Refund season has a rhythm: forms arrive, deadlines stack up, and your inbox fills with messages that promise money back. Cybercriminals follow the same calendar. They send fake tax refund notices when people are most likely to act quickly and least likely to inspect an email address. The goal is not clever code; it is a moment of rushed trust. A good eye for sender addresses, links, and pressure tactics stops most of these attacks before they start.

Why tax refund phishing feels so convincing

Tax agencies do send legitimate communications. That is what makes the fake ones work. A message that mentions a refund, a filing error, or an overdue payment sounds plausible. It may use official logos, a case reference, and a deadline. Attackers also know that tax topics create anxiety and excitement: a refund is money you want, a problem is money you fear losing. Phishing pages often copy official design closely. The spelling can be perfect. The only clue may be the domain in the sender address or the link behind a button. Treat every unexpected tax email as suspicious until you verify it through a separate, official channel.

Timing compounds the effect. In the United States, refunds are front of mind from late January through the April filing deadline. In the United Kingdom, the 31 January self-assessment deadline and the weeks around it produce the same spike in fake notices. Criminals do not need to be original; they need to be timely. The same handful of templates — refund pending, deposit failed, account suspended — gets recycled year after year with refreshed logos and new case numbers, because it keeps working.

"Dear Taxpayer, our records show you are due a refund of £487.23. To release the payment we need you to confirm your bank details within 48 hours. Failure to respond may result in your refund being cancelled."

Read that again with a calm eye. It is vague about who you are, oddly precise about an amount you never expected, and it manufactures a deadline. Those three features appear in almost every fake refund notice.

The most common IRS and HMRC email lures

Most tax phishing emails fall into a few familiar categories. They may arrive as:

• Refund notifications: "You have a refund pending. Confirm your bank details to receive it." A button leads to a fake login or payment page.
• Filing error alerts: A claim that your return was rejected, miscalculated, or flagged, with a request to "correct it now."
• Overdue payment demands: A threat of penalties, legal action, or frozen accounts unless you pay immediately.
• Account verification requests: A demand to re-confirm your identity, National Insurance number, or Social Security number to keep your tax account active.
• Tax credit or rebate offers: Promises of cost-of-living payments or credits you only need to "claim" by entering card details.
• Document delivery: An attachment labelled as a statement or notice that actually installs malware or harvests your credentials.
• Follow-up phone scams: A number in the email invites you to call a fake support line, where a live person walks you through the theft step by step.

How to inspect a sender address and a link

Read the domain, not the display name

Your email app usually shows a friendly name such as "IRS Refund Department" or "HMRC Tax Services." That text is free to type and means nothing. Tap or click the name to reveal the full address, then read the domain — the part immediately before the final suffix. Genuine messages come from official domains, not from look-alikes such as irs-refund-portal.com or hmrc-secure-payments.net. Watch for the subdomain trick too: in irs.gov.refund-check.com, the real domain is refund-check.com, and "irs.gov" is just decoration designed to fool a quick glance.

Hover or long-press before you click

On a computer, hover over the button or link and read the destination shown in the corner of the screen. On a phone, long-press the link to preview the address. If the visible text says one thing and the destination says another, stop. Shortened links, numeric web addresses, and mismatched domains are all warning signs. Legitimate tax agencies send you to their own website, and they generally expect you to log in yourself rather than through a link in an email.

Other red flags worth memorising

• Urgency and threats: deadlines measured in hours, warnings of arrest, fines, or a lost refund.
• Requests for sensitive data: bank details, card numbers, PINs, passwords, or full identity numbers by email.
• Unusual payment methods: gift cards, cryptocurrency, wire transfers, or payments to an individual.
• Generic greetings: "Dear Customer" instead of your actual name.
• Odd tone or layout: slightly stretched logos, mismatched fonts, or stilted, over-formal phrasing.
• Unexpected attachments: forms, invoices, or "statements" you never asked for.

What the real IRS and HMRC will never do

• They will not email or text you out of the blue asking for bank details, card numbers, or passwords.
• They will not demand immediate payment by gift card, crypto, or wire transfer.
• They will not threaten arrest, deportation, or licence cancellation by email.
• They will not ask you to confirm a refund through a link in a message.
• They will not contact you from a personal address or a free webmail account.

If you are genuinely owed money, the agency already holds the information it needs, or it will write to you and point you to your own account on its official website.

If you have already clicked, replied, or paid

1. Disconnect: close the page, and if you downloaded anything, run a security scan.
2. Change passwords: update your email account and anything that shared the same password, then switch on two-factor authentication.
3. Contact your bank: if you entered card or bank details, ask them to block the card or watch the account.
4. Report it: forward the message to the tax agency's phishing address and report the scam to your national fraud reporting service.
5. Check your real tax account: log in through the official website using a bookmark, not the email, to confirm your actual refund status.

A thirty-second habit that prevents most losses

Before you act on any tax message, run this short routine:

1. Ignore the display name and read the full sender address.
2. Hover or long-press every link and compare the destination with the official domain.
3. Ask yourself whether you were expecting this message at all.
4. Navigate to the agency's website yourself and check your account there.
5. When in doubt, delete and report rather than reply.

Phishing survives on speed and surprise. Slow down for half a minute, verify through a channel the sender does not control, and the fake refund email becomes what it always was: a stranger asking for your money.

Photo: Flyfin / Pixabay