A fake IRS or tax refund scam pressures you for money or personal data with an unexpected call, email, text, or “unclaimed refund” message. The real IRS normally starts contact by U.S. mail; unexpected rushes, threats, and demands for immediate payment are red flags. This guide is about tax and IRS impersonation, not general phishing (how to spot a phishing email), fake delivery texts, or tech-support phone scams. You do not need to buy antivirus to hang up and report.

1. Know the warning signs

Scammers impersonate the IRS or mislead you about refunds, credits, and payments. They push for personal, financial, or employment information — or money — right away.

Watch for:

  1. A big payday — “secret” credits or too-good-to-be-true refund tips (often from social media).
  2. Demands or threats — “pay now or else,” threats of arrest or deportation, no chance to question or appeal.
  3. Odd website links — misspelled or non-IRS.gov URLs that can lead to harmful sites.
  4. Unexpected contact that rushes you, asks for personal or financial information, or demands payment immediately.
  5. Social media DMs claiming to be the IRS — the IRS says a social media direct message is never from them.

2. How the real IRS contacts you

Protect yourself by knowing the normal channels (from IRS “how to know it’s the IRS” guidance).

  1. U.S. mail first — The IRS normally contacts you the first time by mail through the U.S. Postal Service. Some collection letters may come from private collection agencies; verify notices on IRS.gov.
  2. Email only if you opted in — Suspicious unsolicited tax emails are a classic phishing pattern. Do not reply, click links, or open attachments.
  3. Text messages only if you opted in — Unexpected “refund ready” texts — treat like fake delivery texts: ignore the link.
  4. Phone — The IRS or a private collection agency may call about account matters in some cases. Automated messages should point you to IRS.gov, not demand gift cards or crypto.
  5. In-person visits are uncommon — Unannounced visits are rare; the IRS generally sends a letter first. Criminal Investigation Special Agents are a different (rare) category and do not demand payment for civil taxes.

If anything feels off, hang up or close the message and check your account yourself on IRS.gov — never through a link in the message.

3. Common household tax scam flavors

These show up often for U.S. households:

  1. Email and text impersonators — Fake IRS/Treasury messages that want money or credentials; opening links or attachments can harm the PC.
  2. Unclaimed tax refund mail or messages — Pressure to send photos or bank details for a refund you supposedly never claimed.
  3. Unexpected tax bill — A bill designed to make you pay the scammer (including gift-card payment schemes).
  4. Fake charity / disaster “help” — Donation or casualty-loss pitches that do not go where you think.
  5. Bad social media tax advice — Influencers pushing fake credits (for example Fuel Tax Credit or other credits you are not eligible for), which can delay refunds or create penalties.
  6. Dishonest tax preparers — Will not sign the return, falsify information, put your refund in their account, or demand cash with no receipt.

4. What to do in the first 15 minutes

  1. Stop — Do not pay, do not share SSN/bank/login codes, do not install remote-access tools.
  2. Hang up / delete the bait path — Close the tab. Do not argue with the caller.
  3. Verify on IRS.gov yourself — Type irs.gov in the browser (or use a bookmark). Sign in only there if you need account status.
  4. Report the fake message — For suspicious IRS/Treasury emails, the IRS asks you to send the message to phishing@irs.gov (prefer as an attachment / with headers when your mail app allows). Also use the IRS report page for texts, sites, calls, and mail.
  5. Report to the FTC — File at reportfraud.ftc.gov.
  6. If money or identity was stolen — Follow IRS “steps if you were scammed,” freeze cards if needed (credit-card fraud first-hour), and consider IdentityTheft.gov.
  7. Optional device check — If you clicked a link or opened an attachment, run Windows Security / Microsoft Defender. Buying a suite is not required first — see Is Microsoft Defender enough?.

FAQ

How do I spot a fake IRS or tax refund scam?

Unexpected contact that rushes you, threatens you, asks for personal or financial information, or demands payment now is a strong scam signal. Prefer verifying on IRS.gov after U.S. mail notices.

Does the IRS text or email about refunds out of the blue?

Treat unexpected refund texts/emails as suspicious. The IRS says email and texts happen only when you opt in, and social media DMs are never from the IRS.

Where do I report a fake IRS email?

Do not reply or click. Send it to phishing@irs.gov (attachment/headers preferred) and use the IRS report-fake-message help page. Also report at reportfraud.ftc.gov.

What if I already paid a scammer?

Report the contact to the IRS and FTC, contact your bank/card issuer, and follow identity-theft steps if SSN or account data was shared. See report identity theft on IdentityTheft.gov.

Do I need antivirus to handle an IRS scam call?

No. Hang up, verify on IRS.gov, and report. Defender or habits are enough for most households unless you also clicked a malware link.

Recognizing and reporting IRS/tax refund scams does not require paid antivirus. Microsoft Defender is a valid buy-nothing choice for many Windows households. What actually helps is ignoring rush payments, verifying on IRS.gov, and reporting fakes. If the household later wants multi-device paid protection, use only these on-site paid links: TotalAV (paid link), Norton (paid link), Bitdefender (paid link), McAfee (paid link), Avast (paid link).