Soft2Securescam registry · since 2014

IRS refund and "unpaid tax" messages

A refund you are "eligible" for, or a tax debt with a threat, by email, text or phone. The IRS states it does not initiate contact by email, text or social media to request personal or financial information.

Impersonates
IRS
Arrives by
email, SMS, phone call
First seen
not dated
Specimens
0
Updated
2026-09-02

Right now what this family looks like

How to recognise it

  1. First contact by email or text — the IRS starts with a letter
  2. A link to "claim" a refund or a demand for gift cards
  3. Threats of arrest on the phone

What to do

  1. Do not reply or click; forward the email to phishing@irs.gov
  2. Check your account only on irs.gov, typed by hand
  3. Delete it
Already called, clicked or paid? what to do in the next hour
  1. Entered a password? Change it now, and everywhere else you used the same one
  2. Entered card details? Call your bank, ask them to block the card and reissue
  3. Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings

How it changed

nothing to compare yet · no specimen on record
Got a version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry

Family created

Opened at launch from the IRS's own alerts; no dated specimen on record yet — send yours.

Same trick, other brands

Indicators

  • None on record yet. Indicators change weekly; an empty list never means an email is safe.

In other streams

  • Nothing yet.

Registry data

Machine-readable
/scams/irs-tax-refund.json
Timeline feed
/scams/irs-tax-refund/feed.xml
Sources
1 · 1 change logged
Licence
CC BY 4.0 · attribution required
Created / updated
2026-09-02 / 2026-09-02