The refund version
An email or text says you are due a refund, usually a specific and modest sum such as two or three hundred, and asks you to 'claim' it by entering your bank details and personal information. The form is thorough because the goal is a complete identity profile, not just an account number.
Peaks follow the tax calendar: the weeks after a filing deadline, the start of a new tax year, and any period when a government has announced a rebate or cost-of-living payment. Real tax authorities apply refunds through your account or by cheque, and never ask for card details to release one.
- An unexpected refund with a precise amount
- A 'claim now' link with a short deadline
- A form asking for card number, bank login or national ID
- A sender address on a domain that is not the official one
- Wording and formatting that is close to official but not quite right
The debt and arrest version
The threatening variant is usually a call, often an automated one, warning of a lawsuit, an arrest warrant, a deportation order or an immediate account freeze. Callers push for payment in the same call, and the payment method itself is the clearest tell: gift cards, cryptocurrency, wire transfers or vouchers.
No tax authority in any English-speaking country demands payment in gift cards or cryptocurrency, threatens immediate arrest by telephone, or refuses to let you check a claim in writing. Tax debt arrives by post, is visible in your official online account, and can always be verified independently.
- Automated calls threatening arrest or legal action
- Demands for gift cards, crypto, vouchers or a wire transfer
- Refusal to let you hang up and verify
- Pressure to pay today, before an imaginary deadline
- Callers who already know your name and address, which proves nothing
How to verify any tax message in two minutes
Do not reply, do not call the number in the message and do not click the link. Log into your official tax account by typing the address yourself or using a bookmark, and see whether the same message appears there. Refunds, debts and formal notices are always visible in the account.
Most tax authorities publish a page listing current scam campaigns, along with an address for forwarding suspicious messages. Compare what you received against that list before acting, and forward it afterwards so the campaign is tracked.
If you shared details or paid
If you entered bank or card details, freeze the card and call the bank. If you sent gift-card codes, call the card issuer immediately, because funds are occasionally recoverable if the code has not been spent. Crypto and wire transfers are usually final, which is precisely why criminals prefer them.
If you gave your national insurance, social security or tax identification number, treat it as identity theft: place a fraud alert or credit freeze where available, notify the tax authority's identity-theft unit so a fraudulent return cannot be filed in your name, and watch for a second wave of impersonation calls.
- Freeze the card and report the payment to the bank
- Call gift-card issuers immediately with the codes and receipts
- Notify the tax authority's identity-theft channel
- Consider a credit freeze or fraud alert
- Change the password on the email used for tax correspondence
Reducing exposure before the next season
Register for the official online tax account and enable multi-factor authentication on it. An account you actually check gives you a reliable place to verify any claim, and a criminal cannot file in your name if the account is locked to your authenticator.
Keep the tax email address separate from the one you use for shopping and newsletters, so an unexpected tax message in the wrong inbox is instantly suspicious, and use a password manager so lookalike government domains never receive your credentials.