Income Tax Refund Fake Link Scam by email

How it looks by email, the red flags and what to do.

An email gives the scammer room to look official: a signature, a fake invoice, an attachment and a button that goes to a lookalike login page. Income Tax Refund Fake Link Scam is one of the ways this shows up: A message says an income tax refund is approved and asks you to confirm your bank account on a link. The page steals net banking and OTPs.

What income tax refund fake link scam looks like by email

• A sender address that is almost, but not exactly, the real domain.
• A button that says "Verify account" or "View invoice".
• An attachment such as a PDF, ZIP or HTML file you did not expect.

The scammer times the campaign near the days when many people file returns. The message includes a made-up refund amount, often an attractive round number. The sender name is a mobile number or a header that resembles an official one. Emails go further and add a logo and a footer with a fake grievance address, so it seems like a standard departmental notice.

Red flags to check on the email

• A refund appears for a return you did not expect.
• It asks for card number or net banking login to receive money.
• The refund is said to expire within hours.
• The link is not the official address you type yourself.
• The tone is urgent and the grammar is slightly off.
• Hover over the link: the address does not match the company website.

What to do

1. Do not use the link or send any fee.
2. Check your refund status only on the official e-filing website, typed by hand.
3. Confirm your registered bank account inside the official portal if needed.
4. Report it as phishing in your email app and delete it.
5. If you typed a password on the page, change it at once and turn on two-step verification.
6. Do not open the attachment and do not press the button.

Use Report phishing in your email app. If money or accounts are affected, call 1930 and report at cybercrime.gov.in.

If money or a code is already gone

1. Call 1930 at once if money left your account.
2. Ask your bank through the number on your card to block net banking and cards.
3. Register a complaint on cybercrime.gov.in with the message and the page address.
4. Change your net banking and email passwords from a clean device.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio Sentinel's scam check reads a pasted message and explains the red flags, such as an expiry deadline, a refund that needs your OTP and fake authority. The link check helps you notice lookalike addresses before you open them. The password exposure check gives only a date and a rough result for passwords you enter. It cannot see your refund status or confirm what the tax department owes.

Full guide: Income Tax Refund Fake Link Scam: how it works, signs and what to do. Other channels: SMS, WhatsApp.

Questions