Hot off the email scam presses comes this newest scam, which claims that “Your Federal Tax Payment ID: 010373 has been rejected.” The “ID number” in the subject line may change, but other than that the variationis will be very similar. This sample comes ‘from’ “CandiceOdell15573@gmail.com”, with a reply-to address of “abrown@mediaeng.com”, but these addresses also may change. In our sample, the link they are trying to get you to click claims to be “http://eftps.gov/R21”, but it really goes to https://web.archive.org/web/20111126005747/http://eftpsid3422.com:80/contacts/s3.
{Ed. note: The scammers are now following up the initial mailings with follow-up mailings that say “SECOND NOTICE: Your Federal Tax Payment has been failed.” They’re an organized bunch!}
In any event, and whatever variation you may see, the bottom line is, it’s a scam. Don’t fall for it, and for goodness sake, don’t click on any links!
Here’s the full text of this very short, but still very malicious, scam:
From: CandiceOdell15573@gmail.com
Subject: Your Federal Tax Payment ID: 010373 has been rejected.
Reply-To: abrown@mediaeng.comThe Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Your Federal Tax Payment ID: 010375120 has been rejected.
Return Reason Code R21 – The identification number used in the Company Identification Field is not valid.Please, check the information and refer to Code R21 to get details about your company payment in transaction contacts section:
In other way forward information to your accountant adviser.
EFTPS: The Electronic Federal Tax Payment System
PLEASE NOTE: Your tax payment is due regardless of EFTPS online
availability. In case of an emergency, you can always make your tax
payment by calling the EFTPS.
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
Hi Anne! Good suggestions – I loved the analysis , Does someone know where I could access a fillable a form copy to fill out ?
*** PLEASE DO NOT RESPOND TO THIS EMAIL ***
Your federal Tax payment (ID: CTDIRS485397521), recently sent from your checking account was returned by the your financial institution.
For more information, please download notification below. (Security PDF Adobe file)
(Google Disk Drive is a file hosting service operated by Google, Inc.)
Transaction Number: CTDIRS485397521}
Payment Amount: $ 5070.31
Transaction status: Rejected
ACH Trace Number: 3333333333
Transaction Type: ACH Debit Payment-DDA
Internal Revenue Service
Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785.
———————————————————————————
*** PLEASE DO NOT RESPOND TO THIS EMAIL ***
Your federal Tax payment (ID: 5RRIRS538401970), recently sent from your checking account was returned by the your financial institution.
For more information, please download notification below. (Security PDF Adobe file)
(Google Disk Drive is a file hosting service operated by Google, Inc.)
Transaction Number: 5RRIRS538401970}
Payment Amount: $ 5621.50
Transaction status: Rejected
ACH Trace Number: 8888888888
Transaction Type: ACH Debit Payment-DDA
Internal Revenue Service
Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785.
I was a little concerned when i got this because i am just wrapping up my amended return. Source country code in header shows as Columbia. The URL link (the ‘Word’ document) appears to point to: estacaoboliche.com/br/inforet.html.
Your federal Tax transaction (ID: 0809340646623), recently initiated from your bank account was returned by the The Electronic Federal Tax Payment System.
Canceled Tax transaction
Tax Transaction ID: 0809340646623
Return Reason See details in the report below
Tax Transaction Report tax_report_0809340646623.doc (Microsoft Word Document)
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
I thank you guys so much god is so good thank you?
Rejected Federal Tax transaction
From
Internal Revenue Service alerts@irs.gov
Your federal Tax payment (ID: 2619375961107), recently initiated from your bank account was canceled by the your financial institution.
Canceled Tax transaction
Tax Transaction ID:
2619375961107
Return Reason
See details in the report below
FederalTax Transaction Report
tax_report_2619375961107.doc (Microsoft Word Document)
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
Here’s the one i got:
Your federal Tax transaction (ID: 70547105942843), recently initiated from your checking account was rejected by the The Electronic Federal Tax Payment System.
Rejected Tax transaction
Tax Transaction ID: 70547105942843
Reason for rejection See details in the report below
Tax Transaction Report tax_report_70547105942843.doc (Microsoft Word Document)
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
Your Tax transaction (ID: 87059803285972), recently initiated from your bank account was rejected by the your financial institution.
