An email claiming to be from the IRS is almost certainly a scam. The IRS does not send unsolicited email asking for personal information, payment, or login credentials, and it does not use email, text messages, or social media to open a conversation about your tax bill or refund.1Internal Revenue Service. Ways to Tell if the IRS Is Reaching Out or if It’s a Scammer If you’ve received an IRS fraud email, don’t click anything in it. Forward it to phishing@irs.gov, then delete it. If you already clicked a link or entered information, the recovery steps below matter more than anything else, and the first few hours count.
How to Tell the Email Is Fake
Start with the rule that makes everything else easier: the IRS opens contact by letter through the U.S. Postal Service.2Internal Revenue Service. How to Know It’s the IRS It will email or text you only if you’ve specifically given permission, with narrow exceptions for criminal investigations, and even those messages point you to a secure government site rather than asking for information directly. So if you never signed up and an “IRS” email shows up in your inbox, that alone is the answer.
Beyond the first-contact rule, fraudulent messages share a handful of patterns.
Urgency and threats. Scam emails demand immediate action and threaten arrest, lawsuits, license revocation, or steep penalties. A real IRS notice gives you time to respond and explains how to appeal.
Generic greetings. “Dear Taxpayer,” “Valued Customer,” or “IRS Account Holder” are mass-mailing tells. A genuine IRS letter uses your name.
Suspicious links and QR codes. Hover over any link before clicking. Legitimate IRS web addresses end in .gov. Anything else, whether .com, .org, or a foreign country code, is a red flag. The IRS flagged QR codes on its 2026 Dirty Dozen scam list because scannable codes now route victims to fake IRS sites built to steal login credentials.3Internal Revenue Service. Dirty Dozen Tax Scams for 2026
Unusual payment demands. Any request to pay by wire transfer, gift card, cryptocurrency, or prepaid debit card is fraud. The IRS accepts payment through IRS Direct Pay, debit and credit cards, digital wallets, checks, and money orders payable to “United States Treasury.”4Internal Revenue Service. Payments
Requests for sensitive information. No real IRS email asks for your full Social Security number, date of birth, or credit card numbers. Even IRS Criminal Investigation agents do not ask for personally identifiable information during contact.2Internal Revenue Service. How to Know It’s the IRS
Why Typos Aren’t Reliable Anymore
Older advice told you to watch for bad grammar and awkward phrasing. That test is losing value. AI tools now let scammers write polished, personalized messages using details scraped from data breaches and public records, so a clean, well-addressed email is not automatically genuine. The IRS reported over 600 social media impersonators during fiscal year 2025, and email scams are becoming more sophisticated on the same curve.3Internal Revenue Service. Dirty Dozen Tax Scams for 2026 The structural red flags above hold up better than spelling checks.
How to Verify Before You Act
If you want to confirm whether the IRS is actually trying to reach you, don’t use any phone number, link, or address in the suspicious message. Go directly to the source.
Log into your IRS Online Account at irs.gov. You can see your balance, any notices the IRS has actually sent you, and your tax transcripts.5Internal Revenue Service. Online Account for Individuals If your account shows no balance due and no notices, the email is fraudulent. Setting up an account requires identity verification through ID.me, which involves uploading a photo ID and either a selfie or a video chat with an agent.6Internal Revenue Service. How to Register for IRS Online Self-Help Tools
If you prefer to call, use 800-829-1040 for general tax account questions. If the message asks you to verify your identity, the Taxpayer Protection Program line is 800-830-5084.7Taxpayer Advocate Service. Identity Verification and Your Tax Return Never call a number that appears in the suspicious email itself.
How to Report the Email
Reporting takes a few minutes and gives investigators the routing data they need to trace the sender.
- Forward the email to
phishing@irs.gov. Use the subject line “IRS” for IRS-related scams or “Treasury” for Treasury-related ones. If your email program has a “Forward as attachment” option, use it, or save the message as a file and attach it. A plain forward works but strips some of the technical headers investigators rely on.8Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages - Report the impersonation to the Treasury Inspector General for Tax Administration at 1-800-366-4484 or through the TIGTA website.9U.S. Treasury Inspector General for Tax Administration. Submit a Complaint
- If you lost money or your device was compromised, file with the FBI’s Internet Crime Complaint Center.10Federal Bureau of Investigation. Internet Crime Complaint Center (IC3)
- Delete the email after forwarding. Don’t reply, don’t open attachments, and don’t click links. Replying confirms your address is active and usually brings more attempts.
