As a rule, phishing emails use elements of threats or scaremongering. The recipient's property (money) is said to be confiscated or has already been confiscated. But here it works the other way around.

A tax refund serves as bait, conveniently disguised as an email from the Federal Central Tax Office. But you can only get these taxes back if you also provide your bank details online. How practical if there is already a link included.

alih1
(Screenshot by Ali Hygazi)

In plain text the email says:

Federal Central Tax Office

According to the last annual calculations of your business activity, we have determined that you are entitled to a tax refund of 219.55 EURO. You have attached the tax return form with the tax refund number: ID:38171DE6214. Please complete the attached tax return form. After filling out the form, submit it by pressing submit and then wait 5-9 business days for us to process it.

Access tax refund

The Federal Central Tax Office (BZSt) Federal Central Tax Office
With kind regards,

your business activity

Luckily, the scammers keep making small mistakes. Spelling and formal errors have become rare, but can still be found.

However, anyone who follows this email, blinded by the windfall and new wealth, will end up on the phishing site.

This is not the BZSt

alih2

You are asked, somewhat strangely, to choose a bank of which you are a customer. After the selection, the page expands to include an input field.

alih3

At this point the warning again: stay away! Under no circumstances should you provide your own details.

This page is then followed by another, quite bold, input form.

alih4

This form actually asks for all the data that strangers can use to cause great damage. Then you are hypocritically directed to the correct page of the Federal Central Tax Office.

alih5

In an emergency

Anyone who has fallen for a phishing email should do so immediately

– change the password in all services in which it is used
– notify your own bank/credit card company that you have fallen for phishing
– report suspicious movements on accounts immediately
– watch out for direct debits that suddenly appear

Author: Andre, mimikama.org

Notes:
1) This content reflects the current state of affairs at the time of publication. The reproduction of individual images, screenshots, embeds or video sequences serves to discuss the topic. 2) Individual contributions were created through the use of machine assistance and were carefully checked by the Mimikama editorial team before publication. ( Reason )