Rejected Tax transaction
Tax Transaction ID: 87059803285972
Return Reason: Loading… Please wait…
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
This is the emaila nd letters I am getting. WHY don’t they have my TIN or SS number from when I set up the account???? Is this real?
IMPORTANT MESSAGE FROM YOUR MERCHANT SERVICES PROVIDER
We understand that you have closed your account with us in 2011. However under new federally mandated Internal Revenue reporting regulations, we are required to maintain our records on your account until the close of the year and report your 2011 calendar year processing activity to the IRS.
Action Required
The Internal Revenue Code Section 6050W requires us to compare the Tax Identification Number (TIN) and legal business name in our records to the information on file with the IRS. The IRS has indicated that its information does not match our records.
To avoid unnecessary tax liability, it is very important that you provide the correct legal business name and TIN that is used when filing your tax return for your business. Please visit the secure merchant portal below to update our records.
The login screen will require you to enter:
Username: Merchant Identification Number (MID)
Password: The last 4 digits of the primary account holder’s Social Security Number
Thank you for your assistance to ensure compliance with this federally-mandated information reporting requirement. To contact an IRSTINcheck representative, call 855-649-2633 or email custservice@irstincheck.com.
Please contact a tax professional if you have questions regarding the new Internal Revenue Service Section 6050W requirement.
Sincerely,
Program Compliance Department
North American Bancard
I usually pride myself for not falling for this stuff, but I’m in the accounting business and am always making payments to the IRS on behalf of my clients. I clicked on the link. Now what do I do?
We received one from the IRS this morning and immediately reported it to the IRS then deleted it, as we had previously received another that came from NACHA…same set up and we found out it was also a scam. All these are coming thru as if they are from official entities. Scary…
I just got one that appears to be new is has the email status@irs.gov with aip file calculations 9026 and the email reads :Notice,
There are arrears reckoned on your account over a period of 2010-2011 year.
You will find all calculations according to your financial debt, enclosed.
You have to sick the debt by the 17 December 2011.
Sincerely,
IRS.
I forwarded it to the real IRS …thanks for this site
P.S. I forwarded both of them to phishing@irs.gov
I got two of these, and was immediately suspicious since they went to an email address I haven’t used in years. Both appeared to contain .pdf file “tax reports” saying my bank had cancelled a transaction, but mouse hovering over said reports indicated one was a link to and the other a link to SPAM!/SCAM! ALERT!
Your federal Tax transaction (ID: 036810850054), recently initiated from your checking account was rejected by the your financial institution.
Rejected Tax transaction
Tax Transaction ID: 036810850054
Rejection Reason See details in the report below
Tax Transaction Report tax_report_036810850054.pdf (Adobe Acrobat Reader Document)
Using the Electronic Filing PIN
After you get your Electronic Filing PIN, enter it in the ?ectronic Filing PIN?ield when filing your return. The Electronic Filing PIN is a temporary PIN used by the IRS to verify your identity when you e-file. Keep a copy of your signed tax return for your records.
Note: If you have trouble while using this application, verify system availability and specific browser and system requirements.
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
Just received a very similar scam email this morning, went online to check, and this site jumps on top. Really good information offered here at Internet Patrol, thanks!
Thanks for this updated blog/post. This email looked pretty authentic. The 2 things that stopped me in my tracks:
1 – It had a FROM address of Ruben_Fisher@irs.gov which looked pretty real.
2- There was no attachement but in the body of the email,it had a link to a PDF file.
Didn’t do anything so not sure where it goes.
Thanks for the help.
From: “Arthur_Burnett@irs.gov”
To:
Sent: Friday, September 30, 2011 8:22 AM
Subject: Federal Tax transaction canceled
Your Tax payment (ID: 732211882896), recently from your bank account was rejected by the your Bank.
Rejected Tax transfer
Tax Transaction ID: 732211882896
Reason of rejection See details in the report below
Tax Transaction Report tax_report_732211882896.pdf (Adobe Acrobat Reader Document)
No need to file a Form SS-4. We ask you the questions and you give us the answers. After all validations are done you will get your EIN immediately upon completion. You can then download, save, and print your EIN confirmation notice.
This EIN is your permanent number and can be used immediately for most of your business needs, including opening a bank account, applying for business licenses, and filing a tax return by mail. However, no matter how you apply (phone, fax, mail, or online), it will take up to two weeks before your EIN becomes part of the IRS’ permanent records. You must wait until this occurs before you can file an electronic return, make an electronic payment, or pass an IRS Taxpayer Identification Number matching program.
