iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Stop interacting with the page immediately. Do not reply, click again, open an attachment, enter more information, or send money. A click by itself does not prove that your identity was stolen or that malware installed. Your next steps depend on whether you entered a password, SSN or ITIN, bank or card details, sent money, or downloaded a file.
This guide is for U.S. consumers and follows current Internal Revenue Service guidance, including IRS Tax Tips dated July 8, 2025, and January 8, 2026.
What a fake refund-link click does—and does not—prove
Scammers use messages that appear to promise an income-tax refund, correct a filing problem, or unlock a delayed payment. The message may arrive by email, text message, or a social-media account impersonating a tax agency. The IRS says it does not make initial contact through email or social media; an IRS letter or notice is the first contact.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Opening the link tells you only that a page was loaded. It does not establish that anyone obtained your identity information, that an account was taken over, or that malicious software installed. IRS warnings say links and attachments may harm a computer, but they do not quantify the chance of compromise from a click alone. The important questions are what you entered afterward and whether a file downloaded or ran.
#1 Best Overall
The IRS identity-protection page puts the distinction plainly: “Not all data breaches or computer hacks result in identity theft.”
What do I do if I clicked a fake IRS refund link?
- Close the page. Stop typing and do not follow prompts that ask for a Social Security number, Individual Taxpayer Identification Number, password, card number, bank details, or a fee.
- Stop communicating with the sender. Do not reply, call a number in the message, click the link again, or open an attachment.
- Record what happened. Keep the original email, text, or social-media message. Note the sender, the link, and the date and time. Do not forward a dangerous attachment to other people.
- Classify the exposure. Decide whether you only clicked, entered account credentials, entered SSN/ITIN or other tax identity details, supplied card or bank information, sent money, or downloaded or ran a file. Each category has a different response.
Act in that order even if you feel embarrassed or rushed. A scam page is designed to keep you engaged and to make each additional disclosure seem routine. You do not need to answer the sender’s questions to find out whether the offer is real; independent verification through IRS.gov is safer.
Choose the response that matches what happened next
| What happened | Priority response |
|---|---|
| Clicked, then closed the page | Do not return to it; report the message and check for unusual activity. |
| Entered a password or username | Secure that account through its genuine website or app, change reused passwords, and turn on multifactor authentication where available. |
| Entered an SSN, ITIN, or tax identity details | Report to IdentityTheft.gov and the IRS, consider your state tax agency, and obtain an IRS Identity Protection PIN. |
| Entered card or bank information, or sent money | Contact the financial institution promptly using a trusted number or its official app or site. |
| Downloaded or ran a file, or the device now behaves oddly | Disconnect from further interaction with the scam and obtain trusted device support; do not assume a click alone installed malware. |
If more than one row applies, follow all of the relevant steps. For example, entering an IRS-account password and a bank-card number requires both account security and a call to the financial institution. Tell each legitimate provider exactly what you submitted so it can give instructions appropriate to that exposure.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you clicked only
Close the tab and leave the message untouched. Do not “test” the link again or answer follow-up questions. Report the message using the instructions below, then independently check your tax information. Monitor your email, financial accounts, and tax correspondence for activity you do not recognize. The available IRS guidance does not establish that a click-only event means data theft, so avoid treating the event as proof of identity theft.
Do not provide information simply because the page displayed your name, a partial address, a refund amount, or an official-looking seal. Those details can be copied into a convincing impersonation. A page that asks for a fee, gift card, payment-card verification, or a password before releasing a refund is not a safe way to confirm a tax payment.
If you entered a password
Open the affected service by typing its known address or using its official app—not by using the suspicious message. Change the exposed password immediately. Change it anywhere else you reused it, because a scammer may try the same credentials on other services. Enable multifactor authentication when the service offers it. For an IRS account, the IRS specifically recommends an IRS online account with multifactor authentication.
If the password belongs to an email account, secure that account first: an attacker who controls email can intercept password resets for other services. Review account activity and recovery methods from the provider’s genuine security page and remove unfamiliar sessions or devices. Do not send a verification code to anyone who contacts you about the incident; use codes only in the legitimate service you opened yourself.
