ZeroFox Intelligence Flash Report - New Tax Fraud Scheme Leveraging Employer Identification Numbers

Product Serial: F-2024-02-14a

TLP:CLEAR

In this flash report, ZeroFox researchers report on a newly disclosed method of leveraging the legitimate gocardless[.]com service to identify corporate employer identification numbers (EINs) to conduct tax fraud schemes, on the Russian-speaking community “Coockie Pro.”

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On February 11, 2024, well-regarded Russian-speaking threat actor “Journalist” disclosed a method of leveraging the legitimate gocardless[.]com service to identify corporate employer identification numbers (EINs) on the Russian-speaking community “Coockie Pro.”
Threat actors can use EINs to create fake tax returns and raise fraudulent tax refund claims on behalf of U.S. companies.
Journalist provided screenshots of the method in action, seeming to successfully obtain the EIN for a U.S.-based construction company.
ZeroFox anticipates schemes of this nature will continue to propagate amongst financially-motivated actors ahead of the April 15, 2024 U.S. tax return deadline. Tax refund and related schemes surge on the deep and dark web (DDW) in the run up tax season in the U.S. year-on-year.