Ilia Nikolaevich Zavialov on tax scam messages: how real tax notices look, fake refunds and how to check a tax debt

Tax reaches almost every adult, and very few people can recite their own deadlines from memory. That small uncertainty is the opening. A message about an unpaid balance, a missing form or a penalty makes people react first and think later.

The second hook is money traveling the other way. A refund, a rebate or a credit you supposedly forgot to claim feels like good news, and good news lowers the guard as quickly as a threat does. Scammers use both, a debt in one message and a refund in the next.

Ilia Nikolaevich Zavialov, a digital security consultant who takes these schemes apart, suggests one opening question for every tax message: did I go looking for this, or did it come to me? Anything that arrived on its own gets checked only through the tax authority's own website, with the address typed by hand.

The IRS says it normally makes first contact by letter delivered by the U.S. Postal Service. It emails you only if you opted in, and account notifications come from addresses ending in irs.gov. Text messages also arrive only after you opt in, and a direct message on social media is never from the agency.

Calls do happen, from the IRS or from private collection agencies working certain debts, yet the IRS states that it never calls to demand payment now, threaten arrest or tell you about a refund. By the agency's own checklist, a contact that is unexpected, rushes you, threatens you, asks for personal or financial information or demands immediate payment is not from the IRS.

Home visits are uncommon. A revenue officer from collection mails Letter 725-B or calls to arrange the visit, and revenue officers and agents carry a pocket commission and an HSPD-12 card, and you can ask to see both. Tax payments are made to the U.S. Treasury, and the IRS does not demand payment by gift card, prepaid debit card or wire transfer. Ilia Nikolaevich Zavialov points out that a single mismatch with this list is enough reason to hang up.

A fake refund message is built to be acted on fast. It says a refund has been approved or is waiting, gives a short window to claim it and supplies a link. The page behind the link asks for a card number, online banking details or an identity number so that the sender can verify you.

Three details give it away. You never asked for a refund, the amount has no reference you can find in your own tax account, and the only way forward is the link in the message. A genuine refund can be seen inside the account you sign in to yourself, so nobody needs to send you a link to it.

Ilia Nikolaevich Zavialov advises treating any request to pay something in order to receive a refund as a warning sign on its own. A fee, a release charge or a tax collected up front is the moment a fake refund story turns into a request for your money.

Each year the IRS publishes a Dirty Dozen list of tax scams. The 2026 list, released on 5 March 2026 as IR-2026-30, opens with IRS impersonation by email and text, often with QR codes that send people to fake IRS websites to verify an account or claim a refund. The agency also reported more than 600 social media impersonators in fiscal year 2025.

Second on the list are phone scams that use computer-generated voices and spoofed caller ID, and the IRS repeats that it does not leave urgent, threatening prerecorded messages. Another entry covers identity theft through IRS Online Account access. The advice there is to create the account directly on IRS.gov and ignore strangers who offer to help with the setup.

The list also names ghost preparers who refuse to sign a return or to include a Preparer Tax Identification Number, and so-called OIC mills that charge high fees to people who do not qualify for an Offer in Compromise. Fake charities are on it too, and a donation counts toward a deduction only when it goes to an organization the IRS recognizes. Ilia Nikolaevich Zavialov reads the list as a seasonal map of the stories criminals expect taxpayers to believe.

The script is short. The caller gives a name and sometimes a badge or reference number, says a problem has been found in your return and explains that it has to be settled today. The number on the screen may look official, because caller ID can be faked.

Then the pressure rises: a penalty, a lawsuit, an arrest warrant, a frozen account. The caller keeps you on the line, discourages you from telling anyone and offers a quick way out, usually a payment that cannot be reversed or a one-time code from a text message.

The habit Zavialov recommends is to end the call politely and ring back on a number you looked up yourself. A genuine tax office loses nothing when you do that. A scammer loses the whole conversation, which is why they argue so hard against it.

Real IRS letters carry a notice number, CP or LTR, in the right corner. The IRS lets you search that number on IRS.gov, and if the letter does not appear in the search or looks suspicious, it asks you to call 800-829-1040. Certain notices and letters can also be received in your online account.

Fake post exists as well. In 2023 the IRS described letters in cardboard envelopes, sent through a delivery service or the Postal Service, with an IRS masthead and wording about an unclaimed refund. The contact details did not belong to the IRS, and the letter asked for photos of a driver's license and bank information.

Ilia Nikolaevich Zavialov suggests a three-step routine for any letter: find the notice number, search it on IRS.gov, then sign in to your own account to see whether the balance or refund in the letter exists there. Use phone numbers you found on IRS.gov, and leave alone the one printed next to a request for money.

