The Income Tax Department has published a compilation of such fraudulent emails along with a guide on how to handle them. The advisory is straightforward:
The department never asks for PINs, passwords, bank details, or card information over email.
It also never redirects users to third-party websites for refunds or verification.
Taxpayers have been warned once again about phishing emails doing the rounds in the name of the Income Tax Department. Every year, many taxpayers end up with ‘phishing’ emails in their inboxes, which are an elaborate attempt at well-articulated financial fraud.
The latest scam involves messages asking recipients to download their e-PAN Card or claim a tax refund through links that appear legitimate but are designed to steal sensitive information.
The Income Tax Department has even published a compilation of such fraudulent emails along with a standard operating procedure (SOP) on how to handle them. One such sample email claims the recipient is eligible for a refund of a few hundred rupees and asks them to “click here” to access a refund form.
Another insists that a refund worth Rs 42,320 is ready but could not be processed due to “incorrect account information,” pushing the recipient to resubmit bank details through a fake portal.
These are scam messages/emails that are carefully, and particularly, designed to mimic official communication channels. They often come from generic addresses like Gmail or Yahoo.
At first glance, they may look convincing with the complete emblem of the tax department. They land in your email with phrases that authoritatively mention ‘tax refund department’, ‘Ministry of Finance’, ‘Government of India’, etc.
However, upon a closer look, you will find some key signs that prove they are a scam, such as:
Emails that have odd IDs such as ‘refund-tax@incometax.gov.in’
Grammatical errors in the text
Urgent calls to action
Clicking on the links in these emails typically leads to fake portals asking for PAN numbers, bank account credentials, or one-time passwords (OTPs). Some messages may even carry malicious attachments that can infect your device.
The first SOP is to never click on any links attached to a fishy email. However, if you happen to click on any suspicious link or share your details, the immediate step is to change passwords for your bank, tax portal, and email accounts.
If not done already, enable the two-factor authentication of your email id.
You should also alert your bank to freeze potential fraudulent transactions and issue fresh cards if required.
The Income Tax Department has asked people to forward such emails to webmanager@incometax.gov.in and also report them to incident@cert-in.org.in, which is the national cyber security body. The department says that the Internet header has additional information that helps them in locating the senders of phishing emails.
After reporting, the email should be deleted permanently from your inbox.
The department has further urged taxpayers to stay alert, avoid clicking on unsolicited links, and verify all communication only through official portals.
