The tax refund text scam is a smishing and phishing fraud in which criminals send fake text messages or emails impersonating tax authorities — the Internal Revenue Service in the United States, HMRC in the United Kingdom, the ATO in Australia, or other national tax agencies — claiming that the recipient has a tax refund available to claim. In every version of the tax refund text scam, the message contains a link to a fraudulent website designed to harvest the victim’s personal information, financial details, or login credentials, which are then used for identity theft, financial fraud, or further targeted phishing.

Tax impersonation is not new, but the tax refund text scam in its current form is. What changed in 2026 is the scale, sophistication, and year-round nature of the fraud. Modern tax refund text scam operations use professional-grade phishing infrastructure, AI-generated personalised messages, sender ID spoofing that makes messages appear to come from official tax agency shortcodes, and highly convincing fake websites that are visually identical to genuine tax portal pages.

The tax refund text scam causes harm in two distinct ways. The first is the direct financial harm of card details entered on fraudulent sites being used for unauthorised purchases. The second — and often more serious — is the identity theft enabled by the personal information collected during the fake refund claim process, including Social Security or National Insurance numbers, date of birth, address, and banking details that enable much broader financial fraud beyond the immediate transaction. This is the same identity-theft mechanism behind the unemployment identity theft scam.

Every tax refund text scam follows the same six-stage pattern, from the first message to the eventual financial damage.

Step 1: The Fake Tax Refund Message Arrives

The tax refund text scam begins with an unsolicited text message or email appearing to come from a tax authority. It states that you are entitled to a refund of a specific amount — often a realistic figure such as $312, $847, or £294 — and that the refund is available to claim immediately through a provided link. The message creates urgency by stating the refund will expire if not claimed within a short window, typically 24 to 72 hours. It may include your name, sourced from data breaches, to feel personalised, and the sender ID may be spoofed to show “IRS” or “HMRC”.

Step 2: The Urgency and Expiry Warning

You are told your refund will be cancelled, returned to the treasury, or forfeited unless claimed within the stated window. For someone who has been waiting for a legitimate refund, the threat of losing money they are owed is particularly motivating. This urgency is deliberately calibrated to prevent you from pausing to verify the message independently — the same pressure tactic used in the traffic violation text scam.

Step 3: The Fake Tax Portal

Clicking the link in a tax refund text scam message leads to a website that closely mimics the genuine tax authority’s online portal — official logo, colour scheme, and layout. The URL is designed to look plausible, combining the agency’s name with words like “refund”, “claim”, or “portal” in a non-.gov domain. On mobile devices, where the full URL is not visible and the screen is smaller, the fake site is particularly hard to distinguish from the real one.

Step 4: Harvesting Personal and Financial Information

The fake portal presents a multi-step refund claim form that asks for progressively more sensitive information — starting with name and address, then Social Security or National Insurance number, date of birth, and employment details, before requesting bank account or payment card information to “process the refund deposit”. Each piece of information is captured immediately by the criminals running the tax refund text scam.

Step 5: The Confirmation and False Reassurance

After submitting their information, the victim receives a professional-looking confirmation page stating the refund application has been received and will be processed within three to five business days. This reduces immediate suspicion — the victim expects to wait, and will not become alarmed until a week or more has passed.

Step 6: The Consequences Emerge

The impact of the tax refund text scam typically becomes apparent through unauthorised card charges, fraudulent accounts opened in the victim’s name, a genuine communication from the actual tax authority showing no such refund exists, or a credit monitoring alert. By this point the harvested information has been in criminal hands for days or weeks.

The tax refund text scam is not a single fraud but a family of closely related variants. These are the six most common.

The Accountant Who Fell for the HMRC Text

A forty-six-year-old accountant — someone with professional knowledge of tax systems — received a text in early February claiming to be from HMRC and stating she was owed an £847.50 self-assessment refund. The amount closely matched a refund she was genuinely expecting from a return she had submitted the previous month. The coincidence of amount and timing made the tax refund text scam feel entirely legitimate. She clicked the link, completed the claim form, and entered her National Insurance number, date of birth, and bank details. Three days later a genuine HMRC letter about her actual refund arrived — the scam had harvested her details in the interval. A £340 fraudulent direct debit had been set up on her account; her bank reversed it, but she had to close and replace the account.

