IRS Scam Guide: Every Way Scammers Pretend to Be the IRS
Free: How to Keep Yourself Safe From Scammers
9 chapters. Reporting checklist. 30-second protection checklist. Read on the site.
IRS Scam Guide: Every Way Scammers Pretend to Be the IRS
It's 7:14 on a Tuesday morning and your phone shows a Washington, D.C. area code. The voice on the other end says you owe $4,812.50 in back taxes, there's a warrant with your name on it, and you have until noon to settle it with a Walmart gift card or someone's showing up at your door. Your stomach drops before your brain catches up. That gap — the half-second between the threat landing and you thinking clearly — is the entire scam.
I've read through a lot of these. The callers, the texts, the emails with official-looking letterhead. They all share one flaw, and once you know it, every version of this scam falls apart at the same seam.
The One Rule That Kills All of These
The real IRS starts every single interaction with a paper letter through the U.S. Postal Service. Not a call. Not a text. Not a DM. Not an email with a PDF attached. A letter, mailed to the address on your last return, with a notice number you can look up.
That's it. That's the whole rule. If you haven't gotten a letter first, whatever contacted you next isn't the IRS — full stop. Everything below is just this rule playing out in seven different costumes.
Not sure if your message is real? Paste it into Cautellus and get a risk score before you reply.
Scan it free →Or: Get the Chrome extension to scan pages without leaving your browser.
The Seven Scams Currently in Rotation
1. The phone call demanding immediate payment. Still the most common version. A caller claims you owe back taxes, threatens arrest or a suspended Social Security number (which isn't a real consequence — the SSA doesn't work that way either), and pressures you to pay before you can "think it over" or "talk to a lawyer." According to the Treasury Inspector General for Tax Administration (TIGTA), which tracks this scam specifically, 16,281 people reported losing a combined $114 million to IRS impersonation phone scams between March 2013 and March 2025 — over a decade of the same script working often enough to keep running it.
2. The text claiming a refund is waiting (or a debt is due). "Your 2025 refund of $1,247 is ready — verify your bank details to receive it" or "Final notice: unpaid balance, click to resolve." Either way, the link leads to a fake site built to harvest your Social Security number and bank login. I wrote a full breakdown of the gift-card and text version if you want to see just how unhinged some of these get — "under the rest" instead of "under arrest" is a real one people have received.
3. The phishing email with an attachment or a fake CP2000. A CP2000 is a real IRS notice about unreported income — which makes a convincing fake one particularly nasty. Scammers spoof the letterhead, attach a PDF that looks like the genuine form, and ask you to "review and respond" through a link instead of the mail. Real CP2000 notices arrive on paper and never ask you to click anything.
4. The gift-card extortion call. This is really scam #1 with a specific demand attached, but it's common enough to name on its own. The caller insists you pay in Walmart, Target, Google Play, or Apple gift cards — sometimes staying on the phone while you drive to the store and read them the numbers off the back.
5. The deportation or arrest threat targeting immigrants. A variant that specifically targets recent immigrants, threatening deportation or loss of immigration status over unpaid taxes. The IRS has no authority over immigration status, but that distinction gets lost fast when someone's yelling about ICE on the phone.
6. The fake Identity Protection PIN request. The real IP PIN program is a free, six-digit code the IRS issues to stop someone else from filing a return using your Social Security number — genuinely useful, and genuinely free. The scam version calls or emails claiming your IP PIN has "expired" or been "compromised" and asks you to confirm it, or your SSN, to "reissue" it. The IRS never asks you to read your IP PIN back to a caller.
7. The fake "resolve your tax debt" collection agency. A caller claims to work for a private collection agency the IRS uses (the IRS does contract with a small number of real ones) and demands payment through a wire transfer, cryptocurrency, or a payment app instead of a check to the U.S. Treasury. Real IRS-contracted collectors send a letter first too, and they never ask for crypto.
Why the Gift Card Demand Is Always the Giveaway
If you remember one red flag, make it this one: no government agency accepts gift cards. Not the IRS, not the FBI, not your state's DMV, not a courthouse. None of them. Ever.
Gift cards work for scammers for the same reasons they're useless for anyone else trying to trace money: the code is the money, there's no chargeback, no bank to call, and once you read those digits over the phone, that value can move anywhere in the world in seconds. Same logic applies to wire transfers, cryptocurrency, and payment apps used for a supposed government debt — a real tax bill gets paid to the U.S. Treasury, by check or through IRS.gov, not through a rail designed to be irreversible.
How the Real IRS Actually Contacts You
- First contact is always a letter, sent to your address on file, with a notice number (like CP2000, CP14, or LT11) printed on it.
- The letter gives you time to respond, question the amount, or set up a payment plan — the IRS doesn't operate on same-day ultimatums.
