Warning From the U.S. Department of Education

Federal Student Aid (an office of the U.S. Department of Education), has issued a warning related to an ongoing IRS impersonation scam, as seen here and copied below. Students and employees at institutions with ".edu" email addresses are particularly at risk of being targeted with these scams. SPU students, faculty, and staff should be watchful of for any emails that appear to be from the IRS and claim to disclose information about your "tax refund payment" or "recalculation of your tax refund payment." If you receive an email like this, please delete it and do not click on any links. Contact CIS with any questions.

Notice from the U.S. Department of Education follows:

The Internal Revenue Service (IRS) posted a warning of an ongoing IRS impersonation scam that appears to primarily target educational institutions, including students and staff of institutions that have ".edu" email addresses.

The Treasury Inspector General for Tax Administration and IRS Criminal Investigation has been notified about the suspicious emails that display the IRS logo and use various subject lines, such as "Tax Refund Payment" or "Recalculation of your tax refund payment." The emails ask individuals to click a link and submit a form to claim their refunds.

The phishing website requests that taxpayers provide the following information:

• Social Security Number (SSN)

• First Name

• Last Name

• Date of Birth

• Prior Year Annual Gross Income

• Driver's License Number

• City

• State/U.S. Territory

• ZIP Code/Postal Code

• Electronic Filing PIN

The U.S. Department of Education encourages institutions to visit the IRS web page—irs.gov/newsroom/irs-warns-university-students-and-staff-of-impersonation-email-scam—which contains details about the phishing campaign. We also ask that you share the web page widely with students and staff to raise awareness about this scam.

Recipients of this scam email should not click on the link in the email, but they can report it to the IRS. For security purposes, recipients should save the email using the "save as" feature and send that file as an attachment or forward the email as an attachment to phishing@irs.gov.

Taxpayers who believe they may have provided identity thieves with their information should consider immediately obtaining an Identity Protection (IP) PIN. An IP PIN is a six-digit number that helps prevent identity thieves from filing fraudulent tax returns in a victim's name. This is a voluntary IRS opt-in program.

Taxpayers who attempt to e-file their tax return and find it rejected because a return with their SSN already has been filed should file an IRS Form 14039, Identity Theft Affidavit, to report themselves as a possible identity theft victim. To learn about the signs of identity theft and actions to take, visit the Identity Theft Central web page on irs.gov.

If you believe your institution has been targeted or breached, report the incident immediately to CPSSAIG@ed.gov and FSASchoolCyberSafety@ed.gov. Include the following:

• Name of the institution

• OPEID – School Code

• Date the incident occurred (if known)

• Date the incident was discovered

• Technical details of the incident (if known)

• Extent of the impact

• Remediation status (what has been done since discovery)

• Institutional points of contact

Thank you for your attention to this matter. Federal Student Aid is committed to working with institutions to combat cybersecurity attacks and protect student financial aid information. If you have questions about the information included in this announcement, please email FSASchoolCyberSafety@ed.gov or call 202–377–4697 between 7 a.m. and 5 p.m. Eastern time Monday through Friday. We look forward to working with you and thank you in advance for your efforts to safeguard student information and secure your institution.