Tax season has its own rhythm: forms arrive, deadlines creep closer, and then the email shows up. A refund is waiting. There is a small problem with your return. A payment is overdue. The message looks like it came from the tax office, it uses the right logo, and it is written in the same bureaucratic tone as everything else in your file. That is the point.
Refund phishing is not clever because it is technically sophisticated. It is clever because it arrives at the exact moment you are already thinking about money, deadlines and official paperwork. The goal is almost always the same: get you to type your tax ID, bank details or card number into a page that looks like a government portal, or to send a payment that cannot be reversed.
Why tax refund scams land so often
Three things work in the attacker's favour. First, timing. People expect contact from tax authorities in spring, so an unexpected email does not feel strange. Second, tone. Tax communication is formal and slightly threatening by nature, which means a message that says your refund will expire or your return has been rejected reads as plausible rather than aggressive. Third, volume. These campaigns go out in enormous batches, and the sender only needs a tiny fraction of recipients to act.
The emotional hook matters too. A refund is good news, and good news makes people click fast. A penalty notice is bad news, and bad news makes people click faster. Either way, the message is designed to short-circuit the pause where you would normally stop and check.
The variants you are most likely to see
Most campaigns fall into a handful of patterns. Recognising the shape of the message is often quicker than inspecting every link.
- The refund notification. "You are eligible for a refund of [amount]." A button leads to a page that copies the real tax portal and asks for your national ID, card number or online banking login.
- The rejected return. "We could not process your return. Confirm your details to avoid delays." This one targets panic and usually harvests credentials.
- The penalty or debt threat. A fake overdue balance with a payment link, sometimes offering gift cards, cryptocurrency or a wire transfer as "accepted" methods. Real agencies do not collect that way.
- Accountant and payroll impersonation. A message that appears to come from your accountant asking you to confirm bank details, or from an executive asking payroll to send employee tax forms. Small businesses get hit hard by this one.
- The document share. A link to a "tax document" or e-signature request hosted on a file-sharing service. The file either asks for a login or installs something you did not ask for.
How spoofing hides the real sender
An email has two names for itself: the display name you see and the actual address behind it. Scammers set the display name to something convincing — "Tax Office Refunds", "Revenue Service", your accountant's full name — while the real address is unrelated.
Then come the lookalike domains. Attackers register names that survive a quick glance: a hyphen added, a different country code, rn instead of m, or the official domain tucked inside a longer one so the address reads tax-office.gov.secure-login.example. A useful habit is to read the address from right to left. The part just before the first single slash is the actual site you will land on, and everything to its left is just a subdomain someone else controls.
Check the reply-to field as well. A message can display one address and quietly route replies to another inbox. And remember that a genuinely correct-looking address is not proof of anything: compromised accounts belonging to real accountants and real companies are used for these campaigns every year.
Treat any unexpected message about a refund or a tax debt as a prompt to log in yourself, never as a source of information.
Red flags worth memorising
- Urgency with a deadline: 24 hours, final notice, before your refund is cancelled.
- A request for full card numbers, online banking credentials, or a photo of your ID.
- Payment requested by gift card, cryptocurrency, wire transfer or a payment app.
- A link that goes to a domain unrelated to your tax agency, especially one with extra words, hyphens or odd endings.
- Attachments you did not expect, including "statements" and "refund confirmations".
- Greetings that are generic: "Dear Taxpayer" rather than your name, or your name spelled oddly.
- Small errors that a real agency would not make: the wrong financial year, the wrong currency, a mismatched logo.
Verifying a refund claim in five minutes
The safe path is boring and quick. It also works almost every time.
- Do not click anything in the message. Not the button, not the "unsubscribe" link, not the attachment.
- Open a new tab and type the official address yourself. Better still, use a bookmark you created earlier. Log in to your account and check your return status there. If there is a real refund issue, it will be visible.
- Call only numbers you already have. Use the number on your tax agency's website or on a letter you received, never a number from the email.
- If the message claims to be from your accountant, call them. Use the contact details in your own records and ask directly whether they sent it.
- Check your tax agency's published scam guidance. Most publish current warnings and a reporting address. Rules on how and when they contact you vary by country, so read the version for yours.
- Report it. Forwarding the message to the official reporting address helps investigators and costs you a minute.
If money or legal questions are involved — a disputed balance, a fraudulent filing in your name, a business wire that went out — talk to a bank representative, an accountant or a tax professional rather than working it out from an email thread.
If you already clicked or replied
Act in order, and do not spend time on regret. Change the password for the account you entered, and for any account that shares it. Turn on two-factor authentication. Contact your bank or card provider immediately if you entered payment details, and ask what can be reversed. Report the incident to your tax agency so a fraudulent return or refund claim can be flagged, and check whether yours offers an extra PIN or passphrase for filing. In countries where credit freezes are available, freezing your file with the main credit agencies limits the damage from stolen identity data. Then expect follow-up attempts: once you reply, your address tends to get resold, and a second, better-written message often arrives a few days later.
Make it a seasonal habit
Set one rule for yourself and the whole season gets simpler: never act on tax information that arrives through a link. Log in directly, or call a number you looked up yourself, and let the official record tell you what is true. Bookmark your tax portal now, before you need it. Mention the rule to the people around you who are most likely to be targeted — a parent, a new business owner, anyone filing for the first time. It takes thirty seconds to explain and it scales far better than trying to out-guess every fake refund email that lands in your inbox.
Photo: Leeloo The First / Pexels
