Meet Francis, a failed phisher

07.05.2009
The subject line alone was enough to unmask this criminal mastermind: "This message it is confidential."

This message it is really not from the IRS.

We've all seen cruder and more laughable specimens, but this one caught my eye because it showed up minutes after a call from my wife informing me that our refund check had arrived. That the real tax man would be sending a confirmation e-mail was conceivable for the split second it took me to hop from the phony sender address -- about@irs.taxrefund.gov -- to the stilted "This message it is ..."

Inside, however, we find only the inconceivable.

"This is Francis V. from the Refund Operations Department at Internal Revenue Service (United States Department of the Treasury). After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of $184.23."Bu ... bu ... but, Fran, my man, our accountant -- a fella we've trusted for years -- had calculated our refund at an amount with another digit attached. How could he have gone so far wrong? And, as noted, we've already gotten the check from Uncle Sam.

No matter, Francis V. is on a roll.

"Please submit the tax refund request and allow us 3-9 days in order to process it. A refund can be delayed for a variety of reason. For example (invalid records or applying after the deadline). The good news is that Internal Revenue Service will make this refund directly to your visa and/or mastercard linked to your checking/savings account instead a check or a direct deposit."

Francis V. is from the government and he's here to help. All you have to do is cooperate by following a few simple steps.

"To access the form for your tax refund, please download our secure server form at the attachment file below this letter."

Even in the interest of writing this column, I dared not go near that attachment.

"Important: Do not use credit and/or american express or discover cards. Only cards that are linked to your checking/savings account are accepted."

Experts insist that people fall for this stuff and I'm sure that's true in general. Francis V., however, needs to polish his skills or find another line of crime ... and, according to his online trail, he's been at this since at least 2007.

Yet he is nothing if not polite:

"Regards, Francis V., Internal Revenue Service - Tax Refund Specialist

"NOTE: After all steps are complete, please delete the form & letter from your computer & email."

You can never be too careful, after all, or in the final words from Francis V.: "This details are very confidential!"

Right, absolutely nothing. Yet that lack of any connection did not deter Cyber-Ark Software from sending us a press release today with this laughable headline:

"Cyber-Ark's security helps keep Swine Flu under control"

Uh, how's that? Well, it seems that medical professionals would be incapable of communicating with one another and transferring sensitive patient data electronically without the sense of security offered by this vendor's products.

And we would all have swine flu by now.

Of course, vendors are always trying to attach their wares to the news of the day; we're used to that sort of thing around here

But usually there's at least a germ of a connection.