Does IRS Direct Pay use Bank of America or is this a scam?

Question

I went onto the IRS website today to make a payment. In the security part of the address bar it is written Bank of America:

My question is this: Is this truly the IRS payment site, or some kind of scam?

Answer 1

Yes, this is the real IRS payment site. The IRS uses Bank of America as its payment processor. From this Department of the Treasury document (PDF):

Bank of America is the EFTPS Financial Agent (FA) that processes and financially settles the various Federal tax payment types.

The EFTPS is the Electronic Federal Tax Payment System, which I suspect is the backend for other IRS direct pay options. Additionally, if you go to this exhaustive description of electronic methods of tax payments from the IRS, they will also tell you that Bank of America is acting as the federal government's agent in regards to tax collection (repeatedly).

Thinking about it logically, note that there's a valid Bank of America certificate on the site. Therefore, the site is either legitimate or it's a scam being pulled off by Bank of America itself. But there's no reason why Bank of America would try to dupe people into paying taxes to it; given the size of Bank of America, the punishment for being found to carry out such a fraud would be far, far larger than the payoff. So we can conclude that it is almost certainly not a scam (as it indeed is not).

Answer 2

It seems legit. The IRS must have contracted this out to BOA.

Answer 3

If the URL you are visiting ends "irs.gov", then yes, that's really the IRS. A domain of "xxx.irs.gov", where "xxx" can be anything, is still the IRS. And the same for any other domain name. "xxx.yyy.com" is owned by the same people who own yyy.com.

Watch carefully for typos. There are scammers out there who get domain names with slight misspellings, like "amazom.com" instead of "amazon.com", making their scam site look like the real site. So if you mistype then you land on their site. It looks right, you type in your ID and password or credit card number and they take your money.

Another trick is to put the name of the real organization at the beginning of the domain name, like "bankofamerica.hacker.com". It's the end of the domain name that matters. That domain would be owned by hacker.com, not Bank of America. Sometimes they'll give very long domain names to confuse you, like "bankofamerica.com.login.account.management.northwest.hacker.com", hoping you'll quit reading after a certain point or it won't fit in a text box and you think it ended, etc.

My favorite scam email ever: I got an email claiming to be from my county courthouse that said that I was the target of a lawsuit and the legal documents were attached. I was suspicious for three reasons:

1. Attachments from unknown sources are often viruses.

2. The text of the email did not contain any specific information other than my email address. It didn't include my name or street address, or even the name of the county, i.e. it said "County Courthouse" not "Monroe County Courthouse". This seemed unlikely, more like they just got a bunch of email addresses and wrote one generic email.

3. One other subtle clue was that the 'From' address on the email was "sugardaddiesgalore.com". I don't know what the domain name of my county courthouse is but I'm going to go out on a limb here and say that it is probably not sugardaddiesgalore.com.