Recommended Free Tools
If you entered an SSN, ITIN, or other tax identity information
Report the exposure at IdentityTheft.gov and report it to the IRS. Consider notifying your state tax agency as well, because state filing systems and procedures differ. Request an IRS Identity Protection PIN (IP PIN), a six-digit number that helps prevent another person from filing a federal return using your identity information.
Set up or secure your IRS online account and enable multifactor authentication. If you learn that someone already filed a return using your information, follow the IRS direction to obtain a copy of the fraudulent return and submit Form 14039, Identity Theft Affidavit. Keep confirmation numbers and copies of what you submitted. Do not send your SSN or a tax document back to the original message address.
If you entered card or bank details, or sent money
Contact the relevant bank, card issuer, or payment institution promptly. Use the telephone number printed on your card, a statement, or the institution’s official app or website. Do not use contact details supplied in the scam message. Tell the institution exactly what information you supplied or what payment you sent and follow its incident instructions. IRS guidance says to contact your financial institution when a scam involved lost money or identity information; it does not promise that a particular transaction can be reversed.
Continue to watch the account for transactions or alerts you do not recognize and communicate through the institution’s established channel. A person claiming to be from the bank, IRS, or a recovery service may contact you after the first incident; verify that person independently rather than using a callback number in a message.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If you downloaded or ran a file
Do not open the file again or install anything the page recommended. If the device is behaving unusually, stop using it for sensitive logins until you can obtain help from a trusted device-support professional or your organization’s IT team. Preserve the message and note what file was downloaded and when it ran.
Rank #3
- EFFICIENT ACCOUNTING MADE SIMPLE: Clever Fox Horizontal Accounting Ledger Book is an effective and easy-to-use tool for tracking payments, deposits, and balances in each of your accounts.
- PERFECT FOR SMALL BUSINESS OR PERSONAL USE: This accounting book ledger is perfect for keeping books on your small business or tracking personal finances. With a clear record of transactions, you can easily spot fraudulent charges or other errors.
- TAKE CONTROL OF YOUR FINANCES & SUCCEED: Using this accounting log book, you will have everything you need to analyze your financial operations, assess your income and spending, and prepare accurate financial statements.
- PREMIUM MATERIALS FOR EXTRA DURABILITY: This columnar book has an eco-leather hardcover, thick 120gsm paper, pen loop, elastic band, lay-flat binding, bookmark, and pocket for loose notes. The personal & business ledger measures 10 by 7 inches.
- 60-DAY MONEY-BACK GUARANTEE: We will exchange or refund your business bookkeeping ledger if you aren’t satisfied with your book keeping log for small business for any reason. Reach out to us via message to refund your accounting journal book.
IRS guidance recommends current security patches, a firewall, and anti-spam or antivirus protection. Those are sound baseline controls, but the reviewed IRS pages do not provide a specific forensic cleanup sequence for this scenario. Do not diagnose malware solely from the fact that you clicked, and do not assume that buying a particular security product is required.
How to report the fake refund message
Reporting helps the IRS identify impersonation campaigns. Keep the original message or its headers when possible, because they preserve information investigators may need.
Email impersonating the IRS, Treasury, or a tax service
Send the suspicious email to phishing@irs.gov. The IRS prefers receiving the email itself or its headers. If that is not possible, provide the underlying URL in your report. Do not alter the original message more than necessary to transmit it safely.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Tax scam text message
Email phishing@irs.gov with the sender’s telephone number, the full message content, your recipient number, and the date, time, and time zone when it arrived. Also forward the text to 7726, which spells “SPAM” on a phone keypad and routes reports to participating mobile carriers.
Social-media impersonation
Use the platform’s reporting controls to flag the account or post. Then send the complete account URL to phishing@irs.gov. Do not continue a direct-message conversation while collecting evidence.
How to verify a refund or notice safely
Never use the link or telephone number in the suspicious message to check a refund. Type IRS.gov yourself, sign in to your IRS online account, or locate an official IRS telephone number independently. Check whether a notice or refund appears in the account and compare it with paper correspondence you have received.
