As the deadline for filing Income Tax Returns (ITRs) approaches, cybercriminals are stepping up efforts to target taxpayers. Fake Income Tax notices sent through WhatsApp, SMS and phishing websites are becoming more common, with fraudsters trying to trick people into sharing sensitive information or installing malware on their devices.
Cybersecurity firm CloudSEK recently warned of an active phishing campaign in which scammers are impersonating the Income Tax Department. The campaign uses fake penalty notices, malicious ZIP files and cloned versions of the Income Tax e-filing portal to steal passwords, one-time passwords (OTPs) and banking details.
While these scams may appear convincing, genuine Income Tax communications follow a defined process. Knowing how the department issues notices and how taxpayers can verify them can help prevent financial loss and identity theft.
How to identify a fake Income Tax notice
Some alerts are issued via SMS and email by the Income Tax Department and these include reminders about return filing, verification, and refunds. However, it would not be advisable for any taxpayer to trust all alerts that come through as being sent from the department. There are several things a taxpayer must consider before taking any measures based on an alert.
It always starts with who the sender of the message is. Any message that comes from an unknown mobile number or an individual’s WhatsApp handle or some ID must raise a red flag. It is also possible for the fraudster to use fear tactics by mentioning that there is a fine, a refund due or even the blocking of the PAN card or bank account.
The presence of a dubious link or attachment can also be another important warning sign. Many fake emails include a shortened URL or a link to a website that looks almost exactly like the genuine Income Tax website. In some cases, the message may also ask you to download ZIP or APK files which have been presented as tax-related documents. As per the statement of CloudSEK, these files may infect your system with malware that could steal your OTPs, banking credentials and many more sensitive data from your device.
There are also many messages asking for passwords, PINs, OTPs, and banking details. However, the Income Tax department has confirmed that it will never ask for any such sensitive information via an email.
How to verify if a tax notice is genuine
One of the simplest ways to verify an Income Tax notice is by checking its Document Identification Number (DIN). Every communication issued by an Income Tax authority on or after October 1, 2019, is required to carry a unique DIN. Taxpayers can use the department’s online “Authenticate Notice/Order Issued by ITD” service to verify a notice using its DIN or other notice details. The verification facility can be accessed without logging in to the e-filing portal.
If a message claims that a notice has been issued, avoid clicking the link provided in the SMS or WhatsApp message. Instead, type the official Income Tax e-filing website address directly into your browser and log in to your account. You can then check your pending actions, notices or e-proceedings to confirm whether any official communication has actually been issued. Verifying notices through the official portal is the safest way to confirm whether they are genuine.
What should you do if you clicked the link?
Accessing such links may result in the compromise of personal and monetary details by hackers. While phishing sites are designed to obtain the credentials of victims, malicious files are capable of installing software, giving hackers control over emails, contacts, and banking information. Usually, people do not realize the threat until unauthorized transactions or identity theft takes place.
In case one has opened the phishing link or even downloaded the attachment, he or she should take action at once. It is necessary to disconnect the device from the internet if there is any suspicion that the computer is infected with malware, remove the suspicious program and perform a system scan via the latest version of antivirus software. One should change the password of the email account, online banking service and Income Tax e-filing portal from another device.
Moreover, it is recommended that taxpayers should not open suspicious attachments, click on any unknown link, or provide any personal and financial information in an email message which is fraudulent. The Income Tax Department can be contacted at its official email address in case of any suspicious phishing emails or fake tax websites. In addition, cybersecurity attacks may be reported to CERT-In and the National Cyber Crime Reporting Portal.
As more sophisticated phishing attacks occur when taxpayers file their taxes, there are a few things that they can do to keep themselves safe. Firstly, it is necessary to verify a notice from the official Income Tax website and check whether the notice contains a DIN or not. In addition, taxpayers should avoid downloading any unsolicited files and should never send OTP and banking credentials in a tax notice email.
Also Read: Gold, Silver Prices Today (August 1, 2026): Check 18K, 22K, 24K Gold Rates in Delhi, Mumbai, Chennai and more
The post Got Income Tax Notice on WhatsApp? Don’t Click Until You Check These Warning Signs appeared first on NewsX.