untrappable

IRS refund email scam: is that refund notice real?

Editorially reviewed · Last updated July 13, 2026

Yes — this is a scam. The IRS never emails you about a refund — and the real irs.gov never sends from a hyphenated look-alike like "irs-gov-tax.example."

Action required: your $1,284.50 federal refund is pending
I
Internal Revenue Service
refunds@irs-gov-tax.example
8:02 AM
Our records show you are eligible for a tax refund of $1,284.50. To receive your payment, verify your information within 24 hours or your refund will be cancelled: irs-refund-verify.example/claim
Claim my refund
The Email, as received

Other versions you might get: A fake "tax transcript" or "stimulus payment" email, a text or call claiming you owe back taxes, or a notice threatening arrest unless you pay with gift cards.

What to do right now

  1. Don't click the link or button, and don't call any number in it. Don't enter your Social Security number, bank, or login.
  2. Check the real source. Type irs.gov yourself and look up your refund at irs.gov/refunds — there won't be a surprise refund waiting.
  3. Report it. Forward the email to phishing@irs.gov, then file at reportfraud.ftc.gov.
  4. Delete it and mark it as phishing.
  5. If you already tapped or shared details: change any password you entered, call your bank if you gave card or account info, and place a free fraud alert with the credit bureaus. If you shared your SSN, see the recovery steps below.

How to make sure it never bites you

These emails land because your address is on breached lists, and a leaked SSN can be reused for fake returns and new-account fraud. Reduce the blast radius — see how to lock down your accounts.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

Does the IRS ever email you about a refund?
No. The IRS's own guidance is one sentence long: “We never email without your permission.” It says the same about the phone — the IRS and its private collection agencies “never call to demand payment now, threaten arrest or inform you of a refund.” So an unexpected email announcing money and asking you to verify your details to release it is not the IRS, no matter how official the logo looks. Check the real thing yourself: type irs.gov and look up your refund status there. If there's no refund waiting, there's no refund.
How do I report a fake IRS email?
The IRS wants the message itself, not a description of it. Its steps: “Don't reply, click links or open attachments,” then send the email to phishing@irs.gov with “IRS” in the subject line. Send it as an attachment (or include the email header) rather than a plain forward — the IRS notes that simply forwarding “strips important data to identify and stop the scammer.” Then report it to the Treasury Inspector General for Tax Administration (TIGTA), delete the email, and — if you want it on the fraud record too — file at reportfraud.ftc.gov.
I clicked the link and entered my Social Security number — what now?
Treat this as identity theft, not just a bad email. The IRS sends victims to IdentityTheft.gov for the recovery steps, and tells you to get an Identity Protection PIN (IP PIN) — a code that stops “scammers from filing a tax return in your name.” If someone has already filed using your SSN, submit Form 14039, the Identity Theft Affidavit. Alongside that: change any password you typed into the fake site, call your bank or card issuer if you gave account or card details, and send the email to phishing@irs.gov.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.