Tax season in October

The IRS text scam and the real letter you'll get instead

Updated 6 October 2026

You are reading the message on a work break and the math is already wrong. The IRS does not text you, does not DM you, and does not hand you a refund through a link in an SMS, and any claim that it does is the first dollar you will lose to the people who built the lie. The real IRS will spend sixty cents on a letter before it spends a single character on your phone.

What the IRS text scam looks like in October 2026

The latest wave hitting U.S. mobile numbers this month opens with a calm, official tone. You will see one of three shapes, and each one is designed to make your thumb move before your brain does.

The first is the "unclaimed refund" text. It says the IRS has tried to deliver a refund and you need to confirm a mailing address through a short link, usually a redirector built on a free service. The second is the "underreported income" text. It claims a 1099 or a W-2 has been filed in your name and you owe a small balance that you can settle today through the same link. The third is the "verify your identity to receive your Economic Impact Payment" text, a recycled script from the pandemic era that still pulls in new victims every filing season and now rides a second wave as a federal cost-of-living adjustment is rolled out in late 2026.

All three rely on the same lever. A text carries a sense of now. A letter feels like a thing you can deal with on Saturday. The scammer wants Saturday to never come.

The links themselves are the giveaway for anyone who looks. A real IRS address ends in irs.gov, and nothing else, and even then the agency does not link you to a refund form in an SMS. The scams use lookalike domains such as irs-refund-portal[.]com, secure-efts[.]gov, or short links that resolve to a freshly registered address on a foreign registry. Tap the link on a desktop browser and you will usually see a clean impersonation of an IRS page with a U.S. flag, the agency seal, and a polished form asking for your name, date of birth, Social Security number, and a payment method. The form posts to a server the scammer controls, and the operator behind it is now selling the package for about thirty dollars a record to a downstream buyer who will use it to file a fraudulent return in your name.

That downstream sale is the part most victims do not see coming. The text is not the whole job. The text is the lead generation for a tax-related identity theft that will not show up until the victim tries to file their real return months later and finds that someone already did.

If you have already tapped the link and typed your details, the damage is no longer theoretical. You are now in the queue for a fraudulent return filed under your SSN, and the window to act before the next filing cycle opens is short.

First, file an IRS Identity Theft Affidavit through IdentityTheft.gov, which is the federal intake that issues you an Identity Protection PIN. The IP PIN is a six-digit number the IRS will require on your real return next year, and without it, a fraudster cannot file as you even if they have your SSN. You will receive a fresh one each January, and the IRS will only send it through the mail to the address on file, not by text, not by email, not over the phone.

Second, place a free fraud alert with one of the three credit bureaus, who are required by law to share the alert with the other two. The bureau will issue a fraud alert and you can request a free credit report to check for accounts you did not open. A fraud alert lasts one year and is renewable.

Third, report the text itself to the IRS by forwarding the message as-is to 202-552-1226, a reporting address the agency has run since 2024. The address accepts SMS and MMS, and the IRS uses the volume to build takedown cases against the redirectors and the lookalike domains. Report the same message to the FTC at ReportFraud.ftc.gov, then delete the message.

Fourth, check your IRS online account at irs.gov for any return that has been filed in your name. If a return is sitting there that you did not submit, the IRS has a form for that and the agency will walk you through clearing it. Do not expect that call to come by phone, either. The IRS will write to you.

How the real IRS contacts you, and what each channel looks like

The IRS has five official channels, and text is not one of them. Knowing the real list is the only durable defence, because the scammers will keep rewriting the SMS script to chase whatever the agency is doing this quarter.

The first channel is paper mail to the address on your last filed return. A genuine IRS letter arrives in a plain white envelope with a U.S. Treasury return address. It will reference a notice number, usually a four-digit code such as CP2000 or CP504, and it will tell you what the agency thinks is wrong and what to do next. It will ask you to respond through irs.gov or by phone to a number printed on the letter, not a number in a separate text or email.

The second channel is the secure messaging inside your IRS online account, which you access by signing in at irs.gov with ID.me. The agency will not message you there about a refund you did not ask for, and the only refund-related action you will see in the inbox is a notice that a return has been processed and a direct deposit has been scheduled to a bank account you authorised on the original return. If you did not file, you did not authorise, and the message is not the agency's.

The third channel is the telephone, and this is where the line gets blurry because scammers love to impersonate it. A real IRS agent will never, under any circumstance, demand immediate payment over the phone, ask you to buy gift cards, threaten to send police to your house, or refuse to mail you a written follow-up. The agency does not accept payment by gift card, by cryptocurrency, by wire transfer, or by payment app. If the person on the line is asking for any of those, you are talking to a criminal. Hang up, then call the IRS back at the number on your most recent notice, or at the official line printed in the agency's contact directory, which is a number you dial, not a number a stranger dialed for you.

The fourth channel is in-person contact at a Taxpayer Assistance Center. The agency does make these appointments, but only after you have a notice in hand or a specific question about a filed return. The appointment is scheduled through your online account or by calling the main line, and the centre will never cold-call you to invite you in.

The fifth channel is email, and this is the easiest rule. The IRS does not send unsolicited email about a refund, a balance, an investigation, or a warrant. The agency uses email only as a notification that something new is waiting in your secure online account inbox. If the body of the email is asking you to act, the body of the email is the scam.

