Tax scams and consumer alerts

Scammers send phishing email supposedly from the Tax Department (10/2024)

Scammers are sending emails that ask taxpayers to review and sign tax documents using Docusign.

If you receive an email like this, do not select the link to bring you to the document. This email is not from the Department of Taxation and Finance. Instead, report the email to us. See Report a tax scam. 

Email scammers use tax transcripts as bait

Emails, supposedly from the IRS, include infected attachments identified as tax transcripts. The attachments contain malware that can spread throughout a computer, or potentially an entire business network.

If you receive an email with attachments purporting to be from the IRS or IRS Online, do not open it; if you're using:

• a personal device, forward the email to phishing@irs.gov.
• a work device, notify your work's IT staff.

To read the full IRS release, visit IRS warns of "Tax Transcript" email scam.

---

Criminals mimic IRS telephone number on caller ID

Phone scammers are programming their computers to display legitimate IRS Taxpayer Assistance Center (TAC) numbers on caller ID. In these calls, scammers demand a tax payment and when taxpayers question the demand, they're advised to verify the legitimacy of the number on IRS.gov.

If you receive a call from someone claiming to be an IRS employee and you've verified the phone number is legitimate, the call may still be a scam. The IRS does not ask for credit and debit card numbers over the phone or threaten to involve law enforcement in tax matters; these are signs the call is fraudulent. Report these calls to the Treasury Inspector General online and to the IRS at phishing@irs.gov with the subject line IRS Phone Scam.

Visit IRS, Security Summit Partners warn of new twist on phone scam to read the full IRS release.

---

Scammers pose as debt collection agencies

In a new scheme, scammers who file fraudulent returns are using taxpayers' real bank accounts for refund deposits, then calling these taxpayers to retrieve the refunds.

Some of the scammers:

• pose as employees of a debt collection agency acting for the IRS,
• claim the IRS deposited refund the refund in error, and
• ask the taxpayer to forward the money to the collection agency.

Other scammers:

• pose as IRS employees in an automated message,
• threaten the taxpayer with criminal charges if they don’t return the refund, and
• provide a case number and telephone number to call to return the refund.

If you receive one of these calls, notify the IRS; visit the IRS at Scam Alert: IRS Urges Taxpayers to Watch Out for Erroneous Refunds; Beware of Fake Calls to Return Money to a Collection Agency for instructions.

---

Scammers target taxpayers and tax professionals with Hotmail accounts

To steal personal and financial information, scammers are sending emails supposedly from the IRS to Hotmail account users.

The subject line of this phishing email reads Internal Revenue Service Email No. XXXX | We’re processing your request soon | TXXXXXX-XXXXXXXX.

If you receive one of these emails, do not select any links in the email. Instead, forward it to the IRS at phishing@irs.gov, then delete it.

Visit the IRS at Consumer Alert: IRS Warns Taxpayers, Tax Pros of New Email Scam Targeting Hotmail Users to read the full release.

---

Warning from the IRS: e-Services accounts are the targets of a new scam

If you have an e-Services account with the IRS, be wary of any emails you receive with the subject line “Important Update about Your e-Services Account”; they may be phishing emails aimed at stealing your tax professional information.

The telltale signs of these phishing emails include:

• a prompt to sign a new e-Services user agreement through a link provided in the email;
• a claim to be from “e-Services Registration”;
• the subject line “Important Update about Your e-Services Account”; and
• the specific text “We are rolling out a new user agreement and all registered users must accept its revised terms to have access to e-Services and its products.”

If you’re a victim of this scam and selected the link provided in the email, perform a deep scan of your computer with your security software, contact your office’s IT or cyber security personnel, and contact the IRS' e-help Desk.

---

Malware scam hijacks users’ devices

Scammers are impersonating the IRS and FBI in a new phishing email that hijacks users’ computers. Unlike other schemes where scammers try to steal sensitive information to file fraudulent tax returns, the objective of these scammers is to hijack users’ devices, preventing them from accessing their information, to demand payment for returning their access.

These emails include a “here” link that appears to download an FBI questionnaire but, in actuality, downloads a malware called ransomware. These emails also contain the emblems of the IRS and FBI.

