IRS Scams, Phishing & Identity Theft: How to Spot a Fake (2026 Guide)

Top-down security illustration with a suspicious tax message, government-style envelope, blue shield, and red warning symbol

Executive Summary for the Taxpayer: The IRS generally begins contact with a mailed notice, not an unexpected email, text, or social media message. If someone demands immediate payment, requests your Identity Protection PIN, or threatens arrest, deportation, or license revocation, stop communicating and verify the matter independently through IRS.gov.

Brick Taxes LLC helps clients distinguish legitimate IRS correspondence from impersonation attempts. If you are unsure about a notice or call, contact Brick Taxes at 732-540-1040 using information you independently verify.

Key Takeaways: What the IRS Will Never Do

According to the IRS tax scam guidance and IRS reporting instructions, the IRS will never:

  • Initiate contact by email, text message, or social media to request personal or financial information.
  • Email or text you unexpectedly about a refund, bill, or account verification.
  • Ask for your six-digit Identity Protection PIN (IP PIN).
  • Demand immediate payment by gift card, prepaid debit card, cryptocurrency, wire transfer, or money order.
  • Threaten immediate arrest, deportation, or license revocation.
  • Call in a hostile or threatening tone to force immediate payment.
  • Ask you to pay a private collection agency that you cannot verify.
  • Ask you to make a payment to an individual rather than the U.S. Treasury.

A real IRS contact usually begins with a letter mailed to you, such as a CP2000 underreporter notice, CP14 balance-due notice, or LT11 collection notice. Verified in-person visits are extremely rare and are generally scheduled in advance. IRS: How to know it’s the IRS

One-point perspective illustration of a blue security shield blocking phishing arrows and suspicious digital squares

How to Spot a Fake IRS Email, Text, or Call

A fake IRS email often uses an official-looking logo, urgent subject line, QR code, or link to a fraudulent website. The message may claim that your refund is waiting, your account is suspended, or your identity must be verified immediately.

Common red flags include:

  • The sender uses a lookalike domain rather than irs.gov.
  • The message asks for your Social Security number, bank details, credit card number, password, or IP PIN.
  • The caller ID displays “IRS” or another familiar institution.
  • The caller demands payment during the same conversation.
  • The message contains unexpected attachments or QR codes.
  • The communication promises a large refund if you provide information.
  • The sender says you cannot question, appeal, or verify the amount.
  • The website address does not match the official organization’s domain.

Criminals also impersonate banks, payment processors, identity-verification services, and other trusted institutions. To verify a real contact, hang up and call the published number on the institution’s official website or on the back of your card; never use a number supplied in an email, text message, voicemail, or caller ID. IRS tax scam guidance

The IRS may contact taxpayers by phone in certain account or collection circumstances, but it does not call to demand immediate payment, threaten arrest, or announce an unexpected refund. Private collection agencies may be involved in limited IRS accounts, but the IRS sends advance written notice and the agency must be verifiable through official IRS information. IRS private debt collection

IRS Dirty Dozen 2026: Current Scam Themes

The IRS Dirty Dozen for 2026 highlights evolving threats to taxpayers, businesses, and tax professionals. Current themes include:

  • Phishing, smishing, and IRS impersonation: Fake emails, texts, direct messages, and QR codes lead to fraudulent IRS websites.
  • AI-enabled IRS imposter calls: Spoofed caller ID, robocalls, and voice mimicry create pressure to pay.
  • Fake charities: Fraudsters exploit disasters or public events to collect money and personal information.
  • Social media tax scams: Viral claims encourage taxpayers to fabricate income, withholding, credits, or deductions.
  • Offer-in-Compromise mills: Promoters promise “pennies on the dollar” without determining whether the taxpayer qualifies.
  • Identity theft involving IRS Online Accounts: Criminals may use stolen information to access or create an account.
  • Unqualified help with new tax-law provisions: Promoters may offer to obtain credits, deductions, or benefits under new rules without verifying eligibility.
  • Ghost preparers and fabricated withholding: A preparer may refuse to sign a return or encourage unsupported income and withholding claims.

Improper claims can cause refund delays, examinations, penalties, or enforcement activity. Taxpayers remain responsible for the information filed under their name, even when a promoter or preparer supplied the scheme. IRS Dirty Dozen 2026

For additional context, see Brick Taxes’ 2026 IRS notice deadline guide, which explains how legitimate notices identify deadlines and response procedures.

What to Do Right Now: Suspicious Message Checklist

If you receive a suspicious IRS email, text, direct message, or call:

  1. Stop communicating. Do not reply, click links, scan QR codes, open attachments, or call the number provided.
  2. Preserve evidence. Save the entire email, including full headers, or record the phone number, date, time, and exact statements.
  3. Report an email. Send the entire message, preferably as an attachment or by using “Forward as attachment,” to phishing@irs.gov. Use “IRS” in the subject line for an IRS-related message. IRS reporting instructions
  4. Report a phone scam. Report it to the Treasury Inspector General for Tax Administration and the Federal Trade Commission.
  5. Report a text. Send the information to phishing@irs.gov, use your phone’s spam-reporting function, and forward the text to 7726, or “SPAM.” FTC text scam guidance
  6. Verify independently. Type IRS.gov into your browser, review your IRS Online Account, or search the notice number on IRS.gov.
  7. Delete the message after reporting.

Brick Taxes communicates about client matters through the secure TaxDome portal and does not text clients requesting sensitive information. If a message appears to come from Brick Taxes but asks for tax documents, passwords, IP PINs, or payment outside the secure process, do not respond. Call 732-540-1040 using the number published on our website.

