Scammers are sending polished “refund approved” messages that look like they’re from the IRS, but clicking the link can lead to stolen personal and financial information.
People who filed extensions are at higher risk through October, since ongoing tax activity makes these messages feel more believable.
The best defense is simple: never click unsolicited IRS links. Go directly to IRS.gov, slow down, and verify before taking action.
Tax Day may be over, but scammers are just getting started. Right now, a new wave of tax scams is hitting inboxes, phones, and social media feeds across the country.
The message is simple and it’s a highly effective way to get people’s attention: “Your refund has been approved. Claim it here.”
For millions of Americans waiting on a refund or filing a tax extension, it’s exactly what they want to hear. And that’s why it works so effectively.
ConsumerAffairs had the chance to interview Gary Orenstein, consumer security expert at Bitwarden, about how these scams work and how to protect ourselves.
What these scams actually look like
These aren’t the obvious scam emails we’ve seen for years that people tend to ignore.
As Orenstein explains, modern tax scams are built to look very polished and legitimate, often mimicking real IRS or tax platforms like TurboTax.
They can show up as:
- Emails
- Text messages
- Phone calls
- Social media messages
They use familiar language that you tend to see around refunds, credits, or account verification. Some even include official-looking logos and QR codes.
But once you click, you’re typically taken to a fake site designed to capture sensitive information like your Social Security number, banking details, or login credentials.
From there, scammers can move quickly into identity theft or even financial fraud.
As Orenstein notes, the danger today isn’t that scams look suspicious, it’s “how convincingly the scam imitates a trusted source.”
This rule still holds true: The IRS does not contact taxpayers by email, text, or social media to request personal or financial information.
Why extension filers are at risk longer
Many people assume tax scams fade after April 15, but that’s not the case.
If you filed an extension, you remain in the process until October 15, which keeps you in the “target zone” much longer.
Orenstein points out that this extended timeline creates more opportunities for scammers to exploit confusion and expectation. If you’re still waiting on documents or planning to file, a message about your taxes feels more believable.
With roughly 20 million Americans filing extensions each year, that’s a large group of people who are still engaged with tax-related tasks for months after Tax Day.
Scammers take advantage of this by sending messages about:
- Verifying your account
- Resolving a tax issue
- Paying a balance
- Claiming a refund
When you already know your taxes aren’t complete, these messages feel much more legitimate.
Why urgency is their biggest weapon
Urgency is one of the most effective tools scammers use these days. And not surprisingly, it shows up in nearly every one of these fake messages.
You’ll often see:
- “Act within 24 hours”
- “Your refund will be forfeited”
- “Immediate action required”
As Orenstein explains, urgency works because “it pushes people to react before they stop to verify what they are seeing.”
And with AI, scammers can now create more personalized, better-timed messages at a larger scale.
The one rule that stops most scams cold
Despite how advanced these scams have become, the best defense is still fairly simple.
Never click links in unsolicited messages claiming to be from the IRS.
Orenstein emphasizes that this one habit can stop the majority of scams before they even begin.
If you receive a message about your refund or tax account:
- Don’t click
- Don’t reply
- Don’t enter any information
Instead, go directly to IRS.gov by typing the address into your browser.
Also remember:
- The IRS will never request payment via gift cards.
- They won’t demand immediate action through email or text.
- They don’t ask for sensitive information this way.
How to protect yourself moving forward
Beyond avoiding suspicious links, a few extra steps can add some much-needed protection.
Orenstein recommends using tools that help verify where you’re entering your information.
- Use a password manager like Bitwarden, Dashlane, or LastPass.
- Turn on multi-factor authentication (MFA).
- Verify any tax-related messages directly with the IRS or your preparer.
Password managers can act as a useful early warning system and protect you. Meaning if a website is fake, they won’t allow you to autofill your password and user ID, signaling that you’re on a shady site.
The bottom line
In many cases, these scams don’t look like obvious scams anymore.
With the help of AI, they’re designed to blend in, feel super familiar, and catch you in a moment of urgency.
As Orenstein makes clear, the best defense isn’t complicated, it just comes down to changing your behavior.
Slow down. Don’t click. Verify everything.
Because when it comes to tax refund scams, that one pause can make all the difference.