If you receive one of these emails, do not pay the ransom; immediately report the email to the FBI at Internet Crime Complaint Center (IC3) and forward the scam to the IRS at phishing@irs.gov.

If you are a tax professional and e-Services user whose login or credential information was compromised, reset your password with the IRS’ e-help Desk. If taxpayer information was compromised, contact your local stakeholder liaison.

Visit the IRS at Defend against Ransomware for more information.

---

Tax professionals—watch out for phony emails aimed at stealing your information

In a new scheme to steal tax professionals’ information, scammers are impersonating tax software providers in emails that ask professionals to validate their login credentials. When professionals select the links in these emails to confirm their information, they are taken to sites that mimic legitimate software providers’ login screens. Entering login information allows the scammers to steal tax professionals’ usernames and passwords and access their accounts, and, subsequently, their clients’ information.

These emails contain a subject line similar to “Software Support Update,” mimic the look and feel of legitimate software providers’ emails, and thank tax professionals for choosing the specific provider’s software. They also include language about an “Important Software System Upgrade.”

If you receive one of these emails, please forward a copy to the IRS and your tax software provider according to the IRS’ instructions (visit the IRS at Security Summit Alert: Tax Pros Warned of New Scam to Steal Their Passwords).

---

Beware of phishing emails directed at tax professionals

The IRS and New York State Tax Department jointly warn tax professionals about a new phishing scam directed at the tax professional community. Scammers are posing as a legitimate tax education software provider in emails where they request tax professionals send their information in an attempt to “revive” their preparer accounts, allowing scammers to access a taxpayer’s information and file fraudulent returns.

The phishing email requests an unusually large amount of information and begins “In our database, there is a failure, we need your information about your account.” (To view the full content of the email, visit the IRS at Security Summit Warns of New Phishing Email Targeting Tax Pros.)

If you received this email, please forward a copy to phishing@irs.gov. Additionally, if you provided your IRS credential information, contact the IRS’ e-help Desk to reset your password, and if you provided information and taxpayer data was stolen, contact your local IRS stakeholder liaison.

---

Scammers call tax professionals about updating their ERO software

Scammers, impersonating representatives from Fastsupport.com and Onlyforsupport.com, are calling tax professionals after identifying which electronic return originator (ERO) they use to transmit returns. The callers claim the tax professionals' ERO software needs to be reinstalled or updated to correct errors and request access to their computers in an effort to take over their accounts.

To report one of these calls, visit the IRS at Stakeholder Liaison Local Contacts; the New York State Department of State at Consumer Protection; and the New York State Attorney General at Taxpayer Protection Bureau.

---

Scammers renew scheme targeting payroll and HR professionals

Once again, cybercriminals, posing as company executives, are emailing payroll and HR professionals to request lists of employees and their personal information. These emails may appear legitimate because they contain the name of the company’s actual chief executive officer; however, if you receive such an email, do not include any payroll data, such as Forms W-2 and Social Security numbers, in a response.

If you are an employer who has been a victim of this scam and, in response, released any payroll data, such as W-2 information and Social Security numbers, see Guidance for employers affected by a W-2 phishing scam for instructions.

For more information about the details contained in these emails, visit the IRS at IRS, States and Tax Industry Renew Alert about Form W-2 Scam Targeting Payroll, Human Resource Departments.

---

Cybercriminals pose as clients to solicit services from tax professionals

In a nationwide phishing scheme, scammers are targeting tax professionals to obtain their preparer information and prepare fraudulent returns. Typically, scammers are sending tax professionals two emails: in the first, a “client” requests tax preparation assistance; in the second, scammers provide a link (or attach a PDF that contains a link) that allows them to steal the tax preparer’s email address and password.

If you receive a suspicious email or one from an unknown sender, do not select any links or open any attachments contained in the email. Please report the scam attempt using the IRS Impersonation Scam Reporting tool (on the Treasury Inspector General for Tax Administration website) and the FTC Complaint Assistant tool (on the Federal Trade Commission website).

To read the full IRS press release, visit Security Summit Alert: New Two-Stage Email Scheme.

