Yes, tax refund scams are active and they work by impersonating the IRS or tax software companies

Tax refund scams are real and running constantly. The most common version arrives as a text, email, or call claiming you have a refund waiting, a problem with your return, or a security issue with your account. The message includes a link or phone number. If you click or call, you land on a fake IRS website or speak to someone posing as an agent who asks for your Social Security number, date of birth, bank account details, or PIN.

The scammer's goal is straightforward: steal your identity or your actual refund money. Once they have your Social Security number and date of birth, they can file a fraudulent return in your name and claim your refund before you do. If they get your bank details, they can drain your account or set up unauthorized transfers. If you give them access to your tax account, they change your password and lock you out.

These scams work because they create urgency and impersonate a source you trust. The IRS itself does not initiate contact by text, email, or unsolicited phone call. That fact alone tells you whether a message is real.

Key Takeaways

  • The IRS never contacts you first by text, email, or phone call about a refund or account problem—any message claiming to be from the IRS through those channels is a scam.
  • Scammers use fake websites that look nearly identical to irs.gov or tax software sites, so do not click links in unsolicited messages even if they look official.
  • If you have already given a scammer your Social Security number or filed a return, report it to the IRS Identity Theft hotline at 1-800-908-4490 and file a police report when ready.
  • The real IRS will contact you by mail if there is a problem with your return, and you can verify any claim by calling the IRS directly at 1-800-829-1040 using a number you find yourself.
  • Tax software companies like TurboTax, H&R Block, and TaxAct also do not contact you unsolicited about refunds or account issues.

How these scams arrive and what they ask for

Scammers send text messages that say things like "IRS: Your refund is ready. Claim it here" with a link. Emails arrive with subject lines like "Action Required: Verify Your Tax Account" or "Your Return Was Rejected." Phone calls come from numbers that look like they could be government offices. All of them push you toward clicking a link, calling a number, or visiting a website where you enter personal information.

The information they ask for falls into two categories. First, identity details: your full name, Social Security number, date of birth, address, and driver's license number. Second, financial access: your bank account number and routing number, your PIN or online password, or permission to access your tax account. Some scammers ask for all of it. Others start with just your Social Security number and date of birth, which is often enough to file a fraudulent return.

A variation targets people who use tax software. The scammer sends an email that looks like it came from TurboTax, H&R Block, or TaxAct, saying your account has been locked, your refund is delayed, or there is a security issue. The link goes to a fake login page that captures your username and password when you enter them.

What happens if you have already given them information

If you gave a scammer your Social Security number and date of birth, they can file a fraudulent tax return in your name and claim your refund. If you gave them your bank account details, they can attempt transfers or set up unauthorized charges. If you gave them your tax account password, they can change it and lock you out of your own account.

The damage is not always when ready. Sometimes scammers sit on stolen information for weeks or months before using it. This means you might not realize you have been compromised until you try to file your own return and discover one has already been filed, or until you see unauthorized charges on your bank statement.

Act when ready if this happened to you. Call the IRS Identity Theft hotline at 1-800-908-4490. They will walk you through filing Form 14039, the Identity Theft Affidavit, which flags your Social Security number in the IRS system and tells them to watch for fraudulent returns. You will also need to file a police report—you can do this online in most places or in person at your local police station. Keep the report number; you will need it when you contact the IRS and your bank.

If the scammer accessed your tax software account, change your password when ready and contact the company's fraud department. TurboTax, H&R Block, and TaxAct all have dedicated fraud lines. If you gave them your bank account number, contact your bank and ask them to watch for unauthorized transactions. Some banks will freeze your account temporarily while they investigate.

How to spot a fake IRS message or website

The IRS initiates contact by mail, not by text, email, or phone. If you receive a message through any of those channels claiming to be from the IRS, it is a scam. That is the single most reliable test.

If you are unsure whether a message is real, do not click any links or call any numbers in the message. Instead, go to irs.gov directly by typing it into your browser yourself, or call the IRS at 1-800-829-1040 using a number you find yourself. Tell them what message you received and ask if it is legitimate. The IRS will never ask you to verify information over the phone, so if someone claiming to be from the IRS asks for your Social Security number or bank details, hang up.

Fake websites often look nearly identical to the real ones. They use URLs like irs-refund.com or irs-find.gov instead of irs.gov. Before you enter any information on a tax-related website, check the URL in the address bar. It should say irs.gov for IRS pages, turbotax.com for TurboTax, hrblock.com for H&R Block, or taxact.com for TaxAct. If the URL is slightly different—extra words, different spelling, a different domain extension—it is fake.

What to do if you clicked a link or visited a fake site

If you clicked a link in a scam message but did not enter any information, you are likely safe. Scammers need you to type something—a password, a Social Security number, bank details—to cause real damage. straightforward visiting a fake website does not compromise you.

If you entered information on a fake site, the risk depends on what you entered. If you only typed your name and address, the damage is limited. If you entered your Social Security number, date of birth, and bank account number, treat it as a full identity theft and follow the steps in the section above: call the IRS Identity Theft hotline, file a police report, and contact your bank.

If you are not sure what you entered or how much information you gave, err on the side of caution. It is better to file a report and monitor your accounts than to wait and discover fraud later. The IRS and your bank can tell you whether fraudulent activity has occurred, and they will help you resolve it.

Protecting yourself going forward

Do not click links in unsolicited messages about taxes, refunds, or accounts, even if they look official. Do not call phone numbers in messages or emails. If you think there might be a real issue with your taxes, initiate contact yourself by going to irs.gov or calling 1-800-829-1040.

Enable two-factor authentication on your tax software account and your IRS online account if you have one. This means that even if a scammer gets your password, they cannot log in without a code sent to your phone or email. Most tax software companies and the IRS offer this option.

Monitor your credit report for signs of identity theft. You can get a free credit report once per year from each of the three major bureaus—Equifax, Experian, and TransUnion—at annualcreditreport.com. Look for accounts you did not open or inquiries you did not authorize. If you see fraud, place a fraud alert on your credit file by contacting any of the three bureaus; they will notify the others.

Frequently Asked Questions

Can the IRS really contact me by text or email about my refund?

No. The IRS contacts people by mail only. Any text, email, or phone call claiming to be from the IRS about a refund, account problem, or security issue is a scam. If you are unsure whether something is real, call the IRS yourself at 1-800-829-1040 using a number you find independently.

What should I do if I already filed a report with the IRS but the scammer filed a return in my name?

The IRS will catch the duplicate return when you file your own. When they do, they will contact you by mail to verify which one is real. Respond promptly with copies of your actual tax documents. The process can take several months, but the IRS will ultimately reject the fraudulent return and process yours.

If I gave a scammer my bank account number, will they drain my account?

Not necessarily. A bank account number alone is not enough to withdraw money in most cases—scammers usually need your PIN or online password too. Contact your bank when ready and ask them to monitor your account for unauthorized activity. Many banks will freeze your account temporarily while they investigate.

Do I need to file a police report if I only clicked a link but did not enter information?

No. A police report is necessary only if you actually gave the scammer personal or financial information. If you straightforward clicked a link and closed the page, there is no identity theft to report. However, if you are unsure what happened, contact your bank or the IRS to ask whether any fraudulent activity has occurred in your name.

What if the scam message came from someone I know?

Your contact's account may have been hacked. Do not click any links they send you about taxes or refunds, even if the message seems to come from a friend or family member. Text or call them directly to ask if they sent it. If they did not, let them know their account may be compromised so they can change their password.