Examples of IRS phishing emails almost always fall into one of three patterns: a threat that you owe back taxes and will be arrested, a message that a refund or stimulus payment is waiting for you, or a warning that your IRS online account has been locked. All three are fake. The IRS does not initiate contact by email, and any unsolicited email asking for your Social Security number, bank details, or login credentials is a scam designed to steal your identity or plant malware on your device.
The Three Phishing Email Templates You’ll See
Scammers aren’t especially creative, which works in your favor once you know the playbook. Nearly every fake IRS email leans on fear, greed, or urgency.
The Arrest or Lawsuit Threat
The most common version claims you owe back taxes and face immediate arrest, a lawsuit, or asset seizure unless you act right now. The language is deliberately alarming. There’s usually a link to “resolve” the issue or a phone number to call. The goal is to panic you into clicking before you think it through. A real IRS collection matter starts with a paper letter, not a countdown clock in your inbox.
The Refund or Stimulus Bait
The second template dangles money. Subject lines read “Tax refund notification” or “Your refund is pending,” and the email asks you to “verify” your bank account or enter personal details to release the funds. It works because people want the money to be real. The IRS does not ask you to confirm banking information by email to receive a refund.
The Account Lockout and QR Code
The third variety targets your IRS online account. The message says your account has been locked, suspended, or flagged for suspicious activity, and it includes a link to a fake login page. Once you enter your username and password, the scammers have your credentials. The IRS’s 2026 Dirty Dozen list warns that these emails now often embed QR codes that redirect to convincing fake IRS sites, which is harder to spot than a hyperlink because you can’t hover over a QR code to preview it.1Internal Revenue Service. Dirty Dozen Tax Scams for 2026: IRS Reminds Taxpayers to Watch Out for Dangerous Threats
Technical Red Flags That Give a Fake Away
Beyond the emotional hook, phishing emails leave fingerprints. A few seconds of checking usually settles it.
The Sender’s Domain
The single most reliable check is the address the email came from. Every legitimate IRS email comes from an address ending in .gov. Phishing emails almost never use .gov because scammers can’t easily obtain those addresses. Instead you’ll see things like “irs-refund.com,” “irs.org,” or slight misspellings such as “irsgov-notice@mail.com.” If the domain after the “@” isn’t irs.gov, it isn’t the IRS.
Suspicious Links and Attachments
Before you click anything, hover your cursor over the link to preview the real destination. Legitimate IRS links go to irs.gov or connect.irs.gov, which the IRS uses for its secure messaging portals.2Internal Revenue Service. LB&I Secure Messaging Anything else is fraudulent. Treat QR codes in unexpected IRS-related messages with the same suspicion. Unexpected attachments are another warning sign; the IRS does not send unsolicited attachments by email, and opening one can install malware.
Grammar, Formatting, and Greetings
Sloppy writing is still a strong tell. Watch for misspellings, awkward phrasing, and distorted logos. Generic greetings like “Dear Taxpayer” or “Dear Customer” are another flag; real IRS correspondence references your name or specific account details.
How the Real IRS Contacts You
Once you know how the IRS actually reaches people, every fake email stands out immediately.
The IRS initiates contact by mail. A letter or notice through the U.S. Postal Service is always the first step for anything involving your tax account, whether that’s an audit, a balance due, or a question about your return.3Internal Revenue Service. Ways to Tell If the IRS Is Reaching Out or If It’s a Scammer The agency will never initiate contact by email and will never require you to communicate by email.4Internal Revenue Service. Sending and Receiving Emails Securely
Email exchanges with the IRS can happen, but only after you’ve already been contacted by mail or phone and have given verbal consent to a specific IRS employee, who verifies your identity by phone before any emails move. This policy is in effect through October 31, 2026.4Internal Revenue Service. Sending and Receiving Emails Securely The IRS also runs a Secure Messaging system, but participation is by invitation only.5Internal Revenue Service. IRS Secure Messaging Help
The IRS will never do any of the following:
- Demand immediate payment by gift card, prepaid debit card, or wire transfer
- Threaten arrest, deportation, or license revocation over the phone or by email
- Leave pre-recorded, urgent, or threatening voicemails
- Ask for credit or debit card numbers by email or phone without prior written correspondence
Any message that does any of these things is a scam, no matter how official it looks.3Internal Revenue Service. Ways to Tell If the IRS Is Reaching Out or If It’s a Scammer If you get a letter that you think might be real but aren’t sure, call the phone number printed on the letter itself. Don’t use a number from the suspicious message.
Text Messages and Phone Calls Use the Same Playbook
Phishing isn’t limited to email. Text scams (sometimes called “smishing”) use the same tactics in shorter form: “IRS Notice: Your refund is pending. Confirm your information here,” followed by a link that can install ransomware or other malware.1Internal Revenue Service. Dirty Dozen Tax Scams for 2026: IRS Reminds Taxpayers to Watch Out for Dangerous Threats The IRS only sends texts to taxpayers who have specifically opted in. If you never signed up, any text claiming to be from the IRS is fake.3Internal Revenue Service. Ways to Tell If the IRS Is Reaching Out or If It’s a Scammer
Phone scams have grown more sophisticated, with AI-generated voice mimicry, spoofed caller ID, and pre-recorded messages that sound convincingly official. Common scripts threaten immediate arrest, demand instant payment, or claim your tax account is under criminal investigation. The IRS identified more than 600 social media impersonators during fiscal year 2025 alone.1Internal Revenue Service. Dirty Dozen Tax Scams for 2026: IRS Reminds Taxpayers to Watch Out for Dangerous Threats
How to Report a Phishing Email
If you receive a suspicious email, don’t click any links, open any attachments, or reply. Forward the whole message to phishing@irs.gov.6Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages
The IRS prefers that you send the suspicious email as an attachment rather than a straight forward, because forwarding strips out header data that investigators use to trace scammers. Most email programs offer a “Forward as attachment” option. You can also save the email as a file and attach that file to a new message to phishing@irs.gov. If neither is available, forward it with as much header information as you can include.7Internal Revenue Service. How to Forward the Header of a Phishing Email
If you actually lost money or had personal information stolen, the IRS also recommends reporting to the Treasury Inspector General for Tax Administration (TIGTA), which investigates IRS-related fraud, and to the Federal Trade Commission through IdentityTheft.gov, which can generate a personalized recovery plan.6Internal Revenue Service. Report Fake IRS, Treasury or Tax-Related Emails and Messages
What to Do If You Already Clicked or Responded
If you clicked a link, entered information, or sent money, take these steps from the IRS identity theft guide:
- Stop all contact with the scammer. Hang up, stop replying, and send no more money or information.
- Run antivirus software on any device where you clicked a link or opened an attachment. Phishing links can install ransomware with no visible sign.
- Change your IRS Online Account password to something complex and unique. Do the same for your email and any other account that shared the compromised password.
- Follow any instructions in an IRS letter or notice you’ve received about the issue.
- Report the identity theft through IdentityTheft.gov for a personalized recovery plan.
- Continue filing and paying taxes normally. Identity theft doesn’t change your filing obligations.
- Check with your state tax agency, since state-level protections are separate from federal ones.
The IRS maintains a full identity theft guide with these steps.8Internal Revenue Service. Identity Theft Guide for Individuals
If your Social Security number was exposed, contact each of the three major credit bureaus (Equifax, Experian, and TransUnion) to place a credit freeze. Online and phone requests must be processed within one business day, and a freeze is free.9USAGov. How to Place or Lift a Security Freeze on Your Credit Report A freeze prevents new accounts from being opened in your name.
Filing Form 14039 (Identity Theft Affidavit) is a narrower step. Most people don’t need it. File Form 14039 only if you can’t e-file because someone already filed under your Social Security number, you receive IRS notices about income you didn’t earn, or a tax account was opened in your name. If the IRS has already sent you Letter 5071C, 4883C, or 5747C, skip Form 14039 and follow the letter instead.10Internal Revenue Service. When to File an Identity Theft Affidavit
Add an Identity Protection PIN for Next Filing Season
An Identity Protection PIN (IP PIN) is a six-digit number the IRS assigns you that must appear on your tax return before the IRS will process it. Without the correct PIN, nobody can file a return using your Social Security number. It’s one of the most effective defenses against tax-related identity theft, and it’s open to anyone with a Social Security number or ITIN who can verify their identity.11Internal Revenue Service. Get an Identity Protection PIN
The fastest route is through your IRS Online Account under the “Profile” page. If you don’t already have an account, you’ll need to register and verify your identity first.12Internal Revenue Service. IRS Online Account and Identity Protection PINs Protect Against Fraudsters If you can’t verify online, two alternatives exist:
- Form 15227, available if your adjusted gross income on your last filed return was below $84,000 (individual) or $168,000 (married filing jointly). You’ll need a phone number where the IRS can reach you to verify identity.11Internal Revenue Service. Get an Identity Protection PIN
- An in-person appointment at a Taxpayer Assistance Center, if you can’t use the online tool, can’t verify by phone, or are ineligible for Form 15227.
The IP PIN changes every year, so you’ll retrieve a new one each filing season. It’s a small annual step that makes fraudulent filing under your name nearly impossible.