TT-CSIRT – 455.20.04.26 – CYBERSECURITY ADVISORY: Phishing Scam Targeting e-Tax Users
The Trinidad and Tobago Cyber Security Incident Response Team (TT-CSIRT) wishes to advise members of the public of an ongoing cyber fraud campaign involving a fraudulent website designed to mimic the e-Tax platform of the Board of Inland Revenue (BIR), Ministry of Finance.
It has been identified that the malicious domain revisar[.]sth[.]tr is being used to impersonate the official e-Tax service. This website is not affiliated with the Government of the Republic of Trinidad and Tobago or the Ministry of Finance.
Additionally, the email address member@surveymonkeyuser has been observed in connection with this scam and is not an official Government email address.
This phishing campaign is intended to deceive individuals into submitting sensitive personal and financial information, including credit/debit card details.
TT-CSIRT strongly urges the public to:
- Verify website URLs before entering any information
- Avoid clicking on suspicious links in emails or messages
- Never share financial or personal information on unverified platforms
- Use only official Government websites and communication channels
For I.T teams, TT-CSIRT recommends that organizations take the following actions immediately block the following malicious domains at firewall, DNS, proxy, and secure web gateway levels:
- revisar[.]sth.tr
- trinidad[.]haje[.]pt
- qtxht8hbb[.]cc[.]rs6[.]net
- 47[.]79[.]149[.]239
What To Do If you suspect compromise
- Reset all potentially exposed credentials
- Contact your financial institution immediately if financial data was shared
- Monitor accounts for suspicious activity
- Conduct a full endpoint malware scan
- Report the incident to TT-CSIRT and the Trinidad and Tobago Police Service (TTPS)
- Report the incident to TT-CSIRT and the Trinidad and Tobago Police Service Cyber Social Media Unit (TTPS CSUM) at: 612-0742 or 715-2072.
TT-CSIRT continues to monitor this threat and is working with relevant stakeholders to mitigate its impact.
If you have any queries, comments or require assistance, please feel free to contact TT-CSIRT via contacts@ttcsirt.gov.tt.
