Another version of the IRS attack was done using emails that instead of threatening people offered them some unimaginably good offers. Victims have said that they have received emails allegedly from the Taxpayer Advocate Service, an IRS department that deals with tax disputes or complications. The emails have been claimed to state that there was an issue with a target's taxes, and they are set for a big refund. They say that the refund will be deposited directly to a target's account, and all that is required is some information to facilitate this. The information that they ask for however is concerning. They ask for PIN codes, passwords, and other bank account information to enable this refund to be deposited. Eager to receive this refund, victims are said to have given out this sensitive information. What then happened was that the hackers proceeded to empty the victim's bank accounts.

Looking closely at this attack, the pretext was still that of the IRS but on a softer note. The emails were, therefore, appealing to the targets rather than threatening them. Again, the attackers employed some research so as to find out some background information about the targets and so as to give more credibility to the attack. The targets also used logical conclusions. They explained that they just needed the target's personal information to help them complete the issuance of refunds. The success rate for this attack was still high as people were excited to get the monies promised by the IRS: