Channel NewsAsia reported on 8 June that police are investigating cases of scam emails purportedly sent by the Inland Revenue Authority of Singapore (IRAS) which ask recipients to click on a link to resolve problems with their tax returns.
The link leads to a web page where victims are asked to provide personal and financial details, which may seem perfectly reasonable in the case of the IRAS.
The IRAS had warned against email scams in March 2014, and updated the alert on May 29 not only to describe the ways in which its name has been used to dupe victims, but also the methods by which it does communicate with the public.
According to the IRAS, the fraudulent communications can be through email, printed letters, text messages or even phone calls which may request the victim to:
- Open an email link or file attachment to review the tax payer’s income or tax statement;
- Transfer a sum of money, supposedly for tax purposes, to accounts belonging to named individuals (usually an overseas account); and/or
- Pay sums of money to named individuals (usually a party not residing in Singapore) before an inheritance/estate of a deceased party is released.
- Provide a tax payer’s bank account numbers to claim tax refunds, enjoy cash rewards, or pay outstanding tax bills; and/or
- Provide confidential personal information such as personal particulars, personal identification numbers, passwords and bank account numbers, either by completing a form on a website or to someone who impersonates IRAS staff.
“Please be extra careful when you receive unsolicited emails, letters, SMSes, phone calls, online chats or all other forms of communication asking you to provide confidential or personal information. Under no circumstances should you give personal information including credit card or banking details to third parties via email, letter, SMS or phone,” reads a statement on the IRAS website.
“We would encourage you to use myTax Mail to correspond with IRAS for added security. If your enquiry contains confidential information, we will respond to you via myTax Mail,” the authority said.
In the case of email requests to open a file attachment to view the recipient’s tax refund statement in email, IRAS stressed that it does not send file attachments. In official practice:
- All official emails from IRAS will typically be sent from email addresses ending with “@iras.gov.sg”. They will not be sent from personal email accounts such as Hotmail, Gmail, or other unfamiliar email domains;
- Official payees for a cheque payment for tax are:
Comptroller of Income Tax
Comptroller of Goods & Services Tax
Comptroller of Property Tax
Commissioner of Stamp Duties
- Confidential documents such as tax statements are not sent through unsecured emails, being deposited in the secured tax portal at https://mytax.iras.gov.sg. This requires Singpass to be used to access the document.
- IRAS would also not ask tax payers to provide your confidential personal details through emails.
- Email replies are typically signed with an officer’s name, designation and contact information.
Those who have received suspicious communications should not respond to them or click on any hyperlink in the email, contacting IRAS at firstname.lastname@example.org or on 1800 356 8225 to verify the authenticity of such requests instead, the authority said.
With suspicious phone calls, the caller’s full name, telephone number and department can be validated through the IRAS’ quality service manager (QSM) helpline at 1800 356 8225.
Those who think they may have responded to a phishing scam with personal or financial information, are advised to:
- lodge a police report;
- change the passwords or PINs on all online accounts; and
- contact their banks to stop any transactions.