The contrast with a text scam is the contrast between a government that runs on a postal system and a criminal that runs on a click. The IRS has been mailing notices since 1862 and will still be mailing notices in 2042, because the mail is the only channel that produces a paper trail the agency can use in court. The text scam has no interest in a paper trail. The text scam has an interest in the seven seconds between the buzz of your phone and the tap of your thumb.

Why the IRS will never ask for a payment app, a gift card, or a wire

The payment method is the tell. Most people who lose money to an IRS impersonator do not lose it because they believed the agency existed. They lose it because the method on the other end of the call or the link was plausible enough to bypass suspicion. It is not plausible. It is the tell.

The IRS accepts payment by direct debit from a U.S. bank account, by debit or credit card through an approved processor that charges a small fee, by check or money order, by cash at a participating retail partner through the IRS2Go app's "pay with cash" feature, and by Electronic Federal Tax Payment System transfer from your own bank. The list is short, dry, and slow on purpose. Every channel on that list produces a record tied to a real account in your name, and that record is the entire point of a system that has to defend itself against refund fraud at scale.

The list does not include Zelle. It does not include Venmo. It does not include Cash App. It does not include Bitcoin, USDT, or any other cryptocurrency. It does not include gift cards from any retailer, including the big-box stores that sell them at the front of the shop. It does not include wire transfers through Western Union or MoneyGram. It does not include a courier showing up at your door to collect cash in a bag. Every one of those methods exists to be unrecoverable, and every one of them is the way a criminal will tell you the agency wants to be paid.

This is the part where the line should be obvious. The agency that runs the U.S. federal tax system is not paid through a channel designed to disappear in fifteen minutes. The agency that runs the U.S. federal tax system is paid through a channel that produces a receipt the agency can read in three years when the audit starts. The criminal is the one who needs you to act in fifteen minutes, and the criminal is the one who will hang up first.

There is a related scam, and it is the one that costs the most money per victim, so it is worth describing on its own. The variant works like this. A victim returns a missed call, an SMS, or a voicemail that claimed to be the IRS. The number routes to a live operator working out of a call centre, often outside the U.S., who keeps the victim on the line for hours and walks them through a fake audit, a fake arrest warrant, a fake lawsuit, or a fake criminal referral. The operator will then move the victim onto a second channel, usually a chat app with end-to-end encryption, to avoid a wiretap. The payment demanded is usually a wire or a gift card, and the amount is usually between two and fifteen thousand dollars, calibrated to the victim's apparent net worth after a short scripted interview about their home, their car, and their job. The payment is unrecoverable the moment it is made.

You cannot reverse a wire once it has been picked up. You cannot reverse a gift card after the numbers have been read over the phone. You cannot reverse a Zelle payment to a stranger, and the bank's fraud department will tell you the same thing. The only reversal that works is the one that happens before the money leaves your account, and the only way to win it is to refuse the channel, not to argue with the operator on the other end.

What to do right now if the text is already on your phone

If a message is sitting in your SMS inbox that claims to be the IRS, the order of operations is short. Do not tap the link. Do not reply, because a reply confirms the number is live and the number will be sold to the next crew within hours. Take a screenshot of the message including the sender number, the body, and the timestamp, then forward the original to 202-552-1226 and report the same screenshot at ReportFraud.ftc.gov. Delete the message from your phone. Block the sender. Check your phone bill for any premium-rate charges if you tapped a link that opened a subscription page, and call your carrier if you see a charge you did not authorise.

If you tapped the link and saw a form but did not fill it in, you are probably safe, but you should still treat your phone as if the SMS itself confirmed your number is live. Expect a second wave. The follow-up is usually a phone call from a person claiming to be an IRS agent, and the call will reference the text you received. Hang up, then call the IRS main line at the number listed in the agency's contact directory if you want to confirm the agency was not actually trying to reach you. The agency will tell you the truth in five minutes, because the agency loves writing things down and hates being impersonated.

If you tapped the link and filled in the form, treat the SSN and the date of birth as compromised. File the Identity Theft Affidavit at IdentityTheft.gov to receive an Identity Protection PIN. Place a free fraud alert with one of the three credit bureaus. Pull a free credit report from AnnualCreditReport.com and read every line. Consider a free credit freeze through the same three bureaus, which blocks new credit outright and is the strongest single step a U.S. consumer can take against new-account fraud. The freeze stays on until you lift it, costs nothing, and does not affect your existing accounts.

If you paid the scammer by any of the methods on the unrecoverable list, call your bank or the payment app's fraud line within the hour and ask for a recall. The recall is unlikely to succeed, but the report is what unlocks the reimbursement. For wires, call the originating bank and the receiving bank and file a fraud report with both. For gift cards, call the retailer's fraud line with the receipt number, the gift card number, and the time of the transaction. For Zelle or Venmo, open a dispute inside the app and call the linked bank's fraud line at the number on the back of your debit card, not a number the scammer gives you. The bank will walk you through a signed statement, and the statement is what the reimbursement process runs on.

Then, in every case, file a complaint with the FTC at ReportFraud.ftc.gov and an IRS Impersonator Scam report with the Treasury Inspector General for Tax Administration at tigta.gov. The two reports together feed the federal casework that drives the domain takedowns and the call-centre raids that make next quarter's wave smaller. The text you received is evidence, and evidence is what the next victim's protection runs on.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.