News

Phishers Targeting Your Tax Dollars

A new phishing scam is targeting debit-card accounts used to deliver government benefits payments in 15 states.

E-mails, phone text messages and so-called "vishing" voice-mail messages ask recipients to confirm or update EPPICard account data, directing them to a phony Web site. Once the scammers have gathered the account information, they can drain money from the benefits account.

"They are apparently targeting government payments" such as food stamps and child support payments, said Marc Salomon, a researcher at Cloudmark, an anti-spam company in San Francisco that noticed the attacks earlier this month. "It is the taxpayer who is footing the bill," he said, because the compromised accounts are held by states, not financial institutions.

EPPICard is a magnetic-stripe debit card branded by MasterCard or Visa to access benefits accounts. The cards are used by Florida, Georgia, Illinois, Indiana, Mississippi, Nevada, New Jersey, New York, North Carolina, Ohio, Oklahoma, Pennsylvania, Texas, Utah and Virginia. Each state uses the card to deliver the types of benefits payments it chooses. When a payment has been credited to the account, the holder uses the debit card for purchases and the payment is deducted from the account. Holders also can get cash back from a purchase and withdraw cash at banks and automated teller machines.

The e-mails apparently come from the address [email protected] and direct victims to a phony Web site. "They are hosted on servers around the world," Salomon added.

EPPICard has posted a warning on its Web site of phishing and vishing attacks. "We will never request your personal information, such as a Social Security number, card number or PIN through any of these methods," the company said.

Cloudmark has spotted about 20 of the phishing e-mails and said that number is probably just the tip of iceberg. There is no indication the e-mails are specifically targeting EPPICard users, said Adam O'Donnell, Cloudmark's director of emerging technology. But he said this type of attack against a niche target is likely to become more common as larger targets such as banks and services such as PayPal become over-phished.

About the Author

William Jackson is the senior writer for Government Computer News (GCN.com).

Featured

  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss. (Now updated with COVID-19-related event changes.)

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.

  • Microsoft Closing Most of Its Retail Stores

    Microsoft on Friday announced a major shift in its retail operations, with plans to close most of its physical Microsoft Store outlets in favor of online sales.

  • Matrix

    Microsoft, Harvard Describe Joint Privacy Initiative

    To facilitate data sharing while still preserving data privacy, Microsoft and Harvard have embarked on a set of open source tool called the "OpenDP Initiative."

RCP Update

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.