IRS and HMRC Phishing Scams: How to Spot Fake Tax Emails and Texts

"You have a pending tax refund of $3,847.00. Click here to claim it."

If you've received a message like this, you're not alone. Tax-related phishing scams spike every year between January and April. The IRS reported over 300,000 phishing attempts in recent tax seasons, and HMRC in the UK sees similar volumes. These scams cost taxpayers millions annually.

Common Tax Phishing Methods

1. Fake Refund Emails and Texts

Scammers send emails or SMS messages claiming you're owed a refund. The link leads to a fake IRS or HMRC website that harvests your Social Security number, bank details, and login credentials.

Real IRS/HMRC	Phishing Scam
Never emails about refunds	"Click to claim your refund"
Sends physical letters	SMS with suspicious links
Uses irs.gov / gov.uk	Similar domains (irs-gov.com)
Never asks for passwords	Requires login credentials
References specific forms	Vague "tax refund pending"

2. Fake Tax Software Alerts

Emails impersonating TurboTax, H&R Block, or other tax preparation services. "Your return has an error — log in to fix it."

3. Phone Scams (Vishing)

Callers impersonate IRS agents, threatening arrest or license suspension unless you pay "overdue taxes" via gift cards or wire transfer. The real IRS never demands immediate payment by phone.

4. Tax Preparer Impersonation

Scammers pose as CPAs or tax preparers, offering to file your return at a discount. They steal your SSN and financial data to file fraudulent returns.

How to Spot Tax Phishing

• Check the sender: The IRS uses irs.gov; HMRC uses gov.uk. Any other domain is suspicious
• Look for urgency: "Immediate action required" or "your account will be suspended" are red flags
• Never click email links: Go directly to irs.gov or gov.uk by typing the URL
• Verify by phone: Call the IRS at 1-800-829-1040 or HMRC at 0300 200 3300
• Check for errors: Phishing emails often contain spelling mistakes and generic greetings

Sharing Tax Documents Safely

When sharing tax documents with your accountant, spouse, or financial advisor, sending them via iMessage or email means they sit in your message history permanently. Tax returns contain your SSN, income, and bank details — the keys to identity theft.

LOCK.PUB lets you create a password-protected memo with an expiration time. Share your tax documents through a secure, self-destructing link instead of leaving them in email threads.

What to Do If You've Been Phished

1. Change passwords immediately: IRS Online Account, email, bank accounts
2. Report to the IRS: Forward phishing emails to phishing@irs.gov
3. File an identity theft report: At identitytheft.gov
4. Place a fraud alert: Contact one of the three credit bureaus (Equifax, Experian, TransUnion)
5. Monitor your accounts: Check bank statements and credit reports for unauthorized activity

FAQ

Q: Does the IRS ever send emails? A: The IRS does not initiate contact via email, text, or social media to request personal or financial information.

Q: How do I check if I'm owed a refund? A: Use the "Where's My Refund?" tool at irs.gov or the IRS2Go app.

Q: What's the safest way to send tax documents to my accountant? A: Use LOCK.PUB's encrypted memo feature to share documents with password protection and auto-expiration.

Stay Vigilant During Tax Season

Tax scammers rely on fear and urgency. Always verify directly with the tax authority and never share sensitive information through unencrypted channels. For sharing tax documents securely, LOCK.PUB provides password-protected, expiring links that keep your most sensitive data safe.

Create a secure memo on LOCK.PUB →