When the message says IRS

Current IRS warning

The 2026 Dirty Dozen

In its annual 2026 list, published as IR-2026-30 on March 5, 2026, the IRS highlighted IRS impersonation by email and text, AI-enabled phone impersonation, misleading tax advice on social media, and identity theft involving access to IRS Online Accounts. Those are specific items on the IRS’s 2026 list, not a prediction about any one message you receive. Read the dated 2026 IRS warning.

The IRS says viral “tax hacks” may encourage false information on a return or claims for credits a person doesn’t qualify for. If a post promises a hidden credit or a guaranteed large refund, check the claim against official guidance before acting. The IRS’s tax scam guidance describes social media misinformation and examples of schemes.

Slow the contact down

Check the channel, not the pressure

An unexpected contact that rushes you, threatens you, asks for personal or financial information, or demands payment now is a warning sign. Caller ID can be spoofed. The IRS generally contacts taxpayers by mail first; it says it won’t call to demand immediate payment or threaten arrest. See the IRS’s March 2026 warning and how to know it’s the IRS for more contact guidance.

1. 01

   Email, text or social message

   Don’t reply, click links or open attachments in an unexpected message. The IRS says it doesn’t send social media direct messages, and sends text messages only when you opt in. Navigate to IRS.gov yourself if you need to check your account or a notice. The IRS explains how it contacts people.

2. 02

   Suspicious call

   Don’t share information or pay because a caller insists. Record the number and hang up. The IRS notes that it may call about account matters, so use its official guidance to check the contact rather than treating every call as fake. Its call-reporting instructions include the TIGTA hotline.

3. 03

   Online Account setup

   Create or access an account from the official IRS Your Account page rather than through an unsolicited helper or link in a message. The IRS’s 2026 list specifically warns about identity theft involving Online Account access.

Official reporting

Report the contact safely

Use the IRS’s reporting instructions for fake messages and calls for details, including how to preserve and send a suspicious email. The IRS gives different steps for each channel:

• For a fake IRS email, don’t reply or open its links or files; send it to phishing@irs.gov with “IRS” in the subject line.
• For a suspicious text, don’t reply or click. The IRS says to email the sender’s number, message contents, your number, and when you received it to phishing@irs.gov with “Text” as the subject. Its instructions also explain how to forward spam texts to 7726.
• For an IRS social media impersonator, report the account to the platform and send its full URL to phishing@irs.gov with “Social media” as the subject. For a suspicious call, record the number, hang up and report it to TIGTA at 800-366-4484.

To report suspected tax fraud or a scam through the IRS’s central reporting page, use Submit a tip to the IRS. If money or identity information was stolen, read the IRS’s steps for people who were scammed.

Tax identity protection

Keep an IP PIN private

An IRS Identity Protection PIN is a six-digit number that helps prevent someone else from filing a federal tax return using your SSN or ITIN. The IP PIN is for tax return filing, not for signing in to an IRS Online Account. The IRS says you can request one proactively through your own account; a new PIN is generated each year. Start from the official IRS account page and read the IRS’s IP PIN instructions.

Keep the PIN private. The IRS says it will never ask for your IP PIN in a phone call, email or text. If someone does, treat it as suspicious and use the reporting instructions above.

If identity theft is suspected

Follow the IRS identity guide

If you think someone used your tax identity or gained access to your account, go to the IRS identity theft guide for individuals and follow the steps that match your situation. It links to IRS reporting and recovery resources. Keep copies of IRS letters and use contact details on IRS.gov or an IRS notice. Don’t send sensitive details in response to an unsolicited message.