If you filed your ITR this year and got an SMS saying your income tax refund is ready to be credited, stop. Don't click anything. That message could be the start of a scam that's already cost some Indian taxpayers over Rs 1.5 lakh in a single incident, according to reporting by Business Today and India Today.
Fake income tax refund SMS scams are surging in 2026. The Income Tax Department has issued multiple public warnings about fraudulent messages and emails pretending to be from the IT department. This isn't a hypothetical threat. People are losing real money right now.
What this scam actually is
You get an SMS or email that looks official. It says your ITR refund of some specific amount is ready. Rs 3,200. Rs 7,850. Rs 12,000. Whatever number sounds plausible for your income bracket. Click this link to update your bank details. Or verify your PAN. Or confirm your Aadhaar-linked account.
The link takes you to a fake website that mirrors the Income Tax e-filing portal (incometax.gov.in). You enter your details. And that's it. Your bank account information, UPI PIN, or net banking credentials are now with fraudsters.
It works because of timing. ITR refunds are a real thing that happens between July and October every year, sometimes later. When a message arrives around that period saying your refund is pending, your guard is down. You're expecting it. So the scam doesn't feel like a scam, it feels like a reminder.
How the income tax refund scam works, step by step
- You receive an SMS from what looks like "ITDEPT", "INCOMETAX", or "CBDT". Fraudsters can spoof sender IDs to make messages appear official on your phone.
- The message says something like: "Your income tax refund of Rs 8,420 is pending. Click here to update your bank account: [short URL]"
- The link opens a fake website that mirrors the IT department's login page. Some even have an HTTPS padlock, which people wrongly assume means the site is safe.
- You're asked to enter your PAN, date of birth, and then bank account details for refund credit: account number, IFSC code, and sometimes your UPI ID or net banking credentials.
- On some fake sites, you're asked to enter an OTP that the fraudsters simultaneously trigger on your actual bank account, completing a fraudulent transaction in real time.
- Money leaves your account. The fake site shows a success message. You may not notice until you check your bank statement hours later.
The Rs 1.5 lakh case reported by Business Today involved exactly this sequence. The victim got a message about a refund delay, clicked a link, entered banking details, and then entered an OTP thinking it was part of the refund process. It was actually authorizing a debit from their account.
Warning signs you need to recognize
None of these red flags are subtle once you know what to look for. The problem is most people aren't looking.
- Any SMS or email asking you to "update bank details" for a refund. The IT department already has your bank account from your ITR filing. They don't need it again.
- Links that go anywhere other than incometax.gov.in or efiling.incometax.gov.in
- URLs with slight misspellings: incometax-india.com, incometaxgov.in.refund-portal.xyz, and similar tricks
- Messages creating false urgency: "Refund will expire in 24 hours" or "Update within 48 hours or forfeit refund"
- Requests for your UPI PIN, net banking password, CVV, or full debit card number. No government department ever asks for these.
- WhatsApp messages claiming to be from the Income Tax Department. They don't use WhatsApp for official communication.
- Emails from Gmail, Yahoo, or Outlook addresses claiming to be the IT department
One thing that trips people up: the message may correctly mention your name, or even an approximate refund amount close to what you're expecting. Fraudsters buy or scrape data from various sources, including past data leaks linked to PAN and Aadhaar records. Your name appearing in a message doesn't make it legitimate. Honestly, that's the part that fools the most people.
Moneycontrol reported in 2026 that fraudsters are running parallel SMS campaigns exploiting multiple government processes at the same time, including ITR refunds, 8th Pay Commission updates, and FASTag alerts. They rotate topics to match the news cycle and whatever government process people are currently anxious about. Tax season is their favourite window. The numbers here are a bit fuzzy, but the pattern is consistent.
How to check your actual refund status safely
This is worth bookmarking right now.
The only official way to check your refund status is directly at incometax.gov.in or through the NSDL portal at tin.tin.nsdl.com. Log in with your PAN and password. No SMS link. No forwarded WhatsApp message. Type the URL yourself in the browser every single time. I know it feels unnecessary, but that habit is what keeps your money safe.
