{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2015-irs-get-transcript-abused-to-pull-334-000-taxpayer-transcripts"},"incident":{"title":"IRS 'Get Transcript' abused to pull 334,000 taxpayer transcripts","date":"2015-08-17","date_precision":"day","victim_org":"US taxpayers via the Internal Revenue Service (multi-victim campaign)","sector":"Government","country":"United States","primary_vector":"Credential Phishing Portal","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"No AI involvement; attackers answered static knowledge-based questions.","outcomes":["Data Breach","Identity Theft"],"loss_usd":null,"loss_note":"The IRS did not publish a fraudulent-refund total tied specifically to this incident in the August 2015 disclosure.","records_affected":334000,"threat_actor":null,"summary":"In August 2015 the IRS disclosed that criminals had successfully retrieved prior-year tax transcripts for roughly 334,000 taxpayers through its online Get Transcript service, having attempted access against about 610,000 taxpayers. The Treasury Inspector General later put the potentially compromised total higher. Attackers defeated the service's knowledge-based authentication rather than breaching IRS systems.","how_it_worked":"Get Transcript authenticated the requester with a name, date of birth, Social Security number and filing status, followed by four multiple-choice knowledge-based questions supplied by a credit bureau about matters such as previous addresses and loan amounts. Criminals already holding identity data from earlier breaches supplied the first tier and then guessed or looked up the multiple-choice answers, which were drawn from commercially available credit-header data. Success rates exceeded half of attempts. A retrieved transcript contains the prior year's income and withholding detail, which is exactly what is needed to file a convincing fraudulent refund claim.","lessons":"Static knowledge-based authentication should not gate access to sensitive government records once bulk consumer data is in criminal hands; identity proofing needs a possession or biometric factor.","confidence":"Confirmed","sources":[{"title":"IRS: 330K Taxpayers Hit by 'Get Transcript' Scam","url":"https://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-by-get-transcript-scam/","publisher":"Krebs on Security"}],"entry_type":"campaign","slug":"2015-irs-get-transcript-abused-to-pull-334-000-taxpayer-transcripts","year":2015,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/2015-irs-get-transcript-abused-to-pull-334-000-taxpayer-transcripts"}}