Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Never send sensitive information in response to an unexpected message about a tax refund. Do not provide your Social Security number (SSN), employer identification number (EIN), bank or credit-card details, account numbers, passwords, PINs, driver’s-license number, passport number, or other personal identifiers. Do not reply, click a link, open an attachment, or send money from the message.
This guidance covers U.S. federal IRS impersonation and refund messages. State tax agencies can use different communication channels, so verify a state message through that agency’s independently located official website rather than assuming the IRS texting rules apply.
Information to keep out of a tax-refund message
A legitimate-looking refund notice does not make an unexpected request safe. Treat the following as information to withhold from an unsolicited text, email, direct message, or pop-up claiming to be about a refund, credit, rebate, account problem, or identity check.
| Information | Why it is sensitive | Safe response to an unexpected request |
|---|---|---|
| Social Security number (SSN) | It is a core identity identifier that can be used in tax and financial fraud. | Do not disclose it. The IRS identity-protection guidance says to share an SSN only when it is necessary, the requester is trusted, or you initiated the contact. |
| Employer identification number (EIN) | Businesses use it as a federal tax identifier; exposing it can support impersonation and fraudulent filings. | Do not type it into a refund-message link or send it by reply. |
| Bank details | Routing and account numbers can be used to redirect payments or attempt unauthorized transactions. | Do not provide account numbers, online-banking details, or a copy of a check. |
| Credit-card or debit-card details | Card numbers, expiration dates, security codes, and billing information can enable immediate theft. | Never use a refund message to “confirm” a card or pay a release fee. |
| Passwords and PINs | They can unlock tax, email, banking, or other accounts, especially when credentials are reused. | Do not send them, even if the message claims an IRS employee needs to verify your identity. |
| Driver’s-license or passport number | Government identity-document numbers can be combined with other data for impersonation. | Do not upload an image or enter the number through an unsolicited message. |
| Name, address, telephone number, email address, or IP address | These are personally identifiable information (PII) that can make later impersonation more convincing. | Do not “complete your profile” from the message. Verify independently first. |
| Tax-account information or payment details | Return data, filing credentials, payment records, and one-time codes can expose your tax account or authorize a transaction. | Do not disclose them by text, email, or an unfamiliar web form. |
An attacker may already know your name, address, or the last digits of an account. Accurate details do not prove that the sender is the IRS. Use an independent verification path instead of testing the message by supplying more information.
#1 Best Overall
What the IRS will and will not send by text
The IRS does have a limited, opt-in text-message program. People who grant permission may receive appointment reminders and certain service updates. That exception does not authorize a text to collect credentials, money, or account data.
“We never text to ask for: Personal, financial or tax account information; Payments of any kind; PINs, passwords or account numbers.”
IRS text-message policy
Therefore, do not conclude that every message mentioning the IRS is automatically fake. Instead, ask whether you opted in to an IRS service and whether the message merely provides a permitted update. An unexpected refund offer that asks for sensitive details, a payment, or a login is inconsistent with the IRS policy.
Warning signs in a refund message
The IRS identifies several patterns associated with tax scams. One sign alone does not establish who sent a message, but several together should end the interaction and trigger independent verification.
- Unexpected contact: You did not request a text, email, or social-media message about a refund.
- Pressure or threats: The sender says you must act immediately, lose the refund, face arrest, or suffer another consequence.
- An unsolicited refund or credit: The message promises money you were not expecting or says a payment is waiting after a quick identity check.
- A request for personal or financial information: It asks for an SSN, EIN, account number, card number, password, PIN, identity-document number, or tax-account data.
- A demand for immediate payment: The sender requests a fee, penalty, gift card, wire transfer, cryptocurrency, or other payment before releasing a refund.
- An unfamiliar or misspelled destination: A link uses a look-alike domain, an unusual shortened address, or a site that is not IRS.gov.
- An attachment or unusual link: Opening it could expose information or harm the device, a risk highlighted in the IRS’s January 8, 2026 tax tip.
Do not try to prove a message is genuine by replying. The safe question is whether the same matter appears after you sign in through a route you chose yourself.
How to verify a tax message without using its instructions
- Stop at the message. Do not reply, click, call a number in it, scan its QR code, download an attachment, or enter information into its form.
