As the tax year comes to an end for most in the UK, attackers are taking the opportunity to send finance-related phishing attacks.

There has been a 164% increase in tax-related phishing emails since February 2023 and a 32% increase versus 2022 levels.

Below, email security firm Egress outlines a recent phishing campaign that employed social engineering techniques to impersonate HM Revenue & Customs (HMRC).

What the HMRC phishing emails look like

Egress Defend has detected phishing attacks that attempt to obfuscate malicious code to bypass attachment scanning and sandbox technology.

The attackers used a basic HTML template and social engineering techniques: the email contained a brief message that appears to be sent from HMRC, complete with their logo at the top. Often, the attackers impersonate HMRC by using a spoofed email address (statements@gov.uk) as the ‘From’ address and displaying the sender name as ‘GOV UK’. The impersonation tactics are carried out to add legitimacy to the email.

The email body states: ‘If you do not complete the refund form now, you will not be able to claim your annual tax refund online’. This common social engineering technique of including an arbitrary deadline and consequence for inaction (inability to claim the refund) adds pressure on the victim, encouraging them to act quickly and without thinking.

The email text instructs the recipient to complete a form and send it to taxreturns@gov.uk, a seemingly legitimate email address. However, the victim is unlikely to reach this stage as the attachment is a malicious HTML file. Opening the attachment will inject malware into the victim’s machine.

At this time of year, many indivuals are waiting to hear from the HMRC about tax refunds for 2022-23.

Tax-related phishing emails, such as HMRC brand impersonation attacks, are common around end of the tax year.

The HMRC emails analysed demonstrate high levels of social engineering and impersonation. The emails use legitimate logos and were sent from a seemingly legitimate HMRC domains to add credibility. This can make it challenging for a user to identify whether the email is genuine. In the HMRC phishing attack, the cybercriminal has also included an email address that appears to be another legitimate gov.uk address, which the victim is instructed to use to ‘send back the completed document’.

Recommended

• Survey: The Most Desired Benefits for Women in Tech
• DIGIT Leader Summit 2023 | Just Three Days to Go!
• Glasgow Healthtech Firm Gains Notable ISO Accreditation

The attackers have also used a variety of techniques within the email to improve its deliverability, including waiting for the domain age to be older than 60 days and sending previous scouting emails to help build a social graph.

This ensures the actual phishing attack is more likely to be delivered straight to the user’s inbox rather than being sent to the junk folder or quarantined by traditional email security solutions. Even though attackers are using lookalike domains, Egress analyses mails that have passed DMARC authentication, which means it’s more difficult for signature-based anti-phishing technologies to detect them.