1. Partnering to Minimize the Impact of Data Compromises
Brian Thomas
Supervisory Special Agent – Group 03
IRS Criminal Investigation

2. Internal Revenue Service Criminal Investigation
Criminal Investigation serves the American public by investigating potential criminal violations of the Internal Revenue Code and related financial crimes in a manner that fosters confidence in the tax system and compliance with the law.

3. Overview Anatomy of a Hack - Overview The Cyber Crime Threat
Cyber Criminal Underground
Actions When Compromised
Cyber Security Resources

4. FBI Statistics 438,800,000 319,084,000 Overall 2013
35% Web Application Breaches
8% Insider Misuse
Finance
27% Web Application Breaches
7% Insider Misuse
IRS-CI Tracking over 200 Preparer and Payroll Service Compromises in 2015

5. ANATOMY OF A HACK

6. The Cyber Crime Threat
Cyber criminals have adapted to today’s technology in exploiting the cyber arena
These groups continually attack systems for monetary gain
Malware
Botnets
Spam and phishing
Extortion
Identify theft
Online fraud and unauthorized transactions

7. Business E-mail Comprise (BEC) Phishing Scheme
“Mary, I want you to send me the list of W-2 copy of employees wage and tax statement for 2015, I need them in PDF file type, you can send it as an attachment. Kindly prepare the lists and them to me asap. Thanks, CFO.”

8. BEC Findings
Data mining of executives within an organization and disguising address (Using Social Media).
Within 24 hours of the comprise, false returns are being prepared and submitted to IRS.
Fraudulent refunds diverted to prepaid cards and RAL checks.
Requesting taxpayers’ prior years transcripts.
Create fictitious bank accounts in taxpayer’s names.
Cloning Taxpayers’ credit cards.
Taxpayers receiving refunds to which they are not entitled.

9. Actions When Compromised
Contact IRS Stakeholder Liaison When Compromise Detected
Stakeholder Liaison will refer Information within IRS (i.e. Criminal Investigations, Return Integrity & Compliance Services)
Follow State Reporting Requirements (i.e. State Attorney General, State Consumer Protection Bureaus, State Police)
Report Compromise to FBI, US Secret Service, Federal Trade Commission

10. Cyber Security Resources
United States Computer Emergency Readiness Team (
AICPA
Cyber Security
Overview:  Available resources to broaden understanding of information security issues and concerns.
Cyber Security Fraud What CPAs Should Know
Webcast:  This series provides information to help practitioners answer questions about cyber security and fraud.
American Payroll Association
National Payroll Reporting Consortium

11. 11/6/2018
Cyber Underground

12. Rules Governing Behavior

13. Where it all Starts: The Cyber Underground
2002: Less than 12 forums
More than 800 Criminal Forums
Represent 25+ languages
More than 50 roles/specializations
Nearly every cyber criminal has a membership on a forum (95%)

14. Questions?