The Student and the IRS Refund Email

A twenty-three-year-old university student received an email claiming to be from the IRS stating that a $612 refund was available. As a first-time filer unsure of what to expect, he completed the form on the fake site, providing his Social Security number, date of birth, and a prepaid debit card number. No refund arrived. Two months later he discovered his Social Security number had been used to file a fraudulent tax return in another state — a tax identity theft situation, triggered by a single tax refund text scam email, that took over eight months to fully resolve.

The Retiree and the COVID Relief Text

A sixty-five-year-old retiree received a text claiming unclaimed COVID-19 tax relief was being distributed and that she was eligible for a $1,400 payment expiring within 48 hours. Having received a genuine stimulus payment in a previous year, the context felt familiar. She completed the claim form with her Social Security number, date of birth, address, and bank details. When she mentioned it to her daughter two days later, her daughter immediately recognised the tax refund text scam. A fraudulent $890 direct debit attempt had already been blocked by her bank — but her Social Security number was compromised, requiring fraud alerts, a credit freeze, and ongoing monitoring.

Tax authorities in every major jurisdiction have published specific and repeated warnings about the tax refund text scam, all delivering the same message: genuine tax agencies do not initiate contact by text message or email about refunds.

The Internal Revenue Service has been explicit for years that it does not send unsolicited texts or emails about refunds — all refund-related contact is initiated by post. The IRS warns that any text or email claiming to be from the IRS about a refund is a phishing attempt and should be reported to phishing@irs.gov. Its guidance is at irs.gov/identity-theft-central.

The Federal Trade Commission addressed the tax refund text scam directly in a January 2026 consumer alert, advising people to go straight to irs.gov or their state tax agency’s website to check refund status rather than clicking any link. Report at reportfraud.ftc.gov.

HMRC in the UK confirms it never sends text messages with links to claim refunds and never asks for personal or financial information by text. Suspicious texts can be forwarded to 7726 and emails to phishing@hmrc.gov.uk. General fraud reports go to Action Fraud at actionfraud.police.uk.

Never Click Links in Tax Refund Texts or Emails

The single most effective protection against the tax refund text scam is never clicking a link in any message claiming to be from a tax authority about a refund. This rule defeats every variant completely. To check a genuine refund, type the official URL into your browser yourself — irs.gov in the US, gov.uk in the UK — and log in there.

Know How Tax Authorities Actually Communicate

Protecting yourself from the tax refund text scam is far easier once you know how genuine agencies operate. The IRS communicates primarily by post; HMRC communicates by post and through the Government Gateway online account. When you know the genuine agency’s standard practice, any channel that differs from it is immediately suspicious. The same principle applies across every impersonation fraud — see our guide to imposter scam warning signs.

Report Suspicious Messages Immediately

Forward suspicious messages to the relevant authority before deleting them. In the US, forward IRS phishing texts to 202-552-1226 and emails to phishing@irs.gov. In the UK, forward texts to 7726 and emails to phishing@hmrc.gov.uk.

Check Your Refund Status Through Official Channels Only

If you are genuinely expecting a refund, use the official tools — the IRS “Where’s My Refund?” tool at irs.gov, or your Government Gateway account at gov.uk. These give accurate status information with zero phishing exposure and put the tax refund text scam completely out of reach.

Place a Tax Identity Protection PIN With the IRS

US taxpayers can enrol in the IRS Identity Protection PIN programme — a six-digit number that must be on your tax return to verify your identity, making it much harder for criminals to file a fraudulent return in your name. Enrol at irs.gov/identity-theft-central.

If you have already responded to a tax refund text scam, act quickly — the steps below limit the damage.