Real Tax Refund vs Tax-Refund Phishing
How to tell a genuine tax authority refund notification from a phishing message designed to steal your bank or identity details under the guise of claiming a refund.
Last reviewed: 1 June 2026
Tax refunds are ordinary. Overpayments happen through payroll, changed circumstances, or an adjusted assessment, and tax authorities do issue money back every year. That is precisely why the phishing version lands so well, especially in the weeks around filing deadlines when tax is already on your mind. The message looks official, the wording is polite and bureaucratic, and the offer is pleasant rather than threatening, which lowers your guard in a way a demand never would. The one distinction that matters most is the direction of information. A genuine tax authority already holds your bank details and pays a refund into the account on file, usually without asking you to do anything. A fraudulent message needs you to type those details into a page it controls, which is the entire purpose of the exercise.
Side-by-side comparison
| Real tax refund | Tax-refund phishing | |
|---|---|---|
| How you are notified | Refund applied directly to the bank account on file; written notification may follow by post | Urgent email or SMS saying you must 'claim' the refund online via a link |
| Information requested | Your tax authority already holds your bank account details; it does not ask you to re-enter them to release a refund | Asks you to enter full bank account number, sort code, and card details to 'receive' the refund |
| Sender domain | Official government domain (e.g., hmrc.gov.uk, irs.gov); never a commercial email provider | From a lookalike domain or free email service; sometimes the display name is correct but the address is not |
| Link destination | Any link in official correspondence goes to the government's verified top-level domain | Link goes to a lookalike domain; URL may contain the agency name but on a different TLD or subdomain |
| Urgency | Refunds are processed in routine cycles; no 'act by tonight or lose your refund' | Claims the refund will be cancelled if not claimed within 24–48 hours |
| Personal data shown | May reference your name or national insurance / tax ID but never asks you to re-confirm all data | Asks you to verify name, date of birth, address, and financial details before releasing funds |
Common red flags
- Email or SMS containing a link to 'claim' a tax refund
- Request to enter bank account, card number, or CVV to receive a refund
- Sender address is not a verified government domain
- Urgency claim that the refund expires within hours
- Asks you to confirm personal details including date of birth and national ID
Verification steps
- Log in to your tax authority's official website by typing the URL directly to check your account for any real refund
- Call the official tax authority helpline using the number from their verified website, not from any message you received
- Forward phishing emails to your tax authority's official phishing reporting address
What not to do
- Do not click links in tax refund emails or SMS messages
- Do not enter bank account or card details on a page reached via a link
- Do not call phone numbers provided in an unexpected tax message
A safe response
Do not use the link, even to look. Open a new tab, type your tax authority's official address yourself or use their app, and sign in to see whether any refund actually exists on your account. If you want to ask, call the helpline number published on that official site rather than any number in the message. There is no deadline to beat, so it is fine to do nothing today. If you have already entered bank or card details, contact your bank on the number on your card, ask them to secure the account, then report the message through your tax authority's phishing address and change any password you reused elsewhere.
Frequently asked questions
The email used my full name and correct tax reference. Could it still be fake?
Yes. Names, addresses, and reference numbers appear in old paperwork, leaked databases, and documents shared with third parties, so accurate personal details do not confirm a sender. Fraudulent messages increasingly include them precisely because they are persuasive. Judge the message on the sender domain, where the link resolves, and whether the request makes sense at all, since a tax authority holding your account details has no reason to ask you for them again.
Will HMRC or the IRS ever send me a link by email?
HMRC states it will never send links asking for personal or financial information by email. The IRS similarly does not initiate contact by email, text, or social media requesting financial details. Any such message should be treated as fraudulent.
How do I report a tax phishing message?
In the UK, forward it to [email protected]. In the US, forward it to [email protected]. Both agencies maintain phishing reporting channels and publish guidance on their official sites.