Between January and April, your inbox gets crowded. W-2s and 1099s arrive, your accountant asks for receipts, a payroll notice reminds you to check your withholding. Criminals count on that noise. A fake refund notice blends in when you are already waiting on a real one, and an invoice for "tax preparation services" looks unremarkable sitting next to the three legitimate ones you received last week.

Most tax phishing does not depend on clever technology. It depends on timing, a familiar logo, and a request that feels just plausible enough to act on. What follows is how to tell the difference, and what to do when something slips through.

What makes tax season different

Tax season hands attackers three things at once: a deadline, a predictable calendar, and a lot of money moving in both directions.

Deadlines create pressure. A request that would normally get a second look gets handled at 11 p.m. on a Sunday, from a phone, between other tasks. People also expect unfamiliar messages this time of year — a new document portal, a new form, a new contact at a payroll provider. Novelty stops being a warning sign.

The data at stake is unusually concentrated, too. One email thread can hold a Social Security number, a bank account, a copy of a driver's license, and a signed authorization. That makes these messages valuable even when the scam fails. A reply alone confirms you are a real person with a real account.

Four tax-themed scams to expect

The refund that needs "verification"

Your refund is on hold, the message says, and you need to confirm your bank details. Sometimes the design copies a tax authority. Sometimes it copies tax software. The link usually opens a page that looks exactly like a login screen you have used before.

"Your refund is pending. Confirm your direct deposit information within 24 hours to avoid further delay."

Tax authorities generally do not open contact by email or text asking for bank details or a Social Security number. The IRS, for instance, says it initiates most contact by mail, and refund status is something you check yourself on the official site. Rules differ by country, so read your own tax authority's guidance — but the pattern holds: if the message asks you to confirm financial details through a link, treat it as hostile.

Invoices with new payment details

A PDF arrives from "your accountant" or a vendor: an outstanding balance, a filing deadline, updated wire instructions. The domain is close but not identical — smithcpa.com replaced by smith-cpa.com, or a free mail account using a display name you recognize.

This scam often follows a real compromise. When a vendor's mailbox is breached, the attacker reads genuine threads and replies inside them, which is why the context and tone match so well. Any change to banking details deserves a phone call to a number you already had, not one printed in the email.

Payroll and direct deposit changes

Two versions circulate. One targets HR: an email that appears to come from an employee asking to reroute their deposit before payday. The other targets you: a message claiming your direct deposit failed and you must re-enter your account number. Both work because payroll is routine and time-sensitive, and because the request looks like an ordinary administrative chore.

"Your documents are ready"

A link to a document portal, or an attachment you must open to see a 1099 or a W-2. HTML attachments, password-protected archives, and macro-enabled spreadsheets are common delivery vehicles. So are portals that ask you to sign in with your email password — credentials an attacker will test elsewhere within hours.

How to inspect a message in two minutes

• Display name versus address. "Payroll Department" is free to type. The domain after the @ is what counts.
• Reply-to. If it points somewhere different from the sender, that is a decision, not an accident.
• Links. Hover first, then read the domain immediately before the first single slash. Lookalikes swap letters, add hyphens, or hide behind subdomains.
• Attachments. .html, .htm, .zip, .iso, and macro-enabled Office files rarely belong in a payroll or tax email.
• Tone. Generic greeting, urgency, penalty threats, and a request to keep things confidential.
• Timing. A "final notice" on a Sunday night, or a refund alert in a month when you have not filed.

Verification steps that actually work

1. Do not use the contact details in the message. Open a new tab and type the official domain yourself.
2. Call a number you already had — from a contract, an old statement, or a company site you navigated to directly.
3. Match the request to a record you can see. Log in through your own bookmark and check the real refund status, invoice, or payroll entry.
4. Require a second channel for money movement. A simple rule that banking changes are confirmed by voice to a known number stops most of these attempts before they cost anything.
5. Ask out of band. Your accountant or IT team can review the raw headers and confirm whether the message is genuine.

If you already clicked, replied, or paid

Speed matters more than embarrassment.

• Credentials entered: change the password, turn on multifactor authentication, and check your mailbox for forwarding rules or delegated access. Attackers create those to keep a way in after you lock the front door.
• Money sent: call your bank right away and ask for the fraud team. A wire recall is sometimes possible within hours and rarely after a day or two. Then report the incident to the relevant authority in your country.
• Personal data shared: consider a credit freeze or fraud alert with the major credit bureaus, and tell your tax preparer before you file. If someone files a return in your name, you will need to work through your tax authority's identity theft process.

Tax and financial decisions carry real consequences, so confirm your specific steps with a qualified tax professional or your tax authority's fraud unit rather than relying on general advice.

A five-minute rule worth keeping

Pick one habit and keep it past April: never act on a refund, invoice, or payroll change from inside the message that announced it. Close the email. Open your browser. Type the address yourself. Or pick up the phone and dial a number you already trusted. Five minutes, once, costs far less than a fraudulent return filed in your name or a payment that lands in someone else's account.

Then tell the people around you. The colleague who nearly rerouted a paycheck, the parent who forwards refund notices — a two-sentence warning from someone they know does more than any security banner.