Written by Greg Schneider, Contributor, 2026
Tax Season Is Phishing Season
Every April, two seasons run at the same time. One is tax season. The other is the phishing season that rides on it — because there is no better time to trick people than when everyone is expecting messages about money, deadlines are real, and a refund feels like something you should act on fast.
Scammers don’t need new tricks for this. They just re-run the greatest hits, and they work every year.
The fake IRS message. A text or email says there’s a problem with your return, or your refund is on hold, and you need to verify your information right now. Pause there. The real IRS does not initiate contact with taxpayers by text message or email — that’s their long-standing, publicly stated policy. They start with a letter in the mail. Any text or email claiming to be the IRS and asking you to click, reply, or “verify” is a scam by definition. You don’t have to judge how convincing it looks. The channel itself is the tell.
The refund “processing fee.” Your refund is ready — you just need to pay a small fee, or confirm your bank details on this page, to release it. The page is fake, the fee goes to a stranger, and the bank details you typed in are worth far more to them than the fee.
The preparer impersonation and the lookalike site. An email that looks like it’s from your tax preparer asks you to upload your documents to a portal. Or you search for a filing service, click the first result, and land on a site that looks right and harvests everything you type — including the Social Security number you helpfully entered on page one. Tax data is the complete identity-theft kit: name, address, date of birth, SSN, income. It is worth stealing carefully, and these people steal it carefully.
The W-2 request. This one aims at businesses, and it lands every year. Someone in payroll or HR gets an email that appears to come from the CEO or CFO: “I need copies of all employee W-2s for a review — send them today, keep it between us.” It’s not the executive. It’s a stranger, and if those W-2s go out, every employee in the file gets to spend the next year fighting fraudulent returns filed in their name. The secrecy in the message is the mechanism — it’s there to stop you from checking.
The defenses (this is the part that matters)
Get an IRS Identity Protection PIN. The IP PIN is a six-digit number the IRS issues you, and a return filed under your Social Security number can’t be accepted without it. A scammer with your full identity kit still can’t file as you, because they don’t have the PIN. You can request one through the IRS website — type irs.gov yourself, don’t follow a link — and it renews each year. Of everything on this page, this is the single highest-value ten minutes.
File early. A fraudulent return only works if it arrives before your real one. Once your legitimate return is filed and accepted, a second one under your number gets rejected. Filing early isn’t just about a faster refund; it’s a land grab, and you want to be the one who got there first.
Only reach tax sites by typing the address. Not from an email, not from a text, not from the first sponsored search result. Bookmark the real IRS and preparer sites once, correctly, and use the bookmarks. Most tax-season phishing dies right here, because it all depends on you arriving through their door instead of yours.
Verify your preparer like it matters, because it does. A legitimate preparer has a PTIN (Preparer Tax Identification Number) and signs your return — someone who refuses to sign, wants to be paid in cash or gift cards, or promises a suspiciously huge refund before seeing a single document is telling you what they are. And if your preparer emails you a new “portal” or new payment instructions mid-season, call them on the number you already have before you upload anything. Portals change; a thirty-second call confirms it.
Turn on MFA everywhere a refund could be redirected. Your email first — it resets everything else — then your tax software account, your preparer portal, and your bank. A stolen password alone shouldn’t be enough to change where your money goes.
For small businesses: a two-person rule for employee data. Any request for W-2s, payroll files, or bulk employee information needs a second human to approve it, and the request gets verified by phone on a number already on file — never by replying to the email that asked. Make it written policy before tax season, tell every executive it applies to requests that appear to come from them too, and the W-2 scam has nowhere to land. Nobody legitimate is harmed by a verification call.
Screenshot this
- ☐ IRS IP PIN requested — a return can’t be filed as you without it
- ☐ Filed early — your real return blocks the fake one
- ☐ IRS and preparer sites bookmarked; never arrived at by email or text links
- ☐ Any “IRS” text or email = scam, full stop (they start with a mailed letter)
- ☐ MFA on email, tax software, preparer portal, and bank
- ☐ Preparer has a PTIN, signs the return, and new portal/payment instructions get a phone call first
- ☐ At work: W-2 or payroll requests need two people and a verification call on a known number
The scams are seasonal. The defenses aren’t — set them up once, and April gets a lot quieter.