~/scams explained / tax-refund-phishing-email-scam

Tax refund phishing: fake emails from authorities

Scammers send emails in the name of an authority: a refund, a payment reminder or a “data update”. The link or attachment leads to fake sites or malware.

How the scam works

1. You receive an email that looks like it comes from a tax office or another authority, with a logo and official wording.
2. It says you are owed a tax refund, your details must be updated or a payment reminder is coming.
3. You are told to click a link or open an attachment that supposedly holds the details or the invoice.
4. The link takes you to a fake page where you are asked to enter personal details, bank details or passwords.
5. Fake invoices and reminders from supposed companies work the same way: the attachment can contain malware.

How to spot it

• An unexpected email from an authority promising money or threatening a penalty.
• The sender address looks odd or does not fit the authority.
• A generic greeting such as “Dear customer” instead of your name.
• Time pressure and threats such as “final deadline” or “account will be blocked”.
• A link or attachment that asks for details, bank information or a password, or an invoice you did not expect.

What to do now

• Do not click links and do not open attachments.
• If in doubt, open the official authority portal yourself, from your bookmark or by typing the address.
• Do not enter details, passwords or bank information through a link in an email.
• Check invoices and reminders against your own records. Only pay for what you really ordered.
• Report the email as phishing to your email provider and delete it.

Already clicked or paid?

1. Change the password of the affected account at once, and anywhere else you use the same one.
2. If you entered bank or card details, call your bank using the number on your card and have the card blocked.
3. If you opened an attachment, disconnect the device from the network and scan it with up-to-date antivirus software.
4. Watch your account statements and report unknown charges immediately.
5. Report it to the police and to your consumer protection service.

Frequently asked questions

Will an authority email me a refund link?

Be very careful with such emails. Always open the official portal yourself instead of following a link.

What if the email contains my name?

A name proves nothing, because criminals often use collected data. Check the sender, greeting and content critically.

What should I do with an invoice I did not expect?

Do not pay it and do not open the attachment. Check whether you really ordered something, and if in doubt ask through a contact route you found yourself.

More scams

• Fake parcel text: "Delivery failed"
• Fake bank email: "Account locked" and "renew your security method"
• Fake PayPal email: "Account limited" and "suspicious payment"
• Fake Amazon email: order, Prime, locked account or refund
• "Hi Mum, new number": the WhatsApp scam with the fake child
• Classified ads scam: the fake buyer with the "secure payment link"
• How to spot a fake online shop
• Prize draw scam: why "You have won" is often a trap
• Fake Microsoft support: the phone call and virus pop-up scam
• Fake bank employee call: when the bank seems to be calling
• Crypto investment scam: fake ads with famous faces

General advice, not legal advice. If you lost money, involve your bank and the police.

← All scams