- Open a fresh browser window. Type IRS.gov yourself or use a bookmark you created previously. Do not copy the address from the message.
- Check your IRS Online Account. Look for notices, payment records, refund information, or other correspondence that matches the claim. A message that exists only in the text or email deserves no trust.
- Use an official contact route. If the issue is not clear in your account, find IRS customer-service contact information on IRS.gov. Use that number or channel, not the contact details supplied by the sender.
- Compare the request, not just the branding. Even a message with an IRS logo, correct spelling, or a familiar caller ID is not proof. The decisive issue is whether it requests something the IRS says it will not request by text or unsolicited electronic contact.
The IRS says it does not initiate contact by email or social media to request personal or financial information. A plausible-looking email therefore requires the same independent check as a suspicious text.
What to do with a suspicious message
Do not engage
Leave the message unanswered. Do not negotiate, threaten the sender, or ask for a corrected link. Engagement confirms that your address or phone number is active and creates another opportunity for manipulation.
Preserve enough evidence to report it
Keep the original email or a screenshot of the text if you can do so without opening an attachment or visiting its link. Preserve the sender address, phone number, displayed URL, and date. Do not forward a dangerous attachment to colleagues or friends.
Report an IRS-related attempt
The IRS asks people to report suspicious IRS-related email or text by forwarding the email or a copy of the text to phishing@irs.gov. Reporting helps the agency identify campaigns; it does not make the message safe to open or reply to.
If you already shared information
Act as though the exposed information may be usable. Stop communicating with the sender and do not send additional documents, codes, or money to “finish” the refund. Contact your financial institution promptly if you supplied bank or card information or authorized a payment, and ask what protective action it recommends.
Follow the recovery guidance at IdentityTheft.gov for the type of information disclosed. The IRS also recommends creating an IRS Online Account and obtaining an Identity Protection PIN. An IP PIN helps prevent someone else from filing a federal return using your identity.
Recommended Free Tools
If you sent only a name or address, do not assume the incident is harmless: those details can make a later impersonation more credible. Record what you disclosed, when you disclosed it, and which account or institution may be affected. That record will help you give precise information to your bank, the IRS, or identity-theft assistance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Refund messages versus legitimate IRS contact
| Question | Opt-in IRS service text | Unexpected refund message |
|---|---|---|
| Did you authorize the contact? | You opted in to a specified IRS text service. | You did not request or expect the message. |
| What does it ask you to do? | It provides an allowed reminder or service update without requesting prohibited data. | It asks for personal, financial, tax-account, credential, or payment information. |
| Where do you verify it? | You can independently check IRS.gov and your IRS Online Account. | You must not use the supplied link, number, or attachment; start at IRS.gov instead. |
| What happens if you do nothing? | A reminder or update does not require you to surrender sensitive information by text. | Pressure, threats, or a disappearing refund are warning signs, not proof of an IRS deadline. |
This comparison is specific to the federal IRS. A state department of revenue may have separate opt-in programs and communication rules; verify those through the state agency’s official site.
Common questions about tax-refund messages
Will the IRS text me for my bank account number?
No. The IRS text-message policy says it never texts to request personal, financial, or tax-account information, payments, PINs, passwords, or account numbers. Do not provide a bank account number in response to a text.
Is a refund text genuine if it includes my correct name?
Not necessarily. Personal details can come from data leaks, public records, or previous scams. Verify through IRS.gov and your IRS Online Account without using the message’s instructions.
What if the message says my refund will expire today?
Urgency is a scam warning sign. Do not click or pay. Check your account independently and report the message if it claims to represent the IRS.
Can I click a link just to see whether it is real?
No. The IRS warns that links and attachments in phishing or smishing messages can steal information or harm devices. Treat the destination as untrusted until you have independently confirmed the matter.
Bottom line
An unsolicited tax-refund message should never receive your SSN, EIN, bank or card details, account numbers, passwords, PINs, identity-document numbers, tax-account information, or payment. The IRS permits certain opt-in service texts, but it does not use text messages to collect those secrets or money. Stop, verify through IRS.gov and your IRS Online Account, report suspicious IRS messages to phishing@irs.gov, and use IdentityTheft.gov and IRS identity-protection steps if you already disclosed information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
