Income Tax Refund Fake Link Scam
A message says an income tax refund is approved and asks you to confirm your bank account on a link. The page steals net banking and OTPs.
Around filing season, messages arrive saying your income tax refund has been approved and will be credited once you verify your account. The sender uses terms like assessment year and refund status. The link opens a clone of a tax or bank page that asks for your account number, card and OTP. A refund is money coming in. Nothing you receive needs your PIN or card number.
How the scam works
The scammer times the campaign near the days when many people file returns. The message includes a made-up refund amount, often an attractive round number. The sender name is a mobile number or a header that resembles an official one. Emails go further and add a logo and a footer with a fake grievance address, so it seems like a standard departmental notice.
The pressure is that the refund will lapse or be sent back if you do not verify within a few hours. The page asks you to choose your bank and enter customer ID, password and card details so the refund can be credited. The logic feels plausible because tax refunds do go to bank accounts, but real credits use the account already linked on the official portal.
The payoff is the credential set. The scammer logs into your net banking as you type, triggers a transaction and uses the OTP you provide on the page. Some pages ask for an amount to be sent as a small processing charge to unlock the refund. The refund never existed, and the money you send or lose goes into accounts that the scammer controls.
An example of what you may see
Example message (invented): 'Income Tax Department: Your refund of Rs 15,490 has been approved. To credit it, verify your bank account today at the link below. Enter customer ID, card number and OTP. Refund will expire after 24 hours.' Notice the specific amount, the expiry, the card details and the OTP. A genuine refund goes to the account already registered on the official e-filing portal and never needs your OTP. Nothing here is a real notice, and you can safely ignore it.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- A refund appears for a return you did not expect.
- It asks for card number or net banking login to receive money.
- The refund is said to expire within hours.
- The link is not the official address you type yourself.
- A processing charge is required to unlock the refund.
- The sender is a mobile number or a generic department name.
What to do right now
- Do not use the link or send any fee.
- Check your refund status only on the official e-filing website, typed by hand.
- Confirm your registered bank account inside the official portal if needed.
- Remember that receiving money never needs a PIN or OTP.
- Report the message on Sanchar Saathi or forward the email as the official channels advise.
If you already paid or shared a code
- Call 1930 at once if money left your account.
- Ask your bank through the number on your card to block net banking and cards.
- Register a complaint on cybercrime.gov.in with the message and the page address.
- Change your net banking and email passwords from a clean device.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
Safeavio Sentinel's scam check reads a pasted message and explains the red flags, such as an expiry deadline, a refund that needs your OTP and fake authority. The link check helps you notice lookalike addresses before you open them. The password exposure check gives only a date and a rough result for passwords you enter. It cannot see your refund status or confirm what the tax department owes.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
Do I need to verify my account to get a refund?
Refunds go to the bank account already linked and validated on the official e-filing portal. You do not need to type card numbers or OTPs on a page from a text. If unsure, check the official portal by typing it yourself.
Why does the refund amount look so specific?
A precise number looks more real. Scammers pick random amounts that are large enough to be tempting but not unbelievable. A message with an amount and a link is a pattern, not proof. Never let a stranger set the pace for you.
Can a refund require a processing fee?
A genuine refund is not released after you pay a private person. If anyone asks for a fee to unlock money, it is a scam. Stop and report it rather than paying. You can always call back later using official details.