Income Tax Department Warns of Phishing Emails Causing Refund Delays

(INDIA) — Taxpayers are being targeted by scam messages that pretend to be from income tax authorities, warning of refund delays or verification issues to harvest personal data in 2026.

Cybersecurity officials and tax professionals say the fraud often starts with messages posing as the Income Tax Department, or the IRS in the United States. The goal is usually the same: steal PAN or SSN details, bank information, and login credentials for identity theft.

Many of the messages arrive as phishing emails, smishing texts, or automated calls. They often display official-looking logos, fabricated case numbers, and links that mimic government portals.

Victims who click may be pushed to “confirm” identity details, reset passwords, or “re-validate” bank accounts to release a refund. In many cases, those details can later be used to file fraudulent returns, redirect benefits, or open credit accounts.

Some scams also attempt to pressure immediate payment, claiming penalties or legal action if taxpayers do not “resolve” the issue right away. Tax officials warn that panic is the point.

Fraudsters in 2026 are increasingly tailoring pitches to current tax chatter, including crypto reporting and “resolution” services. A message may cite Form 1099-DA as a hook to claim a mismatch that blocks a refund.

Other campaigns mention Form 1099-G to suggest unemployment benefits were paid in a taxpayer’s name. That tactic can signal identity theft and “phantom income” problems that may take time to unwind.

AI-enhanced fakes are making the fraud harder to spot at a glance. Some calls use realistic voices, while emails and copycat portals can look close to legitimate notices.

A common pattern is an unprompted message that demands quick action and tries to steer the taxpayer away from official channels. Scammers may insist that only their link, phone number, or “agent” can fix the delay.

Scam watchers say the first defense is to treat unsolicited contact as suspicious, even when it uses government branding. A refund update is typically verified by checking status directly on official systems, not by clicking a message link.

Taxpayers in India can verify refund status by going directly to incometaxindia.gov.in. In the United States, taxpayers can use IRS Where’s My Refund through irs.gov rather than any link sent by a stranger.

Requests for PAN, SSN, passwords, or one-time passcodes over email, text, or unsolicited calls are a major warning sign. Many legitimate processes start with official notices and allow taxpayers to verify information without rushing.

Another red flag is urgency that escalates into threats, such as arrest, deportation, or immediate asset seizure. Tax professionals say those pressure tactics are used to short-circuit verification.

Taxpayers can also reduce risk by requesting an IP PIN, or Identity Protection PIN, when eligible. The IP PIN is a tax-authority-issued number that helps block fraudulent filings under a taxpayer’s identity.

Security experts recommend avoiding attachments from unknown senders, even when the subject line mentions a refund. Malicious files can harvest credentials, install malware, or capture stored passwords.

People who already clicked a link may want to act quickly, starting with password changes on any reused credentials. It can also help to review bank accounts and tax accounts for unfamiliar changes.

Reporting can limit harm and help agencies track active campaigns. In the United States, suspicious IRS-related phishing emails can be forwarded to [email protected], and taxpayers can report fraud patterns to the FTC.

Text-message scams can be forwarded to 7726 (SPAM), a reporting shortcode used by many mobile providers. Tax professionals say that step can help carriers block repeat offenders.

For broader reporting in the United States, consumers can file a complaint with the FTC at ReportFraud.ftc.gov. In India, taxpayers can also use official Income Tax Department channels via incometaxindia.gov.in rather than any numbers provided in a suspicious message.

If personal data may have been exposed, consumer advocates often suggest placing a fraud alert with credit bureaus and monitoring statements for new accounts. Businesses may also consider tightening internal controls for payroll and vendor changes.

Tax preparers and finance teams are also targets, because they hold concentrated identity data. Firms are being urged to verify client requests through known channels and to avoid sharing credentials with AI tools or unknown “document helpers.”

Official warnings have been growing more direct as the campaigns scale. The IRS has repeatedly highlighted impersonation and refund-related social engineering on its annual IRS Dirty Dozen list, calling them persistent threats in 2026.

Officials emphasize a basic credibility test: taxpayers should initiate contact through official portals or published channels, not respond to unexpected outreach. Getting an Identity Protection PIN early can also reduce the chance that a criminal files first.

For taxpayers, the central message is simple: a message about refund delays should be treated as a prompt to verify independently, not a cue to click. When in doubt, consult a trusted tax professional before sharing any data, and report suspicious outreach quickly.

This article discusses scams and safety steps; it does not replace professional tax or legal advice.

Verify guidance with official government portals and trusted tax professionals.