- Payments go through IRS.gov, a mailed check to the U.S. Treasury, or the IRS2Go app — never a gift card, wire, crypto, or app-based P2P payment.
- You can walk into a Taxpayer Assistance Center in person if you want a human, in-the-flesh conversation.
- The IRS will never threaten immediate arrest, revoke your license, or demand your IP PIN over the phone.
How to Verify a Notice Is Actually Real
Got a letter, or think you might have missed one? Don't call the number printed on a text or email — type IRS.gov into your browser yourself, log into (or create) your IRS online account, and check whether the notice number matches something on file. You can also call the IRS directly at 1-800-829-1040 to confirm a notice is legitimate before you respond to anything. If a "notice" only exists as a text or email with no matching letter and no record in your online account, you already have your answer.
If You Already Paid or Shared Information
No shame here — the good ones are built to beat calm, careful people on a bad day, not just careless ones.
- Paid with a gift card: Contact the retailer's fraud line immediately with the card numbers. Some can freeze remaining balances if you're fast.
- Wired money or sent crypto: Contact your bank or the exchange right away; recovery odds drop fast but a same-day report is your best shot.
- Shared your SSN or IP PIN: File an Identity Theft Affidavit (Form 14039) and report at IdentityTheft.gov.
- Report the scam itself: Forward phishing emails and texts to phishing@irs.gov, and report the impersonation to TIGTA at 1-800-366-4484 or tigta.gov — TIGTA is the office that specifically investigates people impersonating IRS employees.
If you're not sure whether something you received is a real IRS notice or a scam trying to look like one, run the text, email, or a photo of the letter through our Scam Text Checker before you respond to anything.
The January–April Spike (and What Changes After)
IRS impersonation calls and texts spike hard between January and April, for the obvious reason: tax season is already on everyone's mind, so a message about refunds or balances due doesn't feel out of place the way it would in July. But the scam doesn't clock out after Tax Day — it just changes shape. I wrote about what shows up after the filing deadline: refund-recalculation scams, ghost preparers who vanish once your return is filed, and a fresh round of fake "your return is under review" contact once the initial rush is over. The IRS's own Dirty Dozen list gets refreshed every spring if you want the annual, official rundown of what's currently trending — this guide is the year-round version, organized by how the scam actually contacts you rather than by season.
This is also just one flavor of a much bigger category. Scammers impersonating the IRS, Social Security, the FBI, and local police all run the same basic playbook with different letterhead — worth a look at the broader government impersonation scams landscape if you want the full picture, or our dedicated page on IRS-specific scam patterns.
Got something like this in your inbox? Drop it into the scanner — it takes 5 seconds and could save you thousands.
Check it now →Already been scammed? See where and how to report it.
FAQ
Does the IRS ever call me first? No. The IRS's first contact is always a letter by mail. If a call, text, or email is the first you're hearing about a supposed tax issue, it isn't the IRS.
What if the caller already knows some of my personal information, like my address or the last four digits of my SSN? Scammers buy leaked data in bulk from old breaches — knowing a few real details doesn't confirm they're legitimate. It just means your information showed up somewhere it shouldn't have. Verify independently regardless of what they already seem to know.
Can the IRS really suspend my Social Security number? No. That's not a real IRS or SSA power — it's a fabricated threat designed to scare you into acting before you think. Anyone who says this on a call has told you everything you need to know about them.
Is it a scam if the letter I received looks completely legitimate? Not necessarily — some scam mail is genuinely well-made. The test isn't how it looks, it's how it asks you to respond. A real notice gives you time and a way to verify through IRS.gov or a phone callback you initiate yourself. If it demands an immediate, untraceable payment, treat it as fake regardless of how convincing the letterhead is.
I already sent a gift card or wired money. Is there any way to get it back? Sometimes, if you act within hours — contact the gift card retailer's fraud line or your bank's fraud department immediately with every number and detail you have. The odds drop fast after that, which is exactly why reporting fast matters more than anything else you can do.
Where do I actually report an IRS impersonation attempt? Forward phishing texts and emails to phishing@irs.gov, and report the impersonation itself to TIGTA at 1-800-366-4484 or tigta.gov — that's the office built specifically to investigate people pretending to be IRS employees.
The IRS mails a letter. Everyone else is guessing at your fear and hoping you don't stop to check.
Think you've been targeted? Paste any text, link, email, or screenshot into Cautellus for instant AI analysis.
Scan something free →Want unlimited scans + the Chrome extension? See pricing.
Courtney
Founder, Cautellus · 20+ years in financial services
Two decades in financial compliance, digital security, and fraud prevention. Built Cautellus because the scam detection tools that exist were made for IT departments, not for real people getting weird texts.
Learn moreKeep reading
Support Our Mission
Cautellus is built to protect people from online fraud. Your contribution helps us keep building security tools and resources.