Original Phishing Message
From: Hackers Linda <Linda.Hackers[@]nelft[.]nhs[.]uk>
Subject: AOTC education credit
Tips for Detection
- The IRS does not initiate contact with taxpayers via email, text messages, or social media. Communication from the IRS is generally via U.S. mail.
- Notice the mismatch of who is sending the email as the signature mentions both the IRS and NHS.
- Hover over the links. Though some go to the legitimate site of id[.]me, one link goes to idme-connect[.]net which is a phishing site masquerading as an id[.]me + IRS site.
Text of Phishing Message
From: Hackers Linda <Linda.Hackers[@]nelft[.]nhs[.]uk>
Subject: AOTC education credit
Dear Staff/students,
We are pleased to inform you that, after the recent annual calculation of your educational expenses, you have been determined eligible to receive an education credit from the American Opportunity Tax Credit (AOTC) in the amount of $2,500.
To ensure you receive your education credits, it is important that you Connect your id.Me account to verify your identity and submit your direct deposit details. Please note that having a verified id.me account is a requirement to claim your credit. If you do not currently have an ID.me account, kindly create one by visiting Create an ID.me account – ID.me
Thank you for your attention to this matter.
Sincerely,
Internal Revenue Service (IRS)
77 K St. NE
Washington, DC 20002
The information contained in this email is intended only for the addressee(s). It may contain privileged and confidential information and, if you are not the intended recipient, you must not read, copy or distribute it, nor take any action in reliance upon it. If you have received this email in error, please inform the sender as soon as possible and delete the email from your computer. Information contained in this email may be subject to public disclosure under the Freedom of Information Act 2000 or the Environmental Information Regulations 2004.
NELFT NHS Foundation Trust