Three days ago, I received this email claiming to be from Internal Revenue Services (IRS), Department of the Treasury. The email has the following content:

Subject: IRS e-file refund notification

The body of the email contains:
—————————————————-

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive 387.6$ tax refund under section 501(c) (3) of the Internal Revenue Code. Please submit the Tax Refund Request Form and allow us 3-9 days to process it.

Yours faithfully,
Sarah Hall Ingram, Commissioner

This notification has been sent by the Internal Revenue Service, a bureau of the Department of the Treasury.

—————————————————-

At first, I got excited about it thinking I am eligible to receive $387.60. Wowowoweee! That’s a lot of money when converted to Philippine currency.

But then I had a second thought…

How come I am entitled for a tax refund from IRS since I don’t live in the U.S. plus I don’t remember signing-up any form from IRS.

So I googled the term “IRS Tax refund” and I found some sites discussing the same issue. The email is a form of email spam and when you click on the link “Tax Refund Request Form”, you will get a blank browser window. It may look as if nothing is happening but behind it a malicious code is downloading and installing a variant of the Win32/Zbot malware family into your computer.

For a more detailed discussion, go here.

Win32/Zbot malware is effective in stealing cached passwords, login credentials and data in certificates and cookies. As of October 2009, Win32/Zbot is currently listed as one of the top 10 most prevalent malware threats.

So again guys, please be very careful when opening suspicious emails to avoid getting your computer infected with viruses like Win32/Zbot.

Navigate your mouse pointer above the link included in the email but don’t click on it. This is for you to see where the link will take you when you click it. Usually, the link is displayed below the browser window. If you see the link is something like “fishy”… delete the email immediately.

Again guys… “If its too good to be true, its possibly a scam”. Oki doks?