New Phishing Scam Impersonates Israeli Tax Authority with Criminal Investigation Threats
A new phishing campaign targeting Israeli citizens is impersonating the Israel Tax Authority, warning recipients of a criminal investigation for alleged tax evasion and artificial actions to gain tax benefits. The fraudulent emails, circulated in recent days, urge recipients to download a malicious file within 72 hours, claiming it contains the investigation report. The messages appear official, signed by a supposed "Head of Enforcement and Investigations at the Tax Authority," but cybersecurity firm BrandShield identified multiple red flags indicating the scam.
The emails originate from non-governmental email addresses and domains not belonging to Israel, use incorrect date formats, invalid fax numbers, contain language errors, and impose suspicious conditions such as requiring the file to be opened only on Windows PCs. The Tax Authority does not notify individuals of investigations via email or request file downloads through links. Official communications direct users to access documents through the government website and secure login systems.
Yoav Keren, CEO of BrandShield, explained that phishing attacks have evolved to use credible scenarios, formal language, case numbers, dates, and legal threats to pressure victims into acting hastily. He emphasized that successful phishing relies on authority, intimidation, and urgency. Keren also noted a rise in government impersonation scams fueled by artificial intelligence tools that enable criminals to produce convincing messages quickly and cheaply.
Cybersecurity experts advise vigilance for suspicious sender addresses not ending with gov.il, urgent demands under threat of fines or criminal probes, requests to download files or click links, inconsistent details, and unusual instructions like "Windows only." The recommended response is to avoid clicking links in such emails and instead access official sites directly by typing their URLs into a browser. Keren summarized that messages pressuring immediate action are likely fraudulent attempts to deceive recipients.
