Fake IRS tax refund emails: how to tell if a refund email is real

"You are eligible to receive a tax refund of $1,284.50. Submit your claim within 72 hours." Fake IRS refund emails promise money, then send you to a copy of the IRS website that asks for your Social Security number, bank details or IRS sign-in. This guide explains the very few emails the IRS really sends, how to check a refund safely, how to report the scam the way the IRS asks, and what to do if you already clicked.

Is an email about my IRS tax refund real?

An unexpected email about your IRS tax refund is almost certainly fake. The IRS's phishing reporting page says: "We never email without your permission." Its email privacy guidance adds: "The IRS will never initiate contact with you by email." The IRS normally contacts you the first time by letter, sent through the U.S. Postal Service (IRS).

There is one exception worth knowing. In Tax Tip 2026-33 (April 21, 2026), the IRS announced that "A new feature in Individual Online Account lets taxpayers opt in to receive email notifications" when there's an update to their refund status. So a refund email can be real, but only if:

• you turned on email notifications in your IRS online account yourself, and
• it comes from an address ending in irs.gov, and
• it carries general information only. The IRS says opted-in account emails contain "only general information in these unsecure emails."

Even then, you don't need anything in the email. Sign in to your account by typing irs.gov and look there.

What do fake IRS refund emails look like?

The first item on the IRS's 2026 Dirty Dozen list is IRS impersonation by email and text. The IRS says scammers send messages "often using alarming language and QR codes that direct taxpayers to fake IRS websites to 'verify' accounts, enter personal information, or claim refunds." It also warns that links in these messages "may install malicious software, including ransomware."

Example of a fake IRS refund email

This is an example written for this guide. It is not a real IRS email.

From: Internal Revenue Service <refunds@irs-taxrefund-gov.com>
Subject: Notice: Pending tax refund - action required

Dear Taxpayer,

After the last annual calculation of your fiscal activity,
we have determined that you are eligible to receive a tax
refund of $1,284.50.

Please submit the tax refund request within 72 hours to
avoid delays in processing.

[ Claim your refund ]

Internal Revenue Service
Department of the Treasury

The warning signs: a sender domain that isn't irs.gov, "Dear Taxpayer", a deadline, and a button to "claim" money. The IRS doesn't make you claim a refund by email.

How do I know if an IRS email is fake?

You can tell an IRS email is fake if it arrived without you signing up, or if it rushes you, threatens you or asks for information. The IRS's How to know it's the IRS page says a phone call, email or text message isn't from the IRS if it:

• is unexpected
• rushes you
• threatens you
• asks for personal or financial information
• demands payment now

The same page lists the only email senders the IRS uses: "IRS account email notifications are sent from email address ending in irs.gov," and "IRS News Bulletin emails are sent from email address irs@service.govdelivery.com." You get these only when you opt in.

Real vs fake IRS email

Does the IRS call, text or message about refunds?

No, not out of the blue. The IRS's reporting page says: "We don't send text messages without your permission." It also says: "We never send direct messages by social media." About phone calls, it says the IRS or private collection agencies may call about account matters, but "We never call to demand payment now, threaten arrest or inform you of a refund."

That matters because refund scams rarely stay in one channel. An email may tell you to call a number, or a text may follow up on an email. The IRS's Dirty Dozen list says it reported over 600 social media impersonators during fiscal year 2025, and its second item is IRS impersonation by phone, including robocalls and spoofed caller ID. If any message, call or DM tells you about a refund, hang up or close it, and check your account on irs.gov yourself.

Watch the domain carefully. irs.gov.refund-claim.com ends in refund-claim.com, not irs.gov. Our guide to lookalike domain phishing shows the common tricks, and the Email Header Analyzer shows the real sending server and whether SPF, DKIM and DMARC passed. For a full walk-through of warning signs, see how to spot a phishing email.

How do I check my tax refund status safely?

Check your refund status only on irs.gov, by typing the address yourself. The IRS's Refunds page gives two ways:

1. Sign in to your IRS account to see your refund status, tax records and amended return status. The IRS's email privacy guidance says you can opt in to email "in your account profile".
2. Use Where's My Refund without signing in. You'll need your Social Security number or ITIN, your filing status, the tax year and the exact refund amount from your return.

The IRS says status is available 24 hours after you e-file a current-year return, 3 days after you e-file a prior-year return, and 4 weeks after you file a paper return. The IRS app and an automated hotline are also listed on the same page. Tax Tip 2026-33 adds that the IRS issues most refunds in less than 21 days, so a refund that takes a little longer isn't a reason to trust an email offering to "speed it up".

If the email's "refund" doesn't show up in your account, it doesn't exist.

How do I report a fake IRS refund email?

Report a fake IRS email to phishing@irs.gov, sent as an attachment, then delete it. The IRS's reporting page gives these steps:

1. Don't reply, click links or open attachments.
2. Send it to phishing@irs.gov with the subject line "IRS" (or "Treasury" if it pretends to be the Treasury). Use one of these options: save the email as a file and send it as an attachment; select "Forward as attachment" if your email provider has it; or get the email header and send that. A plain forward also works, but the IRS notes it "strips important data to identify and stop the scammer."
3. Report it to the Treasury Inspector General for Tax Administration (TIGTA).
4. Delete the email.
5. Optionally, report it to the Federal Trade Commission at ReportFraud.ftc.gov.

For a fake IRS text message, the IRS asks you to email the sender's number, the message, your number, and the date, time and time zone to phishing@irs.gov with the subject "Text", and to forward the text to 7726 (SPAM). Use your mail app's report button too; our guide to reporting phishing emails shows where it is in Outlook, Gmail and Apple Mail.

What should I do if I clicked a fake IRS refund email?

What you do next depends on what you gave away. Work through each step that applies.

1. Stop interacting with the scammer. The IRS's If you were scammed page says to stop, and not to send money or share more information.
2. Bank details entered? Contact your bank or credit union straight away, using the number on your card or statement.
3. Social Security number entered? Follow the steps on IdentityTheft.gov, and consider reporting it to your state tax agency.
4. Get an Identity Protection PIN (IP PIN). The IRS says an IP PIN prevents scammers "from filing a tax return in your name."
5. Secure your IRS account. The IRS notes that your online account is protected with multifactor authentication and lets you monitor activity. If you typed your IRS sign-in into a fake page, change that password from a trusted device.
6. If your return is rejected because someone already filed with your number, submit Form 14039, Identity Theft Affidavit.
7. Opened an attachment or downloaded a file? Disconnect the device from the network and run a full security scan. If it's a work device, tell IT now.

Our general checklist for what to do after clicking a phishing link covers password resets, inbox rules and signs of a taken-over account. The IRS also warns that "Some scam victims get scammed again," so be wary of anyone offering to recover your money for a fee.

Do fake IRS emails target businesses too?

Yes. Businesses get fake IRS emails aimed at staff, plus targeted tax scams. Payroll and HR receive requests for every employee's W-2 "from the CEO", covered in our guide to W-2 phishing in tax season. Tax preparers and accounting firms get fake "new client" emails with malicious attachments; see IRS Publication 4557 and email security.

For an admin, a fake IRS refund email that reaches many staff is handled like any phishing campaign:

1. Find every copy by sender, subject or link, using Microsoft 365 Threat Explorer or the Google Workspace security investigation tool.
2. Remove it from all mailboxes (see how to remove a phishing email from all mailboxes in Microsoft 365) and block the sending domain and URL, for example with the Microsoft 365 Tenant Allow/Block List.
3. Ask who clicked and reset anyone who entered a work password, following signs an email account is compromised.
4. Remind staff before filing season that the IRS starts contact by letter and never asks for a refund "claim" by email.

The IRS says its Dirty Dozen campaign targets fraud "particularly during filing season", and fake IRS emails can come from brand-new lookalike domains that built-in filters haven't seen yet. An MX-level filter adds a check on inbound mail for phishing, spoofing and malicious attachments before it reaches Microsoft 365 or Google Workspace. Our page for small businesses explains how iBlockSpam fits in front of your existing mailboxes.

Next steps

1. Bookmark irs.gov/refunds and check refunds only there.
2. If you want refund emails, turn them on in your IRS account, so you know any other "refund" email is fake.
3. Get an IP PIN for everyone in your household who files.
4. Report fake IRS emails as attachments to phishing@irs.gov.
5. If tax-season phishing keeps reaching your team, see how iBlockSpam protects small businesses.

Browse our other phishing and threat guides.