The Income Tax Department does not send refund links by SMS, email, or WhatsApp, and it never asks for your bank details, OTP, or password to release a refund. Real refunds are credited automatically to the bank account you already validated on the e-filing portal. If a message says your refund is pending and you must click a link, do a manual verification, or confirm bank details to get it, that message is a scam. Do not click. Check your status only at incometax.gov.in, and if you have already shared details or lost money, call 1930.
Who this is for
Anyone in India who files an income tax return or is waiting on a refund. ITR-season scams peak from July to October, when genuine refunds are actually being processed and a fake refund message feels plausible. The most-targeted groups: salaried taxpayers expecting a payout, senior citizens, NRIs whose e-filing accounts hold high refund values, small business owners and traders who fear a raid, and anyone who has just filed and is checking their phone for updates.
What an ITR refund scam is
It is a phishing and impersonation fraud that borrows the authority of the Income Tax Department. The scammer sends a message that looks official, promises a refund or threatens a penalty, and pushes you toward a fake portal or a phone call. The goal is one of three things: your login and bank credentials, an OTP, or a direct transfer.
There are four common variants running in 2025 and 2026:
- Fake refund SMS and email. A message claims a refund is approved or pending and links to a lookalike page.
- Clone e-filing portals. Fake sites that copy the income tax portal on a slightly different domain to capture PAN, password, and bank details.
- Account takeover. Scammers who already have enough of your data change your registered email, mobile, and bank account, then file a forged revised return and divert the refund.
- Fake notice and tax-officer extortion. A caller or email poses as an income tax officer, invents a demand notice or penalty, and pressures you to pay before a fake deadline.
Why this is spiking now
The Income Tax Department issued a fresh advisory in February 2026 warning taxpayers about fake refund SMS messages that mimic genuine notifications and link to counterfeit websites, and urging people to verify refunds only through the official portal (Business Today). The PIB Fact Check unit separately flagged a fake email offering a Rs 50,000 refund for Assessment Year 2025-26 and falsely claiming that refunds above Rs 25,000 need a manual verification (Free Press Journal, Zee Business).
This sits inside a much larger fraud wave. Government data compiled by the Ministry of Home Affairs and the Indian Cyber Crime Coordination Centre (I4C), reported in February 2026, shows the scale:
| Year | Cyber fraud loss | Cases reported |
|---|---|---|
| 2024 | Rs 22,845 crore | 22.68 lakh |
| 2025 | Rs 22,495 crore | 28.15 lakh |
Source: The Print, citing MHA and I4C data.
Case volumes rose about 24 percent year on year even as total losses stayed roughly flat, which points to faster fund-freezing on the government side and a rising count of smaller-value phishing attempts on the citizen side. Refund and identity-theft frauds like the ITR scam fall into that high-volume bucket, not the multi-crore investment scams that dominate the loss figure. The exact rupee loss to ITR refund phishing alone is not separately published, so treat it as a common and growing slice rather than a precise number.
How the fake refund scam works
The refund variant follows a short script, documented across the Income Tax Department advisory and press coverage:
- The bait message. An SMS, email, or WhatsApp text says your refund is approved, pending, or about to lapse. One sample flagged by the department reads: “Dear taxpayer, your refund is pending. Click now to avoid penalty” followed by a link on a junk domain like incometax-refund-claim.xyz (Business Today).
- The lookalike sender. Emails often come from addresses built to look real. The department publicly named one fake sender, donotreply@incometaxindiafilling.gov.in, where “filling” is a deliberate misspelling of “filing” (Income Tax India on X).
- The clone portal. The link opens a page that copies the e-filing portal but sits on a domain that is slightly off, such as a hyphenated or misspelled version of incometax.gov.in.
- The data grab. You are asked to log in and enter PAN, bank account number, and an OTP, sometimes framed as a manual verification required for refunds above a certain amount. No such verification exists.
- The drain. With your credentials and OTP, the scammers empty the account, or log in to your real e-filing profile, change the linked bank account, and redirect the refund.
The threat variant flips the emotion. Instead of a reward, you get a fake notice or a call claiming unpaid tax, a penalty, or an inquiry, with a demand to pay immediately. In one pattern reported in Karnataka, callers pose as income tax officials and threaten an inquiry to frighten people into paying (Deccan Herald).
Real cases
These are reported in mainstream Indian press.
NRI account takeover. Rs 2.26 crore. A cyber gang hacked the income tax e-filing account of an NRI, changed the registered email, mobile, and bank details, filed forged revised returns, and diverted the refunds to fake accounts. The alleged kingpin, Dalip Rajgoda, was arrested by the Panchkula Cyber Crime police, with investigators tracking suspicious transactions of around Rs 13 crore across nine bank accounts (The420.in).
Fake refund-delay message. Rs 1.5 lakh. A taxpayer who received a fake “refund delay” message, clicked through to a page mimicking the e-filing portal, and entered personal and banking details lost Rs 1.5 lakh (Business Today).
Fake tax-officer extortion. A gang posing as Income Tax and GST officers ran a “Special 26” style racket in a market in Ghazipur, Uttar Pradesh, entering shops, claiming to conduct raids, and pressuring traders for money until shopkeepers caught members and handed them to police (Asianet Newsable).
What these share: the victim was pushed to act fast, the pretext used the tax department’s authority, and the money or data moved before anyone verified through an official channel.
5 red flags any taxpayer can apply
Any one of these is enough to stop and verify. Do not wait for a second flag.
1. A refund needs you to click a link or “verify” bank details
Genuine refunds are credited automatically to the bank account already validated in your e-filing profile. There is no click, no manual verification, and no fee. Any refund that depends on a link or a form is fake.
2. The message asks for PAN, password, OTP, or card details
The Income Tax Department has stated it never asks for PINs, passwords, or access to your bank or card accounts through email (Income Tax India report-phishing page). Anyone asking is impersonating it.
3. The link is not exactly incometax.gov.in
Look hard at the domain. Real e-filing lives at incometax.gov.in. Scam pages use hyphens, extra words, misspellings, or odd endings like .xyz or .info. A sender address like incometaxindiafilling.gov.in with a doubled letter is a tell.
4. There is a deadline, a penalty, or an “avoid arrest” threat
Urgency is the weapon. “Click now to avoid penalty”, “refund will lapse today”, or a caller threatening an inquiry or arrest are all pressure tactics. Real tax matters do not resolve through a rushed payment to a private account.
5. A caller claims to be an income tax officer and wants money now
Officers do not collect tax or penalties over a phone call into a personal account or UPI. Genuine demands come as notices on the e-filing portal, each carrying a Document Identification Number you can independently check.
What to do if you got a message or call
- Do not click, and do not call back. Ignore any link or number inside the message.
- Check your real status. Open incometax.gov.in yourself, log in, and look at your actual refund status. If a notice is claimed, use the Authenticate Notice feature to confirm the DIN.
- If you already entered details, act fast. Call your bank to freeze the account and block cards, change your net-banking and e-filing passwords from a trusted device, and check whether your registered email, mobile, or bank account was changed on the portal.
- Call 1930. This is the national cybercrime helpline, run 24/7 by I4C under the Ministry of Home Affairs.
- File at cybercrime.gov.in. Do it in the same window. Speed is the single biggest factor in freezing money before it moves.
- Report the phishing. Forward the fake email or website to webmanager@incometax.gov.in, with a copy to incident@cert-in.org.in (Income Tax India).
- Tell people. A short message to family and colleagues stops the next person from clicking the same link during refund season.
Got a message? Send it to us, we verify free
If a refund SMS, email, or a call claiming to be from the tax department feels off and you want a sanity check before doing anything, send it to us privately.
WhatsApp: +91 99644 43350
Send a screenshot, the sender number or address, and any link (do not click it first). We tell you whether it is a genuine tax communication or a scam, and which official channel to use next. Free verification, no charges, no judgment. We do not ask for your bank details, OTP, or passwords, and we never pose as a government agency.
For the same broad audience that tax scammers target, we also publish guides on the digital arrest scam and on fake loan app harassment.
Save these now
If you are ever unsure about a tax refund message or a caller claiming to be an income tax officer:
- Check status only at incometax.gov.in
- Report cybercrime: 1930 or cybercrime.gov.in
- Report phishing: webmanager@incometax.gov.in
Save them before you need them. During an active scam, you will not have time to search.