Take Sutton's law, an old crook's advice—"Go where the money is"—and apply it to the fact that times of crisis are also times of prime hunting for fraudsters. And, in this time of crisis, the money is where the Economic Impact Payments (EIPs)
are. This post breaks down some of the common fraud schemes the criminals are using to go after these payments.
The IRS has begun sending EIPs to eligible taxpayers. The EIPs are being disbursed either through direct deposit (via ACH) or by paper check. The first wave, an estimated 81 million payments, went to those who had provided their bank account information when filing their 2018 or 2019 taxes or through other federal programs. The IRS will continue sending payments over the coming months.
The first round of check EIPs were mailed with a pay date of April 24. It is estimated that five to seven million EIP checks will be mailed every week. Mailbox check theft and counterfeit checks are the two biggest concerns for EIP checks. Citizens, retailers, and financial institutions should know how to protect themselves from being victims of counterfeit U.S. Treasury Checks. To mitigate fraud risk, the U.S. Secret Service is partnering with the U.S. Treasury in a Know Your U.S. Treasury Check Campaign 
.
The direct deposit EIPs, which first posted April 15, are proving a little more difficult to combat. While fraudsters may not be able to misroute the EIP funds, they are using phishing emails or vishing calls to pose as EIP recipients' legitimate payments service providers and extracting personal information to facilitate future fraudulent transactions.
So expect a significant increase in account takeover attempts as fraudsters go after these funds. Cash-outs using person-to-person transfer services is often the first-choice channel, especially given the dollar values. Account takeover is often accomplished with social engineering or scams including pleas for help. Anticipate attempts of fraud by fake or spoofed websites, as well as social media messages requesting money or personal information. Some scammers are trying to collect "fees" from consumers to allow them to receive their EIPs. Others are impersonating the IRS in calls, emails, or texts, claiming they need to verify receipt of EIPs by getting financial, banking, or personal information. The IRS does not and will not communicate in this manner.
A further consideration around ACH EIPs is that financial institutions receiving these direct deposits are not required to match the name of the account with the name on the EIP, which means that a recipient's funds could be deposited into another person's account. Taxpayers should be aware that if they provided the account information of their tax preparers (or of the preparers' third-party vendor) on their tax returns, there will be delays in receiving their payments. Compounding this is the risk that those third parties may be unscrupulous and pocket the return money. This has happened with regular tax refunds, but the risk is heightened when so many are experiencing extreme economic hardship.
Stay up to date on trends and report fraud attempts using the following resources:
- FTC Coronovirus EIP Scams and FTC Complaints
- NACHA Current Fraud Threats
- Federal Bureau of Investigation Internet Crime Complaint Center (IC3)—accepts online internet crime complaints
- Internal Revenue Service information about phishing and other scams; forward suspicious emails to phishing@irs.gov
By Jessica Washington, AAP, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed