Risk:High — A tax refund scam message uses fake government texts and portals to capture taxpayer credentials, identity details, and banking information.
Install the app:Open the app and verify suspicious content in one scan.
Tax Refund Scam Message: A Step-by-Step Check
When this applies
Use this walkthrough when an unexpected SMS claims you can collect a tax refund, rebate, tax credit, or social benefit through a link. These messages impersonate tax authorities or benefits agencies and lead to phishing portals designed to steal login credentials, identity data, and banking information. A reconstructed lure may read: “Your tax refund, rebate, or benefit is available. Use this link to claim it and provide your login, identity, and banking details.” The exact wording varies, but the promised payoff and requested information remain the trap.
Decision steps in order
- Inspect the sender. A government-sounding sender name does not prove who sent the SMS; treat an unexpected refund or benefit text as unverified.
- Separate the claim from the evidence. A promise of money is not confirmation that a refund, rebate, credit, or benefit exists. Check your account or correspondence through the agency’s independently located website.
- Identify the pressure. The message pushes you to “claim” the payment through its link, discouraging independent verification even without an explicit deadline.
- Do not open the link. Phishing portals can copy government branding while collecting credentials, identity records, and bank details. Do not trust a page merely because it displays an agency name or official-looking seal.
- Navigate independently. Type the relevant official address yourself, such as www.irs.gov, www.tax.ny.gov, or sede.agenciatributaria.gob.es, depending on your jurisdiction. For US consumer guidance, use consumer.ftc.gov.
- Verify inside the official channel. Look for the refund or benefit status after reaching the site independently; if necessary, contact the agency using details published there.
What to do if you already responded
- Stop entering information and close the page.
- Change any password submitted, starting with accounts where it was reused.
- Contact your bank immediately if you entered banking or payment information.
- Monitor tax, benefits, bank, and identity records for unauthorized changes.
- Report the phishing text and portal through the impersonated agency’s official reporting channel.
Most common warning signals
- An unexpected SMS promises a tax refund, rebate, tax credit, or social benefit.
- The message directs you to claim the payment through an embedded link.
- The linked page impersonates a tax authority or benefits agency.
- The portal requests account credentials to release or confirm the payment.
- The page asks for identity data or banking information.
- The message relies on the promised payment to push immediate interaction with the link.
What to do now
- Do not tap or revisit the link in the tax refund message.
- Open the relevant tax or benefits agency website by typing its official address yourself.
- Change any password entered on the linked portal, including every account where it was reused.
- Contact your bank immediately if you submitted banking information.
- Monitor tax, benefits, financial, and identity records for unauthorized activity.
- Report the text and phishing portal through the impersonated agency’s official channel.
Sources
Further reading
- Account and Payment Recovery After Tax Refund Phishing
- Account and Payment Recovery Scam Defense Guide
- Account Takeover Prevention and Recovery Guide
FAQ
Is a tax refund text genuine if the sender shows an agency name?
No. A sender name can be made to look government-related. Verify the claim by typing the agency’s official website address yourself instead of using the SMS link.
What should I do if I opened the refund link but entered nothing?
Close the page without entering anything. Then visit the relevant tax or benefits agency through an independently typed official address and check your account there.
What if I entered my login or bank details on the portal?
Change the submitted password immediately wherever it was used, contact your bank if financial details were entered, and monitor tax, benefits, financial, and identity records.