Due to a high volume of requests for EINs, the IRS will begin limiting the number of EINs assigned per day to a responsible party. Effective April 11, 2011, a responsible party will be limited to five (5) EINs in one business day. This limit is in effect whether you apply online, by phone, fax or mail.
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
I got the email directly in my junk folder, and only viewed it from postini. Looks like it’s getting more authentic with the irs.gov domain.
Date: Thu, 29 Sep 2011 15:30:41 +0100
From: Trey_Shepherd@irs.gov
Subject: Federal Tax transfer rejected
Your Tax payment (ID: 814643023218), recently initiated from your bank account was canceled by the your financial institution.
Canceled Tax transfer
Tax Transaction ID: 814643023218
Return Reason See details in the report below
Tax Transaction Report tax_report_814643023218.pdf (Adobe Acrobat Reader Document)
Attention Tax Exempt/Non Profit Organizations
At the beginning of the online EIN application process, you will be asked to check a box that best describes your legal structure. The legal structure for all Tax Exempt/Non Profit Organizations is found under the 7th option, “View Additional Types, Including Tax Exempt and Governmental Agencies.” Non-profit organizations include corporations, trusts, limited liability companies, and unincorporated associations that qualify for tax-exempt status under Internal Revenue Code (IRC) 501(a) as described in Publication 557 (Tax-Exempt Status for Your Organization).
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
I just got 1 in my spam box funny thing is ALL my .gov goes to my inbox and I have no bank Account forwarded it to irs phishing email
I rec’d two of these emails in my “Spam” box.
Date: Tue, 27 Sep 2011 08:40:23 -0300
From: Brad_Knapp@irs.gov
To:
Subject: Rejected Federal Tax payment
Your federal Tax payment (ID: 20186101160203), recently initiated from your bank account was returned by the your financial institution.
Canceled Tax transfer
Tax Transaction ID: 20186101160203
Reason of rejection See details in the report below
Tax Transaction Report tax_report_20186101160203.pdf (Adobe Acrobat Reader Document)
You can avoid unnecessary penalties and interest by paying your taxes in full and on time. This application will allow you or your authorized representative (Power of Attorney) to apply for an installment agreement if you cannot pay your taxes in full.
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
Date: Wed, 28 Sep 2011 04:01:17 -0800
From: Carmen_Mooney@irs.gov
To:
Subject: Rejected Federal Tax transfer
Your Tax transaction (ID: 67516845468680), recently from your checking account was returned by the your financial institution.
Canceled Tax transaction
Tax Transaction ID: 67516845468680
Reason of rejection See details in the report below
Tax Transaction Report tax_report_67516845468680.pdf (Adobe Acrobat Reader Document)
Important Information for Home-care Service Recipients
If you are a home-care service recipient who has a previously assigned EIN either as a sole proprietor or as a household employer, do not apply for a new EIN. Use the EIN previously provided. If you can not locate your EIN for any reason, follow the instructions on the Misplaced Your EIN? Web page.
If you are a home-care service recipient who does not have an EIN, do not use the online application to apply for one. You must apply for your EIN using one of the other methods (phone, fax or mail). For additional information, visit the How to Apply for an EIN Web page.
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
THESE PEOPLE SO NEED TO GET A LIFE!
I received the same email
received same email from Dillon_marin@irs.gov on 8/4/11
I received the same email. Thanks for being so up-to-date on your site! Also from an IRS dot gov address… Your federal Tax transaction (ID: 421711781190), recently sent from your checking account was canceled by the your Bank.
Rejected Tax transaction
Tax Transaction ID: 421711781190
Reason for rejection See details in the report below
Tax Transaction Report tax_report_421711781190.doc (Microsoft Word Document)
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
Mine just arrived, also allegedly from an irs.gov address. It had a .doc attachment but the address at the bottom to the same Landover, MD address. On mine, the graphic (which, I assume, should have been an IRS logo) did not open.
The IRS emails sent out in the last 2-3 days (21 June+) link to a “PDF” file – actually serious malware. More info about the malware is here:
I received an email yesterday from an Orville_Diaz@irs.gov saying the same thing—scared me for a minute but glad to see that you all have posted this as a scam. Thanks!
I received this email at my work. The email is from a Williams_Vincent@irs.gov. I sent the email to the IRS phishing (phishing@irs.gov). Thanks for keeping this site so up to date.
Thanks! Was about to panic!
Wouldn’t this be considered a Federal crime??? Impersonating a Federal agency???
Why isn’t the FBI all over this???
The email I got actually ended with irs.gov. I knew it was a scam because I have not done any tax transfers.
Thanks to you !!!! You are doing great work here. I appreciate it very much
I clicked on the .exe file. Any ideas what it is and what I now need to do to make sure my computer is not infected?
I’ve received two of these this week (so far). Interesting that the mail comes from “irs.gov.” I forwarded the link to phishing@irs.gov. Did NOT open the .exe attached!
I received a letter today from Amerilife International Lotto Inc. stating I had won $50,000 and to call their office in England at 011-447-986-318-042. Is this a scam?
It’s a bit more formal looking than your sample, with an excellant .pdf of the IRS.gov logo. It directs the reader to an attached .pdf (self-extracting doc). Perports to refer to the 13 digit tax transaction that has been rejected. Got it today.
I received one today at my work email, but it struck me as odd because it has an irs.gov email as the sender.
Emerson_Hawkins@irs.gov
Your federal Tax payment (ID: 87827471468057), recently sent from your checking account was canceled by the your Bank.
Rejected Tax transaction
Tax Transaction ID: 87827471468057
Rejection Reason See details in the report below
Tax Transaction Report tax_report_87827471468057.pdf.exe (self-extracting archive, Adobe PDF)
Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785
I just wanted to check, but I then realized that the IRS had cashed my check, with legal tender for all debts public and private by removing the amount I put on the check from my bank account.
I got 2 of these this week. Thanks for the scam alert!
I got one today … look at the spelling , maybe this one is real?
Your Federal Tax Payment ID: 01037593212 has been not accepted.
Pelase, make sure that all inforamtion you have submtited is correct and refer to Code R21 to find out the niformation about cmopany pyament. Pelase cnotact this page if you have any questions:
Reutrn Reason Code R21 – The identiifcation nmuber you entreed in the Cmopany Identfiication Feild is not functional. Try senidng ifnormation to your acconutant adivser using other optoins.
EFTPS: The Electronic Federal Tax Payment System
WARNING!
You are uisng an Ofifcial United States Government System, which may be used only for authroized purposes. Unauthorized modification of any information stored on this ssytem may result in criminal prosecution. The Govenrment may monitor and audit the usage of system, and all perosns are hereby notified that the use of this system contsitutes cosnent to such monitoring and auditing. Unauthorized attempts to upload inforamtion and/or change information on this web site are srtictly prohibited and are subject to porsecution under theComupter Farud and Abuse Act of 1986 and Title 18 U.S.C. Sec. 1001 and 1030.
I have recieved many of these over the last week, 3 today infact. As Denise P said, very official looking. This is the header, not the from and return adddresses!!!
Return-path:
Envelope-to: robert.c@XXXXXX.com
Delivery-date: Mon, 18 Oct 2010 08:12:15 -0500
Received: from [78.31.79.135] (port=63054)
by modelt.websitewelcome.com with esmtp (Exim 4.69)
(envelope-from )
id 1P7pVe-0001rN-NJ
for robert.c@site.com; Mon, 18 Oct 2010 08:12:15 -0500
Received: from 78.31.79.135 by ; Mon, 18 Oct 2010 16:12:15 +0300
Date: Mon, 18 Oct 2010 16:12:15 +0300
From: “EFTPS Tax Payment”
X-Mailer: The Bat! (v2.00.6) Educational
Reply-To: customers3326@eftps.gov
X-Priority: 3 (Normal)
Message-ID:
To:
Subject: Uregnt. Your Tax Payment ID: 0103344463 has been rejected.
MIME-Version: 1.0
Content-Type: text/html;
charset=”us-ascii”
Content-Transfer-Encoding: 7bit
Thanks for the info. I actually got this email today, only mine has the sender’s email addres with a “.gov” and references US Code at the bottom. VERY official looking.
Thanks,
yes it was good to quickly find out that it is a scam. Specially for us in scandinavia who does not have english as a first language.
Thanks!