The third round of Economic Impact Payments authorized by the American Rescue Plan Act of 2021 was paid as  an advance payment of the tax year 2021 Recovery Rebate Credit.   The IRS began sending these payments on March 12, 2021 to eligible people, most of whom have already received their payment.  However the IRS sent these payments based on information contained in their 2020 income tax returns and many people who filed later including those who just paid in October after getting an extension on the filing date for their 2020 income tax return will be now getting their payment when the IRS processes their 2020 income tax return (which they are doing very slowly).  Scammers are not missing out on this opportunity to scam people or make them victims of identity theft and are capitalizing on interest in these payments by sending emails that appear to come from the IRS asking people to click on links to provide access to a form required in order to authorize the payment.  Other forms of the email provide a link to click on to get help with your payment.  In either case, only bad things can happen if you click on those links.  In some instances, merely by clicking on the link you will download dangerous strains of malware that may include keystroke logging malware that will steal your personal information from your computer and use it to make you a victim of identity theft.  In other other instances, you will be prompted to provide personal information directly that will be used to make you a victim of identity theft.  Copied below is a similar bogus IRS email about which I told you in March.  According to the cybersecurity company Proofpoint which issued a report about this scam, the scammers used email addresses that might appear at first blush to be from the federal government.  Some of the email addresses used are us_irs@federa1.irs.c0m, resecue_plan@federa1.irs.c0m and american_rescure@federa1.irs.c0m.  If you look closely at the email addresses of the sender, however, you will note that rather than the letter “l” in the word “federal,” the digit “1” appears.  Also, each email address ends with .com, but the “o” is replaced with the digit “0.”   If you look closely you will also see the word “quotes” is misspelled.

If you click on the tab marked “get apply form” you will end up downloading a type of malware called Dridex that will steal your personal banking information and other login credentials.

COVID Lure_March_1


The truth is that the federal government is not contacting anyone by email in regard to receiving benefits under the American Rescue Plan, which have been and continue to be sent to the bank accounts of eligible people.  You do not apply for benefits under the American Rescue Plan.  Your stimulus check will be sent to you based on your eligibility as determined from your most recently filed federal income tax return and your payment will be made either electronically to the bank account you indicated in your most recent federal income tax return or sent to you as a paper check or debit card.  You do not need to do anything to apply for these benefits.

For detailed information upon which you can rely, you should go to the IRS’ website where it explains all you need to know about this program.

For information about the status of your specific stimulus payment, you should only go to this IRS interactive website.

For those of you receiving the Scam of the day through an email, I just want to remind you that if you want to see the ever increasing list of Coronavirus scams go to the first page of the website and click on the tab at the top of the page that indicates “Coronavirus Scams.”  Scamicide has been cited by the New York Times as one of three top sources for information about Coronavirus related scams.

If you are not a subscriber to and would like to receive daily emails with the Scam of the day, all you need to do is sign up for free using this link.