Top-down checklist illustration with a turned-off smartphone, secure lock, credit card, and organized identity-theft response documents

What to Do If You Clicked or Gave Information

Act quickly, but do not panic. Use this sequence:

  1. Disconnect the affected device from the internet if you opened a suspicious attachment or believe malware was installed.
  2. Change compromised passwords from a clean device, beginning with email, banking, tax software, and IRS Online Account credentials. Enable multifactor authentication where available.
  3. Contact your bank and card issuers using numbers from official statements or the back of your card. Ask about unauthorized transactions and replacement credentials.
  4. Visit IRS.gov/idtheft for official identity-theft instructions.
  5. Consider a credit freeze or fraud alert with Equifax, Experian, and TransUnion. A freeze is generally free and restricts access to your credit file. FTC credit freeze guidance
  6. File Form 14039, Identity Theft Affidavit, if your e-filed return was rejected because a duplicate return was already filed or you otherwise suspect tax-related identity theft. IRS Form 14039
  7. Review your IRS Online Account and transcripts for unfamiliar returns, income, addresses, payment activity, or balance changes.
  8. File a police report where appropriate, particularly if money, documents, or physical identification were stolen.
  9. Document all actions and dates. Keep reports, confirmation numbers, bank correspondence, and copies of suspicious communications.

If identity theft creates financial hardship or the IRS system does not resolve the issue after reasonable attempts, the Taxpayer Advocate Service may be able to assist. TAS services are generally free. Taxpayers also retain rights to representation and to clear explanations of IRS procedures under the Taxpayer Bill of Rights.

Protect Your IRS Identity Protection PIN

An Identity Protection PIN is a six-digit number known only to you and the IRS. It helps verify your identity on federal tax returns, and the IRS may automatically assign one to a victim of tax-related identity theft. Eligible taxpayers can opt in through the official IRS IP PIN page.

The IRS will never ask you to provide your IP PIN by email, text, social media, or an unsolicited call. Enter it only through official IRS processes or legitimate tax-filing software, and never share it with someone who claims the number is needed to “release” a refund.

A tax professional may receive confidential taxpayer information only within an authorized professional relationship and applicable legal limits. IRC § 7216 generally addresses disclosure or use of taxpayer information by tax return preparers.

How Brick Taxes Protects Your Information

If you receive an unexpected message that appears to come from a tax professional or tax platform, treat it as suspicious until you verify it independently. Do not click the link, do not log in through the message, and do not reply with personal information; instead, contact the firm through a phone number you look up yourself.

This applies to fake document requests, fake portal-login notices, and messages claiming you must verify or unlock an account. Criminals often copy familiar names, logos, and wording to make the message appear legitimate.

Brick Taxes uses the secure TaxDome portal for document exchange, uses multifactor authentication, and follows a verification process before sensitive information changes hands. These steps help reduce the risk of exposing your tax records, identity information, and financial data.

You have the right to representation, the right to clear explanations, the right to request hardship consideration where applicable, and the right to seek help from the Taxpayer Advocate Service if normal channels are not resolving the problem. Safety protections may also apply where personal circumstances require additional care.

If a collection matter develops, you may be asked to document your income, expenses, assets, and household costs, including on Form 433-A or Form 433-F when applicable. Keeping accurate records makes it easier to evaluate your options and respond correctly.

FAQ: IRS Scams and Identity Theft

How do I know if an IRS email is real?

An unexpected email requesting personal information, payment, refund verification, or a link click is not a legitimate IRS initiation. Do not use the link or phone number in the message; go directly to IRS.gov and report the email to phishing@irs.gov. IRS email reporting guidance

Will the IRS ever ask for my IP PIN?

No. The IRS will never ask for your IP PIN by email, text, social media message, or unsolicited phone call. Keep the six-digit number confidential and use only official IRS or tax-filing channels.

How do I report an IRS scam email?

Do not reply, click links, or open attachments. Save the entire message, including full headers, and send it to phishing@irs.gov, preferably as an attachment; also report the matter to TIGTA and the FTC. IRS reporting instructions

What do I do if I already gave my information to a scammer?

Change passwords, contact your bank and card issuers, consider credit freezes or fraud alerts with all three bureaus, review your IRS Online Account and transcripts, visit IRS.gov/idtheft, and evaluate whether Form 14039 is appropriate.

Does the IRS call about back taxes?

The IRS or a properly identified private collection agency may call about an account after written contact, but the IRS will not demand immediate payment, threaten arrest, or require gift cards, cryptocurrency, wire transfers, or payment to an individual. Verify the matter through IRS.gov before providing information or making a payment.

If you received a notice or believe your identity was compromised, Brick Taxes LLC can help you organize the facts and understand your options. Contact 732-540-1040, use the Brick Taxes contact page, or review our Enrolled Agent services and IRS and state tax resolution services.

For refund-related messages, compare the communication with the real procedures in Where’s My Refund? 2026 IRS Refund Status and Delay Guide.

Contact Brick Taxes

Brick Taxes LLC uses secure TaxDome communication for sensitive client matters and does not request confidential tax information by text message. For help reviewing a suspicious IRS notice, possible identity theft, or an IRS imposter call, contact:

Do not send Social Security numbers, IP PINs, account passwords, or tax documents through an unverified message or public website form. When in doubt, stop, verify through an independently published number, and preserve the evidence.

Official Authorities Referenced