Skip to main content
Department of Taxation and Finance

Report a tax scam

Tax scams are on the rise, especially during tax season. Report any suspicious contact you have with individuals claiming to be Tax Department or IRS employees. You may wish to report:

  • suspicious phone calls and voicemails;
  • text messages and emails requesting personal information; or
  • interactions with Tax Department or IRS employees who do not seem legitimate.

You can report possible tax scams to the Tax Department and IRS online or by phone. 

Report a scam

Recognize common tax scams

You can reduce your risk of becoming a target of scammers by staying alert and knowing what to watch out for.

Impersonation scams

Scammers will usually use scare tactics to get you to share your personal and financial information with them. Scammers may:

  • demand immediate payment for a tax debt;
  • threaten you over the phone, possibly with police action or deportation; or
  • demand you pay in a specific way, such as through prepaid debit cards, gift cards, or in person.

Tax Department employees will never:

  • threaten you for failure to pay a tax debt;
  • refuse your request to call us back using a number found on our website;
  • use email, text messages, or social media to request or discuss your personal or tax information; or
  • demand you pay taxes without the option to question or appeal the amount we say you owe.

Phishing scams

Be aware of attempts to trick you into providing personal or financial information through an email request or through a link to a fraudulent website. This is called phishing, a criminal activity to manipulate you into sharing confidential information.

Phishing emails may appear to be from a trustworthy source, but when you select a link in a phishing email, you may be directed to a fraudulent website. The website will attempt to acquire personal or private information, or possibly infect your computer with malicious software. An email may be a phishing attempt if it includes:

  • obvious spelling errors (phishers do this intentionally to avoid spam filters many Internet providers use), or
  • links that contain all or part of a real entity's name or Web address, but are not identical to that of the legitimate website.

To check the destination of an active link on a computer, hover over the link with your cursor and review the Web address (URL) displayed in the lower-left bottom of your window.

On a mobile device, use a URL checker (in an app or a browser) to scan a link for malware. The checker will tell you if the URL is safe. 

For more information on phishing, visit Department of State, Division of Consumer Protection: Phishing Scam Prevention Tips.

Debt collection scam letters

Scammers are posing as legitimate debt collectors – threatening New Yorkers with debt they do not owe. Their tactics can be intimidating. Scammers demand immediate payment and try to convince you to pay using methods that are difficult to trace, such as gift card, wire transfer, prepaid card, or cryptocurrency.

Learn how to tell the difference between a debt collection scam letter and legitimate letters you might receive from the Tax Department or collection agency. Review the samples below.

Offer in Compromise scams

Beware of Offer in Compromise “mills” that mislead taxpayers into believing they can settle tax debt for pennies on the dollar.

The Offer in Compromise program allows qualifying, financially distressed taxpayers the opportunity to pay a reasonable amount of their tax debt. But “mills” can aggressively promote Offers in Compromise to people who clearly don’t meet the qualifications, costing taxpayers thousands of dollars.

Report a tax scam

We review all complaints promptly and, if appropriate, take corrective action. Please refer to the table below to learn how and to whom you should report your concerns.

Who to contact to report a scam
Fraud type Report your concerns
New York State Tax Department 

Note: If you are contacted by phone, note the date, time, and telephone number of the call, and save any voicemails from the caller.
IRS or the US Treasury 
New York State Treasury by phone at 1-800-771-7755.

Follow best practices

Secure your mobile devices

Apply software updates that patch known vulnerabilities to fraud as soon as they become available. Use the security features on your phone or tablet (like a passcode) and enable programs that encrypt data and remotely delete the contents if your device is lost or stolen. 

Be careful with Wi-Fi hotspots

Public wireless hotspots are not secure, which means that it’s easy for cyberthieves to see what you are doing on your mobile device while you are connected. Limit what you do on public Wi-Fi and avoid logging into sensitive accounts, like online banking.

Know your apps

Thoroughly review the details and specifications of an app before you download it. Review and understand the privacy policy of each mobile app. Be aware that the app may request access to your location and personal information.

Be cautious about the information you share on social media

Avoid posting your birthdate, telephone number, home address, or images that identify your job or hobbies. This type of information can be used to determine answers to security questions required to reset passwords and use them to target your accounts and personal information.

Use strong passwords and change them regularly

When it comes to passwords, the longer the better. Fourteen characters is the current industry standard. Use a combination of letters (upper and lower case), numbers, and symbols. To help you remember it, consider using the first letters of a memorable phrase to create your complex password. Remember to use a different password for each account and change them often.

Vary your security questions

Don't use the same security questions on multiple accounts. Select security questions for which the answers cannot be guessed or found by searching social media or the internet. 

Use two-step verification to access accounts

To enhance the security of online accounts, require a password and an extra security code whenever possible to verify your identity when you sign in. 

Learn more

Updated: