A spam e-mail message has been sent around the world telling people they are eligible for a $571.94 tax refund from the IRS. The e-mail offers a link to a fraudulent IRS Web site, but the link actually goes through a legitimate government Web site that only last month was promoted by President Bush.

"This is more advanced than the typical phish, because the Web link really does--at first--take you to the real tax benefit Web site," said Graham Cluley, senior technology consultant for U.K. security vendor Sophos. "Unfortunately the way the government Web site has been configured allows the phishers to bounce the unwary in their direction."

The link in the phishing e-mail goes to a forged IRS Web site that asks for a Social Security number, tax return filing code and credit card details including security code and PIN.

The scam takes advantage of a so-called open redirect on the GovBenefits.gov Web site. This open redirect lets anyone craft a link that to the untrained eye looks like it goes to the government site, but actually goes elsewhere on the Web. The following link, for example, goes to CNET News.com:

http://www.govbenefits.gov/govbenefits/externalLink.jhtml?url=http://www.news.com.