---

Phishing email with the subject line “Mails on Hold!” targets tax professionals

Some tax professionals have received emails appearing to be from the IRS or the IRS’ e-Services team with the subject line “Mails on Hold!” These emails may include references to IRS personnel or PTINs, but they are not from the IRS.

If you receive an email with this subject line, don’t select any links or open any attachments contained in these emails. Please report the scam attempt using the IRS Impersonation Scam Reporting tool (on the Treasury Inspector General for Tax Administration website) and the FTC Complaint Assistant tool (on the Federal Trade Commission website). If the email appears to be from e-Services, you should also contact the e-Services helpdesk at 1 866-255-0654.

---

Fake IRS bills request payment for money owed under the Affordable Care Act

Some taxpayers have received fake IRS bills as attachments in emails and through the U.S mail. These fake bills resemble real IRS CP2000 notices.

These bogus notices usually claim money is owed as a result of the Affordable Care Act and ask recipients to make out a check to “I.R.S.” Real CP2000 notices request that checks be made out to the “United States Treasury.”

If you receive or believe you have received a fake CP2000 notice, visit the IRS at Beware of Fake IRS Tax Bill Notices to learn what to do, or visit IRS and Security Summit Partners Warn of Fake Tax Bills for additional details.

---

Westchester County residents are the targets in a new phone scam

Phone scammers are impersonating Tax Department employees and calling Westchester County residents to demand payment for fake back taxes. Seniors should take special care, as the scammers are manipulating caller ID to display legitimate Tax Department phone numbers. If you receive a call from the Tax Department's fraud hotline—either 518-457-5181 or 518-457-0578—do not answer the call. The Tax Department will never contact you from the fraud hotline.

To read the full article about this scam, visit Scam targeting Westchester residents.

---

Tax professionals—scammers mimic software providers in new phishing email

Tax professionals are the targets in a new phishing email. In the email, scammers pose as tax software providers and ask recipients to download and install a software update using a bogus link. Downloading the requested "software update" allows scammers to track activity on the device, thereby accessing sensitive information, such as Social Security and credit card numbers.

If you’re a tax professional and think you’ve received this or a similar phishing email, or you'd like to read the entire IRS release, visit the IRS at New phishing scheme mimics software providers. 

For general information on how to report fraud, a scam, or instance of identity theft to the Tax Department, see Report fraud, scams, and identity theft.

---

IRS impersonators demand payment for nonexistent “federal student tax”

Phone scammers are targeting students and demanding payment for a bogus federal student tax. These scammers, who pose as IRS employees, threaten to report students to the police if they do not wire money immediately to the scammer to pay the fake tax. If you receive a phone call where you are asked to pay the federal student tax, hang up immediately. Report the call online using the IRS Impersonation Scam Reporting tool, or over the phone at 1 800-366-4484.

For more information about this scam, visit the IRS at News and events.

---

Payroll and HR professionals—phishing scammers target taxpayers’ W-2s

Cybercriminals, posing as company executives, are emailing payroll and HR professionals to request lists of employees and their personal information. These emails may appear legitimate because they contain the name of the company’s actual chief executive officer; however, if you receive such an email, do not include any payroll data, such as Forms W-2 and Social Security numbers, in a response.

If you are an employer who has been a victim of this scam and, in response, released any payroll data, such as W-2 information and Social Security numbers, see Guidance for employers affected by a W-2 phishing scam for instructions.

For more information about the details contained in these emails, visit the IRS at IRS alerts payroll and HR professionals to phishing scheme involving W-2s.

---

Phone scammers pose as Treasury representatives

Phone scammers, posing as New York State and US Treasury agents, may call to ask for your banking information and $250, promising in return a larger sum of cash to come at a later date. If you receive a phone call asking for your money and information, do not provide either; contact the Tax Department or IRS to report these phone calls.

For more information about this scam, visit NY.Gov at Governor Cuomo warns consumers.

---

New email phishing scams (01/2016)

New scams ask IRS e-services users to update their e-services information through email. E-services will never ask you to do this; the IRS will not initiate contact with you through email, text message, or social media to request your personal or financial information. If you receive an email or requests like this, do not select any links in the email or take any other action.