Tax season has its own rhythm: forms arrive, deadlines close in, and a refund starts to feel like money already spent. That anticipation is exactly what phishing gangs build their campaigns around. A convincing message about a missing refund lands in an inbox that is already crowded with genuine tax paperwork, and the difference between real and fake can be a single character in a domain name. Here is how to tell them apart before you click, and what to do if you already did.
Why Refund Phishing Peaks in Filing Season
Most phishing works on volume and luck. Tax phishing works on context. For a few weeks each year, millions of people are genuinely waiting for money from a government agency, genuinely confused about forms, and genuinely willing to open an attachment labeled "refund statement."
Scammers also know that many people file through an accountant, a payroll portal, or a relative, which makes the message feel plausible: someone else handled it, so an unexpected notice about a missing payment seems normal. Add a deadline — real or invented — and the urge to click without checking gets strong.
The Anatomy of a Fake Refund Email
No two campaigns are identical, but the same pressure points show up again and again.
Sender and domain
Display names are trivially easy to fake. A message can show "Tax Office Refunds" as the name and still come from a free mail account or a lookalike domain such as tax-refunds-portal.support or gov-refund.info. Watch for hyphens, extra words like "secure" or "portal", and endings that are not the agency's real one.
Links and attachments
Hover over a button, or long-press it on a phone, and read the actual destination. Ignore everything before the first single slash after the domain — that part is just a folder path and can say anything. The real question is: does the domain right after https:// belong to the agency, or to someone renting a lookalike?
Attachments deserve the same suspicion. Tax agencies rarely send refund details as a ZIP file, an HTML page, or a document that asks you to "enable content." Those are classic delivery vehicles for malware.
What the message asks you to do
This is the fastest test of all. Legitimate refund processes do not require you to confirm your bank account, card number, national ID number, or a one-time code by email. A request for any of those is the point of the scam, no matter how polished the message looks.
From: Refund Department <refunds@tax-gov-refund.support>
Subject: Action required — your refund could not be delivered
"Confirm your bank details within 24 hours or your payment will be returned."
Red flags in that example, even without seeing the body: a lookalike domain, a deadline, a threat of losing money, and a request to hand over banking details.
- A greeting like "Dear Taxpayer" with no reference number or account detail you can match.
- A reply-to address that differs from the sender address.
- Grammar that slips in a way a real notice rarely would — or, just as often, flawless copy that still asks for credentials.
- A "processing fee" or "release fee" payable by card or gift card. Real refunds are not paid for in advance.
- A link that opens a login page you have never seen, asking for your tax account password.
How to Verify a Sender Domain in Four Steps
- Do not use the link or the phone number in the message. Open a new tab, type the agency's official address yourself, or use an app you already installed.
- Log in to your own account. If there is a genuine refund issue, it will appear there, not only in an email.
- Read the address character by character. A missing letter, an added hyphen, or a different domain ending is enough to make it fake.
- Check the full headers if you use a desktop mail client. You are looking for a mismatch between the visible name and the actual sending domain, and for authentication results that failed.
If you still are not sure, call the agency using a number from its official website. Someone at a contact centre would rather answer a cautious question than process a fraud report.
Refund Texts Are Shorter and Nastier
Text messages compress the same trick into two lines. The signs shift slightly:
- The sender is a random mobile number or a short code you do not recognise.
- The link is shortened, so the destination is hidden until you tap it.
- The message says you must claim, confirm, or update something "before it expires."
- It asks you to reply with a photo of your ID, a screenshot of a code, or your card details.
A real agency or bank will not ask for a one-time code, a password, or a photo of your identity documents by text. If you get a message about a refund you were not expecting, treat it as suspicious until you have checked your account directly.
If You Already Clicked, Replied or Paid
Act quickly and calmly. Speed matters much more than shame here.
- Change the password on your email and on any tax or banking account that shares it, and turn on two-factor authentication where it is offered.
- Contact your bank or card issuer immediately if you entered payment details. Fraud teams can often block or reverse a transaction that is reported fast.
- Tell the tax agency that your identity or account may have been used. Ask what steps it recommends, including any identity protection measures it offers.
- Keep the message, including full headers and the sender's number. It is evidence.
- Expect follow-up attempts. Scammers often call days later, quoting details from the first message to sound official.
For advice on your actual filing situation — amended returns, identity verification, or a suspected fraudulent claim in your name — speak to a qualified tax professional or the agency's own support line.
How to Report a Suspicious Refund Message
Reporting takes a minute and helps protect other people.
- Forward the email to the tax agency's phishing address. Many publish one for exactly this purpose, and the US Internal Revenue Service accepts reports at phishing@irs.gov. Check your own agency's site for the current address.
- Forward spam texts to your mobile operator's reporting short code, where one exists.
- Send the message to your national cyber security or fraud reporting centre, and to your consumer protection authority if money was lost.
- Then delete it. Do not unsubscribe, click "remove me", or reply — that only confirms your address is live.
Build the Habit Before the Deadline
The most reliable defence is a rule you follow without thinking: refund news never arrives by link. If a message says you are owed money, close it, open your tax account the way you normally do, and look there. Set up online access with your tax agency now if you have not already, so checking takes seconds instead of becoming a project. Warn the people around you who are less likely to check — a parent, a first-time filer, a colleague who files late — and tell them what to look for.
Refunds are real, and so are the messages that imitate them. One extra minute of verification costs you nothing; a rushed click can cost a lot more than the payment you were waiting for.
Photo: Mohamed_hassan / Pixabay
