Partnering to Minimize the Impact of Data Compromises Brian Thomas Supervisory Special Agent – Group 03 IRS Criminal Investigation

Internal Revenue Service Criminal Investigation Criminal Investigation serves the American public by investigating potential criminal violations of the Internal Revenue Code and related financial crimes in a manner that fosters confidence in the tax system and compliance with the law.

Overview Anatomy of a Hack - Overview The Cyber Crime Threat Cyber Criminal Underground Actions When Compromised Cyber Security Resources

FBI Statistics 438,800,000 319,084,000 Overall 2013 35% Web Application Breaches 8% Insider Misuse Finance 27% Web Application Breaches 7% Insider Misuse IRS-CI Tracking over 200 Preparer and Payroll Service Compromises in 2015

ANATOMY OF A HACK

The Cyber Crime Threat Cyber criminals have adapted to today’s technology in exploiting the cyber arena These groups continually attack systems for monetary gain Malware Botnets Spam and phishing Extortion Identify theft Online fraud and unauthorized transactions

Business E-mail Comprise (BEC) Phishing Scheme “Mary, I want you to send me the list of W-2 copy of employees wage and tax statement for 2015, I need them in PDF file type, you can send it as an attachment. Kindly prepare the lists and email them to me asap. Thanks, CFO.”

BEC Findings Data mining of executives within an organization and disguising e-mail address (Using Social Media). Within 24 hours of the comprise, false returns are being prepared and submitted to IRS. Fraudulent refunds diverted to prepaid cards and RAL checks. Requesting taxpayers’ prior years transcripts. Create fictitious bank accounts in taxpayer’s names. Cloning Taxpayers’ credit cards. Taxpayers receiving refunds to which they are not entitled.

Actions When Compromised Contact IRS Stakeholder Liaison When Compromise Detected Stakeholder Liaison will refer Information within IRS (i.e. Criminal Investigations, Return Integrity & Compliance Services) Follow State Reporting Requirements (i.e. State Attorney General, State Consumer Protection Bureaus, State Police) Report Compromise to FBI, US Secret Service, Federal Trade Commission

Cyber Security Resources United States Computer Emergency Readiness Team (https://www.us-cert.gov/ncas/tips) AICPA Cyber Security Overview:  Available resources to broaden understanding of information security issues and concerns. Cyber Security Fraud What CPAs Should Know Webcast:  This series provides information to help practitioners answer questions about cyber security and fraud. American Payroll Association National Payroll Reporting Consortium

11/6/2018 Cyber Underground

Rules Governing Behavior

Where it all Starts: The Cyber Underground 2002: Less than 12 forums More than 800 Criminal Forums Represent 25+ languages More than 50 roles/specializations Nearly every cyber criminal has a membership on a forum (95%)

Questions?