IRS impersonation scams, plus the ATO, HMRC and CRA versions
Industry / situation. Updated 2026-09-13. About 5 minutes to read.
Hang up and check your tax account yourself by typing the agency's address or opening its official app. Never use a number or link from the message.
The IRS normally makes first contact by mail, does not demand immediate payment, and does not accept gift cards. A call, text or social media message that threatens arrest over unpaid tax is a scam. The FBI received 32,424 government impersonation complaints in 2025, with 798 million dollars lost.
The same script runs in Australia, the UK and Canada with the local tax office's name swapped in. This guide covers how it unfolds, what each real agency will and will not do, and exactly where to report.
How the tax office scam unfolds
Contact: a robocall saying a lawsuit or warrant has been filed, a text about a refund, or an email about a problem with your return.
Credibility: the caller gives a badge number, knows your address, and the caller ID shows a government number, which is easy to fake.
Threat or bait: you owe back taxes and police are on the way, or you are owed a refund that needs your bank login to release.
Pressure: you must stay on the line, not hang up, and not speak to an accountant or family member.
Payment: gift cards, a wire transfer, a crypto ATM, a payment app, or a 'verification' payment to a personal account.
Harvest: for refund versions, a fake login page collects your tax account password, ID numbers and bank details for identity theft.
What the IRS does, and never does
The IRS normally contacts you first by US mail. It emails only if you opted in, from addresses ending in irs.gov, and texts only if you opted in.
It says a social media direct message is never from the IRS.
It will not rush you, threaten you, demand payment now, or accept payment by gift card.
Real payments go to the United States Treasury, or through IRS.gov/payments.
Revenue officers carry two forms of official credentials, a pocket commission and an HSPD-12 card, which you can ask to see.
Report fake IRS emails and texts to phishing@irs.gov, and scam calls to the Treasury Inspector General for Tax Administration on 800-366-4484.
The same scam in Australia, the UK and Canada
ATO (Australia): the ATO never sends an unsolicited SMS containing a hyperlink. To check a contact, call 1800 008 540. Forward scam emails, or email screenshots of scam texts, to ReportScams@ato.gov.au. Since April 2026, the ATO app has a verify call option that confirms within about 30 seconds whether a caller is really the ATO.
myGov (Australia): myGov only asks you to sign in through the official app or by typing my.gov.au, and never sends a link or asks you to reply with sign-in details. Report scams to reportascam@servicesaustralia.gov.au, or call the Scams and Identity Theft Helpdesk on 1800 941 126 if you clicked a link or gave information.
HMRC (UK): HMRC never sends tax rebate notifications by text. Forward suspicious emails to phishing@hmrc.gov.uk, forward texts to 60599, and report suspicious calls through the Report a suspicious HMRC phone call service on GOV.UK.
CRA (Canada): the CRA will not demand or pressure immediate payment by Interac e-Transfer, cryptocurrency, prepaid credit cards or gift cards, and will not threaten arrest or deportation. Verify through CRA My Account or by calling 1-800-959-8281, and report to the Canadian Anti-Fraud Centre on 1-888-495-8501.
The ATO says almost 7,500 ATO impersonation scams were reported to it in July 2025 alone. Tax time is peak season for these messages in every country.
Phrases that give the scam away
'A warrant has been issued for your arrest for tax evasion.'
'Press 1 to speak to an officer before legal action begins.'
'You are eligible for a tax refund, click here to claim it.'
'Your tax file number, SIN or Social Security number has been suspended.'
'Pay the outstanding amount today with gift cards or Bitcoin.'
'Do not hang up, this call is being recorded for court.'
Any text from the tax office with a clickable link.
If you paid or gave your details
Call your bank on the number on your card and ask them to stop or recall the payment. For gift cards, call the card company straight away.
Change the password on your tax account and your email, and turn on the strongest sign-in option the agency offers.
US: if your Social Security number was shared, go to IdentityTheft.gov, which can generate an FTC report and the IRS Identity Theft Affidavit. Consider an IRS Identity Protection PIN. Report the call to TIGTA on 800-366-4484.
Australia: call the ATO on 1800 008 540 if you shared personal information or paid, and call IDCARE on 1800 595 160 for a free response plan.
UK: tell HMRC and report to Report Fraud on 0300 123 2040, or Police Scotland on 101.
Canada: contact the CRA to secure your account, then report to the Canadian Anti-Fraud Centre.
Protect a parent at tax time
Set your parent up with the official tax app or online account and show them where real notices appear. When a scary message arrives, the habit becomes: open the app, look for the notice, and if nothing is there, it was a scam.
In the US, an IRS Identity Protection PIN stops anyone filing a return in their name. In Australia, register their device in the ATO app so the verify call feature works, and help them set up a passkey or Digital ID sign-in for myGov.
Frequently asked questions
Does the IRS ever call you?
It can, but normally only after sending letters first, and it will not demand immediate payment, threaten arrest, or ask for gift cards. If in doubt, hang up and check your account at IRS.gov.
I got a text from the ATO or myGov with a link. Is it real?
No. The ATO does not send unsolicited texts with hyperlinks, and myGov never sends links to sign in. Delete it and report a screenshot to the ATO or Services Australia.
Where do I forward an HMRC scam text?
Forward it to 60599, which is charged at your network rate. Forward HMRC scam emails to phishing@hmrc.gov.uk.
Can the CRA ask for payment in Bitcoin?
No. The CRA says it will never demand immediate payment by cryptocurrency, gift cards, prepaid credit cards or Interac e-Transfer.
I only gave my name and address. Do I need to do anything?
Report the contact and watch for follow-up messages that use those details to sound more convincing. If you also gave an ID number, bank details or a login, follow the full steps above.