If You Already Clicked or Shared Information
This is where the stakes jump. Work through the steps in order.
Secure the Device
Disconnect the affected device from the internet to cut off any active data transfer. Run a full scan with reputable antivirus and anti-malware software. Phishing links can install ransomware or keyloggers that keep capturing information long after you’ve closed the fake page.3Internal Revenue Service. Dirty Dozen Tax Scams for 2026
Change Passwords and Turn On Multi-Factor Authentication
If you entered credentials on a spoofed site, change those passwords now. Include your email, bank, investment accounts, and any other account that shared or reused the password. Enable multi-factor authentication everywhere it’s offered, especially on your IRS Online Account, email, and financial accounts. It’s the single most effective defense against credential theft.
Protect Your Credit
If you entered your Social Security number or other personal information, place a fraud alert with one of the three major credit bureaus: Equifax, Experian, or TransUnion. You only need to contact one; that bureau must notify the other two, and the initial alert lasts one year.11Federal Trade Commission. Credit Freezes and Fraud Alerts
A credit freeze is stronger. It blocks new creditors from pulling your credit report, which stops most fraudulent account openings. Freezes are free under federal law and don’t affect your credit score, but you have to place one at each bureau separately.11Federal Trade Commission. Credit Freezes and Fraud Alerts If your SSN was exposed, the freeze is worth the extra minutes.
File an Identity Theft Report
Go to IdentityTheft.gov and file a report. The site generates an official Identity Theft Report and builds a personalized recovery plan that pre-fills dispute letters and tracks your progress.12Federal Trade Commission: IdentityTheft.gov. Identity Theft Steps For tax-related identity theft, the plan typically includes filing IRS Form 14039 (the Identity Theft Affidavit), placing credit bureau alerts, and contacting the IRS identity theft victim assistance line at 800-908-4490.
Watch Your Accounts
Check bank and credit card statements for unauthorized charges. If you find any, contact the institution right away to freeze the account and open a dispute. Pull your tax transcripts through your IRS Online Account to confirm no one has filed a return in your name.13Internal Revenue Service. IRS Communication on Data Disclosure Look for a return you didn’t file, income you didn’t earn, or a balance due you don’t recognize.
If Someone Already Filed a Return in Your Name
This is the most common endgame for tax phishing. You usually find out when you file your legitimate return and the IRS rejects it because a return with your SSN was already submitted. You might also get a notice about income you didn’t earn or a refund you didn’t request.
File IRS Form 14039 (Identity Theft Affidavit). You can submit it online at irs.gov, by fax to 855-807-5720, or by mail to the IRS in Fresno, California. If you’re responding to an IRS notice, follow the contact instructions on that notice instead. You still need to file your legitimate return on paper, with Form 14039 attached to the back.14Internal Revenue Service. Identity Theft Guide for Individuals To check on your case, call 800-908-4490.
Resolving tax identity theft can take months. Keep filing returns and paying anything you legitimately owe on time while the case moves. The refund statute of limitations doesn’t pause during an identity theft investigation, so don’t wait to claim a refund you’re owed.
Prevent the Next Attempt with an IP PIN
An Identity Protection PIN is a six-digit number that blocks anyone from filing a federal return under your Social Security number without the PIN. Anyone with an SSN or ITIN can enroll.15Internal Revenue Service. Get an Identity Protection PIN (IP PIN)
The fastest route is your IRS Online Account. Log in, go to the IP PIN section of your profile, and the system generates one immediately. The PIN is valid for one calendar year, and you’ll need a new one each January. If you enrolled online, the IRS will not mail it, so set a reminder before filing season.
If you can’t verify your identity online and your adjusted gross income on your last return was under $84,000 ($168,000 if married filing jointly), you can apply on Form 15227. The IRS verifies by phone and mails the PIN in four to six weeks. If neither option works, visit a Taxpayer Assistance Center in person with photo ID.15Internal Revenue Service. Get an Identity Protection PIN (IP PIN)
Parents and legal guardians can request IP PINs for dependents too. Children’s Social Security numbers are frequently stolen and misused for years before anyone notices, so it’s worth doing even without a specific incident.
Don’t Overlook Your State
Everything above is federal. Most states have their own income tax systems, and a scammer with your SSN can file fraudulent state returns as well. The IRS specifically advises identity theft victims to check with their state tax agency for additional steps.14Internal Revenue Service. Identity Theft Guide for Individuals Many states offer their own identity protection PINs or fraud alert systems. Contact your state’s department of revenue directly using the number on its official website.