An unexpected email or social-media direct message is not how the IRS initiates contact. If a real issue exists, the agency’s first contact is an IRS letter or notice. A message claiming that immediate payment, a verification code, or a fee is needed before a refund can be released is therefore a strong warning sign.
Do not let a message’s branding, a familiar-looking sender name, or a short deadline override this check. Navigate independently every time, even if the message contains a case number or a link that appears to begin with an IRS-related term.
Protect yourself from a second scam
After a victim reports a loss, criminals may pose as investigators, recovery specialists, or government representatives. They may promise guaranteed recovery, demand an upfront fee, or ask for additional passwords and financial information. IRS recovery guidance warns about this follow-up tactic. Treat any unsolicited recovery offer as another scam and verify every contact independently.
What to monitor after the incident
- Look for password-reset notices, sign-in alerts, or new recovery addresses that you did not request.
- Review bank and card activity for unfamiliar transactions and respond through the institution’s official channel.
- Watch for IRS or state tax notices, filing confirmations, or refund changes you cannot explain.
- Keep the original scam message, your report details, and any institution case numbers together.
- If new evidence shows that tax identity information was used, follow the IdentityTheft.gov, IRS, and state-agency reporting steps rather than replying to the original scammer.
When to get additional help
Contact your financial institution immediately when money or payment credentials were involved. Use the IRS and IdentityTheft.gov reporting routes when SSN, ITIN, or tax-return information was exposed. Seek trusted technical support if a download ran or the device shows unexplained behavior. These channels can address the specific type of exposure without requiring you to trust the person who sent the refund link.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Frequently asked questions
Is my identity stolen if I clicked a phishing link?
Not necessarily. Clicking alone does not prove that identity information was taken or that identity theft occurred. Determine whether you entered credentials or tax identifiers, supplied financial details, sent money, or downloaded a file, then follow the matching response.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShould I change every password after clicking?
Change the password you entered and any other account where you reused it. Secure an exposed email account first and enable multifactor authentication where available. If you clicked without entering credentials, the IRS guidance does not require treating every password as compromised.
Best Value
What if I entered my SSN but no money?
Report the exposure through IdentityTheft.gov and to the IRS, consider contacting your state tax agency, and request an IRS IP PIN. Secure your IRS online account with multifactor authentication and watch for fraudulent filing notices.
How do I report an IRS refund scam text?
Email phishing@irs.gov with the sender number, complete text, your recipient number, and the date, time, and time zone. Forward the text to 7726 as well. Preserve the original message while reporting it.
Can the IRS recover money I sent to a scammer?
Contact the financial institution or payment service promptly and follow its instructions. Do not assume a reversal is guaranteed, and be suspicious of anyone who promises recovery for an upfront fee.
Frequently Asked Questions
What should I do immediately after clicking a fake IRS refund link?
Close the page, stop responding, avoid attachments and downloads, and do not enter more information or send money. Then identify what, if anything, you disclosed and follow the matching account, tax-identity, financial, or device steps.
Does clicking a fake tax link automatically install malware?
No conclusion can be made from a click alone. IRS warnings say links and attachments may harm a computer, but they do not establish that malware installed in every click-only event. Get trusted technical help if a file ran or the device behaves unusually.
Where do I report a fake IRS message?
Email phishing@irs.gov. For email, include the message or headers when possible; for texts, include the sender number, full content, recipient number, and receipt date and time, and forward the text to 7726. For social media, report the account to the platform and send its full URL to phishing@irs.gov.
What is an IRS Identity Protection PIN?
An IP PIN is a six-digit number that helps prevent another person from filing a federal tax return using your identity information. Request one after reporting exposed SSN or ITIN information.
How can I check whether the refund offer was real?
Do not use the message’s link or phone number. Type IRS.gov yourself, sign in to your IRS online account, or find an official IRS contact number independently. The IRS says an agency letter or notice is its first contact, not an unsolicited email or social-media message.
The Bottom Line
A click alone is not proof of identity theft. Close the page, stop communicating, determine exactly what you entered or downloaded, secure the affected account or financial institution, report the message through the correct IRS route, and verify any refund only through IRS.gov or your IRS account. Stay alert for follow-up recovery scams.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
