IRS scam letters in 2026: How to spot fake IRS notices

An urgent IRS-looking email, letter, text, or call is not automatically real just because it uses the IRS logo, a payment deadline, or a tax year such as 2025. In 2026, the IRS says its first contact is usually by mail, while unexpected emails, texts, social media messages, threats, and links are major red flags.

Scammers know the 2026 filing season creates pressure. They copy real IRS language, mention balances, refunds, audits, or “secure portals,” and push taxpayers to act before checking the notice.

For US expats, the risk is higher because mail can arrive late, foreign phone numbers may not look familiar, and tax deadlines can overlap. The 2025 return deadline for most taxpayers was April 15, 2026, while many taxpayers abroad had until June 15, 2026, to file.

Taxes for Expats helps Americans abroad sort real tax filing obligations from noise. If an IRS-looking notice relates to your 2025 return, foreign income, FBAR, or prior-year filings, you can review our US expat tax filing guide for 2026 for deadline context before responding.

How urgent IRS notifications turn into an IRS scam in 2026

An IRS scam often begins with a deadline shorter than 24 or 48 hours, a link to “download” a statement, or a demand to confirm personal data before a refund or account is released. The IRS specifically warns taxpayers not to click unexpected links or open unexpected attachments.

The suspicious email you received matches a common pattern: it mimics an official notice, says there is an outstanding tax balance, and asks the taxpayer to download a “tax statement.” Even if the visible text says IRS.gov, the hidden link can send the reader to a harmful website.

Based on our client scenario at TFX: a US citizen in Europe received a May 2026 email with an IRS-style banner, a “Download Your Tax Statement” link, and urgent balance language. The safe move was not to click – the taxpayer checked their IRS Online Account, reviewed whether any CP or LTR notice existed, and reported the email.

The following 5 red flags commonly appear in urgent IRS scams:

• A link or attachment appears before any verified IRS notice number.
• The sender address is not from a legitimate government system.
• The message demands payment through a specific method.
• The notice threatens arrest, deportation, or immediate collection.
• The message asks for an SSN, ITIN, bank account, IP PIN, or login code.

 

How the IRS really contacts taxpayers in 2026

The IRS usually contacts taxpayers first by mail through the US Postal Service, not by an unexpected email, text, or social media message. The IRS may email only with taxpayer permission, with a few exceptions, such as criminal investigations, and it texts only with taxpayer permission. It does not demand immediate payment by gift card or prepaid debit card.

The IRS may send notices about a balance due, a refund change, identity verification, return correction, processing delay, or a question about a return. A real IRS letter generally has a CP or LTR number on the right corner, and the IRS says taxpayers can search that number or call 800-829-1040 if the letter looks suspicious.

Use our guide on what US expats should do after getting a letter from the IRS if the notice has a response deadline, tax year, or foreign address issue. International delivery delays do not make a fake notice real, but they can make real response deadlines harder to manage.

Does the IRS send you emails? The IRS can send certain email notifications only after you opt in, but it does not make initial contact by email to demand payment or personal information. A fake IRS email often asks you to click, verify, download, or “unlock” an account before you have checked IRS.gov directly.

IRS.gov email scams often rely on a convincing display name while hiding a non-government sender address. IRS gov email scams without the dot in “IRS.gov” can also appear in subject lines, search ads, or fake help pages designed to capture taxpayer data.

A scam IRS email may copy real IRS colors, include a fake payment link, or use a real-looking IRS phone number next to a harmful button. The safer approach is to type IRS.gov into your browser yourself; never use the link inside an unexpected message.

What a real IRS letter looks like – and what an envelope cannot prove

A real IRS letter usually identifies a specific tax year, notice issue, and CP or LTR number, while a fake IRS letter often relies on urgency instead of verifiable details. The IRS says taxpayers can search IRS notices and letters by number or topic and should call 800-829-1040 if a suspicious letter does not appear.

A real IRS letter is verified by its notice details and IRS.gov confirmation, not by the envelope alone.

 

An official IRS letter envelope may look plain, use government-style formatting, or include a return address, but an envelope is only one clue. A real IRS letter envelope can be copied, so the safer test is whether the notice number, tax year, and account details match your IRS Online Account or the official IRS notice database.