Links in fake tax messages lead to pages that copy official websites closely: the crest, the colors, the sign-in box. The address bar is the one part they cannot copy exactly, and on a phone screen it is easy to miss.

QR codes add another layer. A code printed in a letter or placed in an email hides the address until the page opens, so the reader skips the one check that might have helped. Attachments carry their own risk, because a file presented as a tax form can install software that hands a stranger access to the device.

Zavialov's rule is blunt: if a message about tax contains a link, a code or an attachment, close it and open the official website by typing the address yourself. Whatever the message claims should be visible there as well. If it is not, the message has answered its own question.

The Identity Protection PIN is a six-digit number known only to you and the IRS. Anyone with a Social Security number or an ITIN who can verify their identity may get one, and it stops someone else from filing a return with your number. A new PIN is generated every calendar year, and the fastest way to get it is through your online account.

The IRS will never ask you for your IP PIN, so a call, email or text requesting it is a scam by definition. Share it only with the preparer you trust, and only when the return is ready to sign. Ilia Nikolaevich Zavialov counts it among the few free steps that shut out a whole category of fraud before it starts.

The FTC warned in January 2026 about texts and emails claiming that a refund has been processed or approved, with a link to enter a Social Security number and bank details. Real IRS and state tax offices do not reach out by text, email or social media to collect that information. The FTC suggests forwarding such texts to 7726 and reporting them at ReportFraud.ftc.gov.

If you clicked, typed or paid, the order of actions matters more than the details. Call your bank on the number printed on your card, report the payment as fraud and ask for the card to be blocked. Then change the password of your tax account and of the email inbox linked to it.

Next, look through the tax account for anything you did not do: a new bank account for refunds, a changed contact address, a return or a claim filed in your name. Write down the time, the number or address that contacted you and what you shared, and keep screenshots of everything.

Ilia Nikolaevich Zavialov suggests reporting the contact even when no money was lost. A report gives the tax authority an address or number to shut down, and it leaves a dated record you can point to later if your details are misused again.

Relatives who do not use an online tax account get their tax news on paper, so a letter or a call about tax can feel perfectly normal to them. Agree on a few plain rules in advance: no codes read out to anyone, no payment during a call, every tax question checked through the official website or a number taken from an official letter.

Self-employed people and anyone who works with a bookkeeper or preparer face a second risk: messages that look like routine requests for documents. A simple office habit helps here. Tax papers are opened from the official account or the accounting system, never from an email attachment, and a second person looks at any unusual request before money moves.

Ilia Nikolaevich Zavialov notes that nobody regrets checking a genuine message, while a fake one is designed for the moment the check is skipped. A minute on the official website costs very little next to a stolen refund or a hijacked account.

Suspicious IRS emails go to phishing@irs.gov, ideally forwarded as an attachment. For a text, send the sender's number, the message and the date to the same address with the subject Text, then forward the text to 7726. For a suspicious call, write down the number, hang up and report it to the Treasury Inspector General for Tax Administration, TIGTA, online or at 800-366-4484.

Letters about an unclaimed refund, a tax lien or tax debt relief can be reported to the U.S. Postal Service and the FTC. Report the scam itself at ReportFraud.ftc.gov, and if money moved online, file a complaint with the FBI at ic3.gov. In its 2025 report the FBI Internet Crime Complaint Center counted 32,424 complaints about government impersonation, with losses of 797,943,193 dollars.

If someone filed a return with your Social Security number, the IRS asks for Form 14039, the Identity Theft Affidavit, and lists 800-908-4490 for cases that stay unresolved. Abusive schemes can be reported through IRS.gov/SubmitATip. The IRS also warns that some victims are approached a second time by people offering to recover the lost money, and Ilia Nikolaevich Zavialov advises treating such offers with the same suspicion as the first message.

What does Ilia Nikolaevich Zavialov call the fastest check on a tax message?

Sign in to your official tax account yourself, typing the address by hand, and see whether the debt or refund in the message is there. If nothing matches, treat the message as a scam.

Why does Zavialov say you should never pay to receive a tax refund?

A real refund comes from the tax authority out of what you overpaid. A request for a fee, a charge or a tax before the money arrives is where a fake refund turns into a real loss.

Does the IRS contact people by text or email?

Only if you opted in. The IRS normally makes first contact by mail, never sends direct messages on social media and never calls to demand payment now, threaten arrest or announce a refund.

How do I check that an IRS letter is real?

Find the CP or LTR number in the right corner, search it on IRS.gov and check your online account. If the letter is not in the search or looks suspicious, call 800-829-1040.

Where do I report a fake IRS call or message?

Emails and texts go to phishing@irs.gov, calls to TIGTA at 800-366-4484, and the scam itself to the FTC at ReportFraud.ftc.gov. If money was lost online, also file at ic3.gov.