IRS Tax Refund Phishing

High SeverityRisingIRS / Tax Refund PhishingVerified 2026-02-28

Fake IRS emails or texts about unclaimed tax refunds, stimulus payments, or tax credits directing victims to phishing sites that harvest Social Security numbers, banking details, and other PII. Tax-related scams cost an average of $8,199 per person in 2024.

Annual Losses

Part of $789M government impersonation total (FTC 2024)

Avg Loss / Victim

$8,199 (2024 average for tax-related scams)

Primary Vector

Email, SMS, phone call

Peak Season

January through April (tax filing season)

How It Works

During tax season, scammers send emails or texts claiming you're owed a tax refund, stimulus payment, or tax credit. The message includes a link to a fake IRS website that looks nearly identical to the real irs.gov. The fake site asks for your SSN, date of birth, filing status, and bank account information for 'direct deposit of your refund.' With this information, scammers can file fraudulent tax returns in your name, steal your actual refund, and commit identity theft.

1Victim receives an email or text claiming a refund, credit, or stimulus payment is available
2Message includes a link to a convincing replica of the IRS website
3Fake site requests SSN, date of birth, bank routing number, and account number
4Scammer uses the data to file a fraudulent tax return in the victim's name
5Victim's real refund is stolen or they discover identity theft when filing their actual return
6Some variants involve fake 'tax preparers' who steal data and charge fees for non-existent services

Example Scam Messages

Hover or tap the highlighted text to see why each element is a red flag.

EXAMPLE 1

IRS NotificationRed flag: The IRS does not initiate contact via email or text about refunds — they send paper notices by mail: You have an unclaimed tax refund of $1,247.00Red flag: Specific amount to seem credible — the IRS would reference this in an official letter for tax year 2025. Claim your refund now before it expiresRed flag: False urgency — tax refunds don't 'expire' from a random text deadline: irs-refund-claim.comRed flag: Fake domain — the IRS website is irs.gov (always .gov, never .com)/verify

“IRS Notification” — The IRS does not initiate contact via email or text about refunds — they send paper notices by mail

“$1,247.00” — Specific amount to seem credible — the IRS would reference this in an official letter

“before it expires” — False urgency — tax refunds don't 'expire' from a random text deadline

“irs-refund-claim.com” — Fake domain — the IRS website is irs.gov (always .gov, never .com)

Red Flags Checklist

IRS contacts you by email or text about a refund

The IRS does not use email, text messages, or social media to discuss personal tax issues. They use the U.S. mail.

Link goes to any domain other than irs.gov

The IRS website is irs.gov — always a .gov domain. Any .com, .org, .info, or other domain is fake.

Request for SSN, bank details, or personal info via a link

The IRS never asks for sensitive information through email or text links

Claims of unclaimed or expiring refunds

If you're owed a refund, it will be processed when you file your return. The IRS doesn't send texts about unclaimed money.

What Real Communication Looks Like

The IRS initiates contact by mail through the U.S. Postal Service. If you're owed a refund, it comes automatically when you file your return. The IRS will never ask for personal or financial information by email, text, or phone. You can check your actual refund status at irs.gov/refunds or the official IRS2Go app.

What To Do

If you just received this message:

Do not click any links

Forward phishing IRS emails to phishing@irs.gov

Check your actual refund status at irs.gov/refunds

Delete the message

If you already clicked or gave information:

If you entered your SSN and personal info: go to identitytheft.gov immediately

File IRS Form 14039 (Identity Theft Affidavit) to alert the IRS

Place a fraud alert or credit freeze with all three credit bureaus

Monitor your IRS account at irs.gov for any unauthorized filings

Where to report:

IRS: forward to phishing@irs.gov

Treasury Inspector General for Tax Administration: tigta.gov

FTC: reportfraud.ftc.gov

identitytheft.gov for identity theft

Frequently Asked Questions

Could the IRS really owe me money I don't know about?

It's possible — for example, if a stimulus payment wasn't delivered. But the IRS communicates this by mail, not text. To check: create an account at irs.gov and view your tax records directly.

Sources

IRS.gov Scam Alerts (2025-2026 Tax Season)
FTC 2024 Fraud Data
Keepnet Labs: Tax-related phishing costs avg $8,199 per person (2024)

Got a suspicious message?

Paste it in and get an instant analysis — free, private, no account needed.

Analyze a Message