crypto scams irs scam Jul 23, 2026

That Email Claiming to Be the IRS? It's a Scam.

By Clinton Donnelly, LLM, EA | CEO & Founder, CryptoTaxAudit

An email arrives. IRS letterhead. American flag. The eagle seal. It says you have an outstanding tax balance and need to download your tax statement immediately. There's a blue link. It looks real.

Example of a fake IRS email using official-looking branding to push a phishing link.

It isn't. The IRS does not initiate contact with taxpayers by email. Period. If you received a message like this, you are looking at a phishing attempt designed to steal your identity or install malware on your device.

This exact scam has been circulating since at least 2009. The IRS has issued repeated warnings about it. Scammers have gotten better at faking official branding, which is why knowing the rules matters more than trusting your eyes.

Key Takeaways:

The IRS never initiates contact by email. The IRS sends physical letters through the U.S. Mail. An unexpected email claiming to be from the IRS is a scam, every time.

Do not click any link or open any attachment. Links in phishing emails lead to fake websites built to capture your credentials. Attachments often contain malware.

Forward the email to phishing@irs.gov, then delete it. This is the official IRS reporting address. Include the full email headers if your mail client allows it.

If you already clicked a link, act immediately. Report to the FTC, file a complaint with the FBI's IC3, and place a fraud alert on your credit file.

Fake IRS emails follow predictable patterns. Urgency, threats, unexpected refunds, and sender addresses that are not exactly @irs.gov are the most common tells.

How the IRS Actually Contacts Taxpayers

The IRS sends physical mail through the United States Postal Service. That's the rule. When the IRS needs to reach a taxpayer about an outstanding balance, a missing return, or an audit, they send a letter to the address on file. The letter includes a notice number in the upper right corner and a toll-free phone number you can call to verify it.

The IRS does not initiate contact by email, text message, or social media to request personal or financial information. This is not a recent policy. It has been consistent IRS practice for decades. Any email claiming to be from the IRS and asking you to act, click, download, or pay is fraudulent by definition.

If you're unsure whether a letter you received is real, you can call the IRS directly at 1-800-829-1040. Do not call any number listed in a suspicious email. Look up the IRS number yourself at irs.gov.

Anatomy of a Fake IRS Email

The phishing email that prompted this post is a good example of how these scams work. It includes the IRS logo, the American flag, official-looking formatting, and a footer crediting the Internal Revenue Service and the Department of the Treasury. It names a real IRS phone number: 1-800-829-1040. It even links to the real irs.gov/payments page.

The dangerous element is the blue link labeled "Download Your Tax Statement." That link does not go to a real IRS document. It goes to a fake page designed to capture login credentials, payment information, or personal data. Or it downloads malware directly to your device.

The technical delivery shows "govdelivery.com" in the footer, which is a real email distribution platform used by some government agencies. Scammers spoof these identifiers to pass spam filters and look legitimate. The presence of a real platform name in an email footer does not make the email real.

Warning Signs Every Taxpayer Should Know

Phishing emails impersonating the IRS follow recognizable patterns. Knowing these patterns is your first line of defense.

False urgency. The email warns of "further accrual of interest and potential collection proceedings" and urges "prompt resolution." Scammers create pressure to make you act before you think. Real IRS notices do not demand immediate online action.

Unexpected contact. If you weren't expecting correspondence from the IRS and an email arrives, that's a red flag. The IRS sends letters before it escalates to enforcement, and the paper trail always comes first.

A link you're asked to click. The IRS does not send emails with clickable download buttons. If an email asks you to download a tax statement, open a secure portal, or log in anywhere, stop.

Sender address that isn't exactly @irs.gov. Scam emails often use addresses that look similar: irs-gov.com, irs.us.gov, internal-revenue-service.net. The only legitimate IRS domain is irs.gov. If the "from" address doesn't end in @irs.gov exactly, it's not from the IRS.

Unexpected refund offers. Some IRS phishing emails offer unclaimed refunds or tax credits to get your bank account details. The IRS deposits refunds to the account on your tax return. They don't email you to collect new banking information.

What to Do If You Receive a Suspicious Email

Three steps. In this order.

Do not interact with it. Don't click links. Don't open attachments. Don't reply. Even replying to confirm your email address is active gives scammers useful information.

Forward it to phishing@irs.gov. This is the official IRS reporting address for phishing emails. If your email client allows it, forward the message as an attachment so the full headers are included. The IRS uses these reports to track and shut down active scam operations.