What does a real IRS letter look like? It normally points to 1 specific issue, such as a balance due, refund change, identity verification request, or correction to a return. It should include instructions, a deadline if action is needed, and a CP or LTR number that can be checked through IRS.gov.

How to tell if an IRS letter is real? Verify the CP or LTR number, compare the tax year to your filed return, and contact the IRS through a known IRS.gov number. Do not use a phone number, QR code, or link printed in a suspicious letter until you have independently checked it.

How to spot a fake IRS letter? Look for impossible deadlines, threats of arrest, unusual payment instructions, missing appeal rights, and requests for full SSNs, bank logins, or IP PINs. A fake letter from IRS impostors often asks you to call a private “settlement” number instead of using IRS.gov.

Current IRS scams that mimic time-sensitive notices

Current IRS scams in 2026 include email and text impersonation, AI-enabled phone impersonation, fake direct-deposit update notices, social media refund claims, OBBB-related refund promises, and unclaimed-refund mail. The IRS 2026 Dirty Dozen list specifically includes IRS impersonation by email and text, AI-enabled phone scams, and misleading social media tax advice.

Is there an IRS scam going around? Yes. The IRS warns that scammers send alarming emails, texts, and direct messages that appear to come from the IRS and send taxpayers to fake websites to verify accounts, enter personal information, or claim refunds.

The following 6 scam examples are especially relevant for taxpayers filing 2025 returns in 2026:

• Fake “latest tax summary” email: This message says a tax balance is ready for download and includes a harmful link.
• IRS tax refund email scam: This message says your refund is blocked, waiting, or “unclaimed” unless you verify bank details.
• Fake IRS audit letter: This letter says you are under audit and must call a private number immediately.
• CP53E direct-deposit copycat: This scam copies confusion around refund bank updates and asks for banking data by phone, email, or text.
• OBBB refund or credit pitch: This scam claims you are pre-approved for a new credit, deduction, or “fast payout.”
• AI phone call or voicemail: This call uses a spoofed caller ID, a synthetic voice, or a prerecorded threat.

The CP53E issue deserves special caution in 2026. TAS (Taxpayer Advocate Services) explains that a real CP53E notice may ask certain taxpayers to update direct deposit details through their IRS Online Account within 30 days, but the IRS will not ask for bank information by email, text, or phone.

OBBB-related scams also appeared in the 2026 IRS warnings. The IRS says scammers may claim taxpayers are pre-approved for new OBBB credits or deductions, request SSNs or bank details, charge “release” fees, or claim they can speed up normal IRS refund timelines.

Tax scams by mail: letters, fake refunds, and audit threats

Tax scams by mail are dangerous because paper feels official, especially when the letter references the IRS, Treasury, a lien, a refund, or a tax debt. The IRS says fake IRS mail may claim an unclaimed refund or tax issue to pressure taxpayers into sharing personal and financial information.

Are there IRS scams by mail?

Yes. IRS scams by mail can include fake refund letters, fake tax debt letters, fake lien notices, and copycat private collection notices. For the 2025 tax year filed in 2026, verify any suspicious paper notice through IRS.gov, your IRS Online Account, or an official IRS phone number before calling, paying, scanning a QR code, or sending personal documents.

The following 6 warning signs can help you separate real IRS correspondence from scam IRS letters:

• The letter creates pressure instead of giving a process.
  IRS scam letters often use phrases such as “final notice,” “immediate levy,” “audit enforcement,” or “pay within 24 hours.” A real IRS notice usually identifies the tax year, explains the issue, and gives response or appeal instructions.
• The notice includes a fake case number but no verifiable CP or LTR number.
  IRS scams via mail often use official-looking numbers that cannot be checked through IRS.gov. For IRS mail scams, the safest first step is to search the CP or LTR number at IRS.gov or check your IRS Online Account.
• The payment instructions do not match IRS rules.
  IRS letter scams may ask for gift cards, crypto, wire transfers, payment apps, or a check made out to someone other than the US Treasury. An IRS fake letter may even use a real IRS address while adding a fake payment link, QR code, or phone number.
• The letter asks for sensitive identity documents too soon.
  IRS scam mail may claim a refund is waiting and ask for a driver’s license, passport copy, bank account number, full SSN, or other documents before you verify the notice. Fake IRS mail often uses refund language because taxpayers are more likely to respond quickly.
• The message targets expat concerns.
  IRS scams in the mail can pressure US expats by claiming that foreign bank accounts, FBAR filing, passport renewal, or overseas refunds will be blocked unless payment is made immediately. A real IRS notice should still identify 1 tax year, 1 issue, and a verifiable IRS notice number.
• The letter looks official, but sends you away from IRS.gov.
  A fake IRS letter in the mail may copy IRS language, include a “Department of the Treasury” signature block, or look like a federal tax authority's letter. If an IRS letter, real or fake, raises a question after your first review, call the IRS using a number found directly on IRS.gov – not the number printed on the suspicious letter.

NOTE! If you receive an IRS scam letter in mail, do not throw it away immediately. Keep the envelope, scan the pages, avoid calling the printed number, and compare the notice details with IRS.gov before sending personal information or making a payment.

 

How to verify a real IRS letter vs fake before paying

A real IRS letter vs. a fake check should take at least 3 steps: verify the notice number, verify your account independently, and verify payment instructions. The IRS accepts payments through IRS.gov/payments and never asks for gift cards or prepaid debit cards.

Real IRS letter vs fake: a real notice gives you a process; a fake notice tries to remove your time to think. Real notices often give response rights, payment options, or dispute instructions, while fake notices threaten arrest or demand a specific payment channel.

The following 7 checks help decide whether a letter, email, or call is real before you pay:

• Check whether the notice has a CP or LTR number.
• Check whether the tax year matches your records.
• Check whether the amount due appears in your IRS Online Account.
• Check whether the payment instructions go to IRS.gov/payments or US Treasury.
• Check whether the notice gives appeal or dispute rights.
• Check whether the sender asks for an IP PIN, full SSN, or bank login.
• Check whether the deadline is realistic and tied to the notice date.

For eligible taxpayers abroad, cross-checking deadlines matters because the automatic two-month extension can extend the time to file and pay until June 15, 2026, but interest applies to the 2025 tax not paid by April 15, 2026. A later extension gives more time to file, not more time to avoid interest. See our 2026 US tax deadlines guide for expats for filing and payment timing before assuming a notice is fake or real.

Private debt collection notices can be real, but they have extra verification rules

A private collection agency contact can be real, but the IRS must first send Notice CP40 before the agency sends its own letter. Both letters contain a taxpayer authentication number, and only 3 private agencies are listed by the IRS for certain inactive tax debts.

The IRS says the current private collection agencies are CBE Group Inc., Coast Professional, Inc., and ConServe. A private collector should not threaten you, and the taxpayer authentication number helps both sides confirm identity.

A fake private collection letter may skip CP40, omit the taxpayer authentication number, or ask you to pay the collector directly through unusual methods. When in doubt, verify the assignment through your IRS transcript or IRS Online Account before speaking with the agency.

What to do if you get a suspicious IRS notice or message

If an IRS-looking email, text, call, or letter feels urgent, treat the next 24 hours as a containment window. The goal is to preserve evidence, avoid new exposure, and verify the issue through IRS.gov, your IRS Online Account, or an official IRS phone number – not through the link, QR code, or phone number in the suspicious message. The IRS tells taxpayers not to click unexpected links or open unexpected attachments and to report suspected IRS-related phishing to phishing@irs.gov.

Based on our client scenario at TFX: a taxpayer abroad received a “latest tax summary” email while preparing a 2025 return in 2026. Because the taxpayer had not clicked the link, the safest response was simple: save the message, check IRS Online Account for any balance or notice, and report the phishing email before deleting it.

The following 4 response paths depend on what already happened:

• If you only received the message: do not reply, click, download, scan a QR code, or call the number in the notice. Save a screenshot or copy first, because the sender address, subject line, date, and visible link text can help with reporting.
• If you clicked a link but entered nothing: close the page, clear the browser session, run a security scan if needed, and change the password for any tax, email, or financial account that was open on the same device.
• If you entered personal or tax information: change affected passwords from a clean device, enable multi-factor authentication, check your IRS Online Account, and consider requesting an IP PIN. An IP PIN is a 6-digit IRS number that helps stop someone else from filing a federal return using your SSN or ITIN.
• If you sent money or bank details: contact your bank or card issuer immediately, report the incident, and monitor account activity. If the scam involved cybercrime, the FBI’s Internet Crime Complaint Center accepts reports from victims, including people outside the US.

 

How to report an IRS scam without making the problem worse

Report the scam through the correct channel before deleting the message, because emails, texts, call details, and envelopes may contain evidence.

Use the reporting channel that matches what you received, because a mailed fake notice and a phishing email do not leave the same evidence trail.

 

If the scam came by email, forwarding it as an attachment is better than copying the message into a new email when your email provider allows it. The IRS also provides instructions for forwarding full email headers, which can help preserve technical details that normal forwarding may remove.

If the issue involves identity theft, the FTC’s IdentityTheft.gov provides a recovery plan, and IRS Form 14039 is used for victims of tax-related identity theft. The February 2026 version of Form 14039 says victims should not submit duplicate affidavits for the same incident, because duplicate filings can delay processing.

Use the IRS Online Account before you trust an urgent notice

IRS Online Account is one of the safest ways to check whether a 2025 balance, payment, refund issue, or notice exists before responding to an urgent message in 2026. The IRS says individual online accounts can show balances, payment history, tax records, payment plans, refund status, amended return status, account transcripts, and more than 200 digital notices.

Use this account as a verification tool, not as a link you reach through an email. Type IRS.gov directly into your browser, sign in from there, and compare the account details with the notice.

The following 5 items are worth checking before you call, pay, or send documents:

• Balance due by tax year, especially 2025 and any prior year named in the notice.
• Payment history and pending payments.
• Digital notices available in your account.
• Refund status or amended return status.
• Authorized tax professional access requests.

For US expats, IRS Online Account can also help separate a real tax issue from a delivery problem. A mailed notice may arrive overseas weeks after the notice date, so checking the account can reduce the risk of missing a real deadline while still avoiding scam links.

Add an IP PIN if personal data may be exposed

An IP PIN is a 6-digit IRS number that helps prevent someone else from filing a federal tax return using your SSN or ITIN. The IRS says anyone with an SSN or ITIN, including taxpayers living abroad, can get an IP PIN if they can verify their identity.

The IP PIN is not a password and should not be shared by email, text, phone, or chat. The IRS says the number is known only to the taxpayer and the IRS, and tax professionals cannot get one on behalf of a client.

The following 4 situations make an IP PIN especially useful:

• You entered your SSN, ITIN, date of birth, or filing status into a suspicious IRS-looking page.
• Your email account was compromised during tax season.
• Someone attempted to file a return using your information.
• You live abroad and rely on digital communication for most tax records.

A new IP PIN is issued each calendar year, so a 2026 IP PIN is not reused for a future filing year. Keep it with your tax records and share it only with the tax professional preparing your return when the return is ready to be filed.

Special protection steps for US expats

US expats should check suspicious IRS notices against 3 dates for the 2025 tax year: April 15, 2026, June 15, 2026, and October 15, 2026. The IRS gives eligible taxpayers abroad an automatic 2-month extension, but interest can still apply to tax not paid by the regular due date.

Scammers often use deadline confusion against Americans abroad. A fake notice may claim that a refund, passport, foreign account, or FBAR filing is at risk unless the taxpayer pays immediately.

The following 6 expat-specific safeguards reduce the chance of a rushed mistake:

• Keep your IRS mailing address current when you move countries.
• Save envelopes, because the postmark can matter if a notice arrives late.
• Compare the notice to your filed Form 1040, Form 2555, Form 1116, Form 8938, and FBAR records, if applicable.
• Use secure upload portals for tax documents instead of email attachments.
• Do not share your IP PIN, SSN, ITIN, or bank details through email or text.
• Ask your tax professional to review any notice involving foreign income, foreign accounts, or prior-year filings before you respond.

When to get professional help

Get help before responding if a notice mentions a 2025 balance, an audit, identity verification, foreign income, FBAR, Form 8938, or prior-year nonfiling. One wrong reply can expose personal data or create a tax record problem that takes months to unwind.

A professional review is especially useful if the notice references a foreign address, foreign employer, foreign bank account, treaty position, or missing Form 1040 filing. Use our US expat tax return preparation service if you are a taxpayer with cross-border filings.

FREE

Got an urgent IRS-looking email, letter, or call? Don’t click any link or respond immediately

Book a free call today & let us help you avoid the fake scams

Schedule my free call