Fake Tax Notice Email Scam

An email with a tax notice or demand pushes you to open an attachment or pay a penalty. See how fake notices steal logins and how to check real ones.

An email with a tax department logo says you have an outstanding demand, a mismatch in returns or a notice that needs a reply within 48 hours. It has a PDF or a link to 'view the notice'. The attachment may carry malware and the link leads to a copy of the tax portal that steals your PAN, password and OTP. A follow-up call from a 'tax officer' increases the pressure to pay a penalty.

How the scam works

The scammer copies the style of tax department emails, with a case number and an official-sounding subject such as 'Final notice under verification'. The sender's address looks close to a real government domain. Salaried people, small business owners and senior citizens receive the message, especially around due dates when worry about returns is already high.

The email says that failing to respond leads to a penalty or legal action. The link or attachment opens a login page that looks like the portal and asks for the PAN, password and an OTP. A call may follow in which a person asks you to pay a 'penalty' to settle at once to a personal account, or to install a remote tool to 'fix your return'.

The payoff is the portal login, the OTP and the penalty money. With your login, a scammer can see your income and bank details and use them for convincing calls later. Some also redirect refunds to another bank account. The fear of a legal consequence keeps people from checking the real portal, so the scam works for days before anyone notices.

An example of what you may see

Example email (invented): 'Subject: Notice of demand, immediate response required. Dear taxpayer, a discrepancy of Rs 62,300 has been found in your return. Open the attached notice and log in within 48 hours at the link below to avoid a penalty and prosecution proceedings.' A caller later says he is the assessing officer and asks you to pay Rs 15,000 to a personal UPI ID to close the file today.

This example is written for illustration. Real messages change their wording, names and links all the time.

Red flags

• A tax notice that arrives with a link or attachment and a deadline of hours.
• A sender address that is close to, but not exactly, a government domain.
• A login page reached from an email, asking for the OTP.
• A penalty demanded by UPI to a personal name.
• A threat of arrest or prosecution by email or call.
• A request to install a tool to fix your return.

What to do right now

1. Do not open the attachment or link. Log in to the official portal by typing its address.
2. Check the notices and e-proceedings section of your own account.
3. Ask your tax professional to review any notice before replying.
4. Never pay a penalty to a personal account.
5. Forward the email to the official reporting address and delete it.

If you already paid or shared a code

1. Change your portal and email passwords from a clean device.
2. Call 1930 and report at cybercrime.gov.in if you lost money.
3. Tell your bank on the number printed on your card if card or bank details were shared.
4. Check your registered mobile number, email and bank account on the portal.

National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.

Where this scam shows up

Read how it looks on each channel:

How Safeavio helps

Safeavio's link check can look at the link in a tax email before you open it and warn about lookalike domains, shortened links and risky patterns, and the scam check on pasted email text marks the threat, the deadline and the penalty demand. It cannot open attachments for you or log in to the portal, so check notices only inside your own account.

• Phishing checks
• Scam checks

Questions people ask

Other scams in this group

Also known as: income tax notice phishing, tax demand email fraud, e-verification notice scam, fake IT department letter. More fake government and police scams