Ministry of Finance issues urgent warning over fake tax phishing emails targeting businesses

Recently, online scam tactics have been constantly evolving, with fraudsters gradually shifting their targets to the financial and administrative departments of enterprises and business entities. The Northern Area Directorate of the National Taxation Bureau, Ministry of Finance, has issued a stern warning, pointing out that bad actors have recently been sending phishing emails to specific companies under the guise of tax authorities, with the subject line highlighting "Profit-Seeking Enterprise Income Tax Verification Notice." The National Taxation Bureau emphasized that such emails are typical online scams designed to trick financial personnel into clicking on unknown URL links within the emails or downloading attachments containing malicious software, thereby stealing corporate confidential data or launching subsequent malicious attacks.

Regarding this incident of impersonating the National Taxation Bureau, the bureau further explained the statutory official document workflow of government agencies. When tax authorities conduct important administrative procedures such as profit-seeking enterprise income tax final returns verification, tax investigations, tax retroactive collections, or penalties, they strictly adhere to the provisions of the Administrative Procedure Act and send official paper-based documents by mail. Alternatively, they use the legally established and secure electronic filing and tax payment service website of the Ministry of Finance for lawful and secure inquiries and notifications. The National Taxation Bureau never has—and never will—directly send notification letters containing external links or requesting clicks to view verification results to taxpayers or enterprises via standard email inboxes.

These types of phishing attacks targeting corporate accounting and financial personnel often conceal significant information security and financial risks. When corporate employees carelessly click on unknown links in scam emails, they are very likely to be guided to remarkably convincing fake login pages, prompting them to enter highly sensitive information such as corporate uniform business numbers, certificate passwords, Citizen Digital Certificates, or corporate online banking accounts. If they go a step further and open attached malicious compressed files or documents, it could allow malware or ransomware to directly infiltrate the internal corporate network, paralyze overall operational systems, and cause incalculable commercial losses. Therefore, cybersecurity experts and tax authorities have repeatedly urged enterprises to establish strict cybersecurity awareness and standard operating procedures.

To prevent the spread of similar tax scams, the Ministry of Finance and regional national taxation bureaus have continuously strengthened publicity through various channels in recent years, reminding the general public of taxpayers and business owners to maintain a high degree of vigilance. When receiving any email claiming to be from the National Taxation Bureau, the Ministry of Finance, or other government agencies, individuals must adhere to the "three-no principle": do not click on unknown links, do not open unknown attachments, and do not easily fill in personal or corporate confidential data. If there are any doubts about the content of received emails, the safest and most direct approach is to immediately call the toll-free service hotline of the Ministry of Finance for verification, or directly consult the local branch or collection office of the National Taxation Bureau. Under no circumstances should individuals reply using the contact information provided in the email, so as to avoid falling into the traps set by fraud syndicates.

From a macro perspective, this type of scam tactic reflects the potential threats brought by the heavy reliance of Taiwan's digital economy and corporate operations on the internet environment. As government agencies at all levels actively promote e-government and digital tax services, fraud syndicates have also seized upon enterprises' familiarity with and reliance on digital official documents, using keywords of high concern to businesses such as "profit-seeking enterprise income tax verification" to carry out precision scams. This not only endangers the information security and financial health of individual enterprises, but also poses a challenge to the nation's overall digital trust mechanism. Therefore, the industrial, governmental, and academic sectors must continue to deepen cybersecurity education in the future, enhance the identification capabilities of corporate practitioners, and have government departments strengthen identification mechanisms for digital communications in order to effectively curb endless online fraud crimes.

(Source: Central News Agency)