Executive Summary
- Tax season creates a strong social-engineering opportunity because people expect refunds, notices and tax-related communication.
- The awareness post describes a phishing pattern in which a fake tax email or SMS creates urgency around a refund, tax demand or PAN issue and directs the victim to a fraudulent website.
How the Scam Works
- Fake Income Tax email/SMS → 'Refund Failed', 'Tax Due' or 'PAN Issue' → Urgent Link → Fake Income Tax Website → Login/PAN/Banking Details → Credential Theft or Financial Fraud.
- The post also warns that phishing messages may contain attachments or links capable of installing malicious software.
Red Flags
- Claims that a refund is on hold.
- Immediate payment demands to avoid a penalty.
- Threats that a PAN will be blocked.
- Requests to verify a bank account.
- Requests for OTP, PIN or password.
- Suspicious or misspelled domains.
- Unexpected attachments or payment links.
The Golden Rule
- Never verify an unexpected tax notice through the link supplied in an email or SMS.
- Open the official Income Tax e-Filing portal yourself and verify whether a notice, demand or refund actually exists.
- The source post states that the Income Tax Department does not ask taxpayers for PINs, passwords or similar financial-account access information through email.
If You Receive a Suspicious Message
- STOP → DON'T CLICK → VERIFY → REPORT.
- The source post provides webmanager@incometax.gov.in and incident@cert-in.org.in as reporting addresses for suspicious tax phishing emails or URLs, and references cybercrime.gov.in for compromised e-Filing accounts.
CyberRakshak Labs Insight
- Cybercriminals do not necessarily need to compromise the Income Tax Department; they may only need to make a victim believe that they are communicating with it.
- Don't click because a message looks official. Verify because your money is real.
Source note: This research page expands the corresponding CyberRakshak Labs LinkedIn post supplied by the author. Claims and figures in the incident sections are presented as reported in that source post.