Delete it. Once you've forwarded it, remove it from your inbox and your trash folder. There's no reason to keep it, and keeping it creates a risk that someone else using your device might click it.

If You Already Clicked a Link

If you clicked a link in a phishing email and entered any personal or financial information, you need to act quickly. The window for damage control is short.

Report to the FTC. File a report at reportfraud.ftc.gov. The FTC coordinates identity theft recovery and can help you build a recovery plan.

Visit the IRS Identity Protection page. Go to irs.gov and search "identity theft." The IRS has a dedicated process for taxpayers whose information has been compromised. You may need to file Form 14039, the Identity Theft Affidavit.

File a complaint with the FBI's IC3. The Internet Crime Complaint Center at ic3.gov handles cybercrime reports, including phishing. Your report helps law enforcement track patterns and identify active scam networks.

Monitor your accounts. Check your credit reports at annualcreditreport.com. Consider placing a fraud alert or credit freeze with the three major bureaus: Equifax, Experian, and TransUnion. Review your financial statements for any transactions you don't recognize.

If you entered your Social Security Number or tax account credentials, assume those are compromised. Contact the IRS Identity Protection Specialized Unit at 1-800-908-4490.

Why Crypto Taxpayers Are Prime Targets

Crypto investors are disproportionately targeted by IRS phishing scams for one reason: the IRS has made crypto enforcement a public priority. Scammers know that a crypto investor who receives an email about an "outstanding tax balance" is more likely to believe it's real and more likely to panic.

The IRS has received account data from major exchanges including Coinbase, Kraken, and others through John Doe summons and court orders. Exchanges are now required to issue Form 1099-DA starting with tax year 2025. The combination of subpoenas, exchange reporting, and blockchain analytics means many crypto investors have legitimate concerns about IRS contact.

Scammers exploit that legitimate concern. If you have unreported crypto transactions and receive an email claiming the IRS has identified an outstanding balance, you may be tempted to take it at face value. Don't. Real IRS enforcement starts with a paper letter, not an email with a download button.

If you have genuine concerns about your crypto tax compliance, address them directly. A tax professional who specializes in cryptocurrency can review your situation and help you get ahead of any real IRS contact before it happens.

Frequently Asked Questions About IRS Phishing Scams

Q: Does the IRS ever send emails to taxpayers?

A: No. The IRS does not initiate contact with taxpayers by email to request personal or financial information. All initial IRS contact comes by U.S. mail. If you receive an unsolicited email claiming to be from the IRS, it is a scam.

Q: I got an IRS email saying I owe money. How do I know if it's real?

A: It isn't. The IRS does not notify taxpayers of outstanding balances by email. If you believe you may have a real tax balance, go directly to irs.gov or call 1-800-829-1040 to check your account. Do not use any link or phone number from the email.

Q: What is phishing@irs.gov?

A: It's the official IRS email address for reporting phishing attempts. If you receive a suspicious email claiming to be from the IRS, forward it to phishing@irs.gov before deleting it. Include the full email with headers if your email client allows it.

Q: The email had the real IRS logo and a real IRS phone number. Doesn't that mean it's legitimate?

A: No. Scammers can copy logos, replicate formatting, and include real phone numbers to appear credible. The presence of accurate IRS contact information in a phishing email is a deliberate tactic. The rule is simple: the IRS does not initiate contact by email, regardless of how official it looks.

Q: I clicked the link but didn't enter any information. Am I safe?

A: Possibly, but not certainly. Some phishing links install malware on click without requiring any data entry. Run a full antivirus scan on your device immediately. If you use the same browser for financial accounts, consider changing your passwords as a precaution.

Q: I entered my Social Security Number on a fake IRS page. What do I do?

A: Contact the IRS Identity Protection Specialized Unit at 1-800-908-4490 immediately. File Form 14039 (Identity Theft Affidavit) with the IRS. Place a fraud alert with Equifax, Experian, and TransUnion, and file a report with the FTC at reportfraud.ftc.gov.

Q: I have unreported crypto gains. Could a real IRS notice arrive by email?

A: No. Even if the IRS has identified unreported income, initial contact comes by paper mail. The IRS sends notices like the CP2000 or CP2501 through the postal service, not email. If you have concerns about unreported crypto income, speak with a qualified tax professional before you receive any IRS contact.

Q: Concerned about your actual crypto tax situation?

A: If phishing emails about crypto taxes are hitting close to home, it may be worth reviewing your tax position. CryptoTaxAudit offers a consultation to help you understand where you stand before the IRS contacts you by mail.