I Received A Bogus IRS Email: Here's How To Tell And What To Do If It Happens To You

I did a double take this morning. I was scrolling through my inbox and ran across an email allegedly from the Internal Revenue Service (IRS) regarding tax transcripts. It wasn’t actually from IRS: It was a scam. However, it was close enough to get my attention.

Here’s what the email looked like:

In contrast, here’s what a recent Tax Tip email from the real IRS looks like:

The first one is a decent attempt to recreate an email from the IRS, and the topic is timely. The IRS has been advising taxpayers to double-check their withholding following tax reform (more on that here).

However, a tax return transcript isn’t what you need to do a withholding checkup. A tax return transcript shows most line items including your adjusted gross income (AGI) from your original tax return as filed, along with any forms and schedules. In other words, it will show you what you reported on your last filed tax return. It doesn’t show changes made after you filed your original return, including estimated payments or changes to your form W-4. If you really want to do a withholding checkup, you’d plug your current tax data into the withholding calculator on the IRS website. You can do a “paycheck checkup” directly on the site (find out more here) and make changes to your form W-4 if necessary (more on that here).

There are a few other tricks worth noting:

• There’s a link in the text that purports to connect you to the tax transcript page but appears to take you to a website located in Russia, not IRS.gov. If you’re not sure whether a link in an email might be safe, don’t click. It’s generally a better bet to head over the main website for the company (in this case, IRS is at irs.gov) and access the page directly.
• That’s not a real number from IRS. It’s close, which is what the scammers are counting on. The number provided by the scammers is 1-864-666-5046. Area code 864 is not a toll-free number, but rather the area code for parts of South Carolina. However, the number is just a few digits off from the number (844-545-5640) used to schedule an appointment at taxpayer assistance centers, which may trick some taxpayers.
• The Taxpayer Advocate is not responsible for tax transcripts (you can find out what they do here).
• The IRS main office is not located in San Francisco. There is a local office in San Francisco, but it’s not located at the address included on the email.

There are lots of red flags in the email, and you should be able to distinguish it from a real IRS email. The scary part is that scammers are getting much better at approximating the IRS and other federal agencies, as well as financial institutions. Taxpayers need to remain alert.

The irony of receiving the email today is that the IRS, state tax agencies and the tax community, partners in the Security Summit, have dubbed this week as “National Tax Security Awareness Week.” All week they’ve been sending reminders to taxpayers and tax professionals. One of those reminders noted “a surge of new, sophisticated email phishing scams.” (You can read more here.)

The IRS encourages taxpayers who receive these phishing emails to forward them to phishing@irs.gov. I did and received an acknowledgment. Here’s part of the reply: 

We have received your report of possible phishing or fraud. Although we review and investigate each email we receive, due to the number of incident complaints, we cannot guarantee a personal response to your message.  

Please note that the IRS does not contact individuals by email. 

Therefore, if you received an email claiming to be from the IRS it is a phishing attempt and should be reported to us.

…

The IRS values your report, and encourages individuals to report future IRS phishing/fraud to phishing@irs.gov so that we can handle these incidents and limit the number of possible victims. 

While forwarding the email to the proper authorities is encouraged, don’t engage or respond with scammers. Here’s how to protect yourself:

• If you receive a call from someone claiming to be from the IRS, and you do not owe tax, or if you are immediately aware that it’s a scam, don’t engage with the scammer and do not give out any information. Just hang up.
• If you receive a telephone message from someone claiming to be from the IRS, and you do not owe tax, or if you are immediately aware that it's a scam, don’t call them back.
• If you receive a phone call from someone claiming to be with the IRS, and you owe tax or think you may owe tax, do not give out any information. Call the IRS back at 1.800.829.1040 to find out more information.
• Never open a link or attachment from an unknown or suspicious source.
• If you’re not sure about the authenticity of an email, don’t click on hyperlinks. A better bet is to go directly to the source’s main Web page. 
• Use security software to protect against malware and viruses found in phishing emails.
• Use strong passwords to protect online accounts and use a unique password for each account. Longer is better, and don’t hesitate to lie about important details on websites since crooks may know some of your personal details.
• Use two- or multifactor authentication when possible. Two-factor authentication means that in addition to entering your username and password, you typically enter a security code sent to your mobile phone or other device.

As a reminder, the IRS will never:

• Call to demand immediate payment over the phone, nor will the agency call about taxes owed without first having mailed you a bill.
• Threaten to immediately bring in local police or other law-enforcement groups to have you arrested for not paying.
• Demand that you pay taxes without giving you the opportunity to question or appeal the amount they say you owe.
• Require you to use a specific payment method for your taxes, such as a prepaid debit card, gift card or wire transfer.
• Ask for credit or debit card numbers over the phone.

Don’t fall for the tricks. Keep your personal information safe by remaining alert. And, when in doubt, assume it’s a scam. For tips on protecting yourself from identity theft-related tax fraud, click here.