Tax season is a phisher’s favourite calendar event, because it comes with three gifts: a deadline, an authority figure, and money in motion. Whether your filing season peaks in April (US), July (Australia and New Zealand) or January (UK self-assessment), the same scams arrive on schedule. Here’s what they look like and how to stay ahead of them.
US$798 million
Reported losses to government-impersonation scams in the US in 2025 — nearly double the year before. Source: FBI IC3 2025 Internet Crime Report.
The tax scams that come back every year
- The refund lure. "You’re owed a refund — verify your bank details to receive it." The link leads to a cloned tax-agency page that harvests your identity and banking details.
- The threat. "Unpaid tax — legal action within 24 hours." Panic is the point; agencies don’t threaten arrest by text or robocall, and don’t take payment in gift cards or crypto.
- The impersonated accountant. Emails posing as your tax preparer requesting documents or "updated payment details" — classic business email compromise, timed for when such requests are normal.
- The fake filing portal. Sponsored search results for "file taxes online" leading to lookalike services that collect everything identity theft needs in one form.
- W-2 and payroll-data requests (US) — HR staff receive "urgent" executive requests for employee tax forms, feeding identity-theft rings for the rest of the year.
The rules that hold in every country
- Tax agencies initiate by post, not by threatening texts, robocalls or WhatsApp. An unexpected refund or demand message is guilty until proven otherwise.
- Go to the source yourself. Never use the link provided — type your tax agency’s address or use its official app to check your actual account status.
- No agency takes gift cards. Payment demands in gift cards, crypto or wire transfer are a scam, every time, everywhere.
- Slow the urgent request down. Deadline pressure is manufactured precisely so you skip verification. A real deadline survives a five-minute check.
- Protect the moment of the click. Cloned agency pages are often hours old — too new for blocklists. Real-time page analysis catches them on sight.
For businesses: brief the two teams that get targeted
Finance and HR carry tax season’s risk: fraudulent "updated bank details" from suppliers, and payroll-data requests from spoofed executives. One standing rule — verify any payment or data change by phone, on a known number — plus deeper email analysis for targeted staff removes most of it.