You can also check via the AIS (Annual Information Statement) on the same portal, or call the IT department's helpline at 1800-103-0025 (toll-free). If your refund is genuinely stuck or delayed, those are the only right channels.
If you use the income tax app on your phone, only download it from the official Google Play Store or Apple App Store. Search for "Income Tax India" and verify the developer is listed as "Income Tax Department, Government of India."
What to do right now to protect yourself
Honestly, the single most powerful habit you can build: never click any link in any SMS or email related to banking or taxes. Just never. Go to the website directly. It takes ten extra seconds and it protects you from this entire category of scam.
Beyond that, here are the things actually worth doing:
- Enable transaction alerts on all your bank accounts so you know immediately if anything moves
- Set a UPI transaction limit on apps like PhonePe, Google Pay, and Paytm. Most apps let you cap daily limits under settings.
- Activate two-factor authentication on your income tax e-filing account at incometax.gov.in
- Never share OTPs with anyone, even someone claiming to be from the bank or the IT department
- Report suspicious sender IDs via the Sanchar Saathi portal at sancharsaathi.gov.in or through the TRAI DND app
- Check your Form 26AS annually on the IT portal. It shows TDS deducted and refund status officially, no third-party link required.
The government has officially clarified that the Income Tax Department sends refund communications only through registered emails from the domain @incometaxindia.gov.in. Any other domain is fake. (I'm not 100% sure this applies in every edge case, but that's the stated official position as of 2026.)
CERT-In, India's national cybersecurity agency, actively publishes advisories about phishing campaigns including tax-related scams at cert-in.org.in. Worth checking if you want to track active threats. We also maintain a running list of active scam alerts in India if you'd rather have one place to check regularly.
If you've already been scammed: act fast
Don't panic. But act immediately.
First, call your bank on their 24/7 helpline and ask them to freeze the account or reverse the transaction. Banks in India have a chargeback window, and acting within the first few hours gives you a real chance of getting your money back. The longer you wait, the harder it gets.
Second, file a complaint on cybercrime.gov.in, India's national cybercrime reporting portal. Or call the cybercrime helpline at 1930. It's available 24 hours and is free to call. Do this the same day, not tomorrow.
Third, file a police complaint at your nearest station and specifically ask for it to be logged as cybercrime under the IT Act. Get a copy of the FIR. Your bank will need it during dispute resolution.
Change your passwords immediately after: your income tax e-filing account, net banking, and any account that shared the same password or email. See our explainer on what to do after a cyber fraud for the full step-by-step checklist.
Official position from the Income Tax Department: "The department does not ask taxpayers to share bank account details, passwords, OTPs, or card information through SMS or email. Any such request is a fraud. Do not respond to such messages."
Why this scam keeps finding new victims in 2026
Around 7 to 8 crore ITRs are filed in India every year. A large percentage of those filers are first-timers or people who file once a year and aren't totally clear on what the official process looks like. They're exactly the audience that doesn't know the IT department would never ask for bank details over SMS. And the scammers know this too.
The scams are also getting technically more capable. Sender ID spoofing has improved a lot. Fake websites are harder to spot. Some fraudulent sites now have real-time OTP capture pages that use your OTP the moment you enter it, to authorize a transaction on your behalf before you even realize what happened. CERT-In has flagged this as an emerging attack vector in India's digital payments space.
There's also a volume problem. Moneycontrol has noted that scammers are running these campaigns at industrial scale, rotating between income tax, FASTag, and pension-related lures depending on the season. The income tax refund lure peaks between August and November every year, right when people are checking their refund status most frequently. Tax season is, if you ask me, basically open season for these scams.
The best defense is simple awareness. You now know what this looks like. Share this with a parent, a sibling, anyone who filed taxes this year and might be expecting a refund. One conversation could save someone a significant sum. And if you ever get a suspicious link, our free URL checker tool can help you verify whether it's real before you click.
