Tax Refund Approved? The Email May Be Asking for Your Identity, Not Releasing Money
How a fake refund notice collects personal and banking information, how to check a real refund, and which exposure to address if you already responded.
A refund message arrives with good news and one small condition: confirm your identity or bank details to release the payment. If you are expecting money, the request can feel like the final administrative step rather than a new financial risk.
The FTC’s January 2026 tax-refund warning describes messages designed to obtain personal information through a refund pretext. The safest response is to check the refund through the relevant tax authority, separately from the message asking you to claim it.
For a US federal refund, start from IRS.gov. For a state refund, use that state’s official tax agency. A logo and an amount in an email do not establish that the payment exists.
There are two different questions to answer
First, are you actually due a refund, and what is its status? Second, is this particular message an authentic communication? You do not need to settle the second question before using an independent official route to answer the first.
That distinction prevents a common trap. A real refund can be pending at the same time that a fraudulent message arrives. The genuine expectation makes the lure plausible; it does not authenticate the attached form.
If you are not expecting a refund, do not submit information simply to discover why the message was sent. Investigate any tax concern through the authority’s established service, not through an unsolicited “eligibility” check.
Check the actual refund through the responsible authority
The IRS refund page links to its official refund-status tools and explains the process. Reach it independently rather than using the email’s button or a phone number in an attachment.
State refunds are separate. Use the relevant state tax authority’s website, and do not assume a federal tool can show every payment. USA.gov’s refund information provides a useful government starting point for federal and state questions.
An official status tool may ask for identifying information needed to locate a return. The safeguard is not “never type personal information anywhere.” It is to use the correct service reached through an independently established route, and provide only what that process requires.
Watch the request, not just the spelling
Errors in an email can be warning signs, but polished writing is not proof of authenticity. A copied logo, familiar agency name, and plausible refund amount can be assembled into a convincing message.
Look at the requested action. Is it asking you to supply a bank login, upload identity documents through an unfamiliar form, pay a release charge, install software, or call a special cancellation desk? Those requests should be checked against the authority’s actual process.
Do not trust a reply from the same sender that says the page is safe. Nor should a browser padlock settle the question: encryption protects a connection, not the truth of the organization claim behind it.
| Message claim | Independent action |
|---|---|
| Your refund is approved | Check status through the official tax-agency tool |
| Your bank details must be confirmed | Consult the authority’s established instructions before providing anything |
| A fee releases the money | Do not pay through the message; verify the claim independently |
| Your identity must be verified immediately | Use the tax authority’s documented identity-verification process, if applicable |
| A refund was sent in error | Contact the authority through a known route before returning funds |
If you entered details but no money moved
Do not measure the incident only by the absence of a charge. A form collecting a Social Security number, date of birth, address, or identification image can create an identity exposure without an immediate payment.
List the specific fields you completed. If you do not remember, record that uncertainty rather than revisiting the page to reconstruct it. Preserve the original message and any confirmation already available.
Use IdentityTheft.gov for official US guidance based on the information disclosed or misuse discovered. If the exposure involves your tax account or a suspicious return, follow the tax authority’s own identity-theft instructions as well.
If you supplied a password or banking information
Secure an exposed password through the real provider’s app or website. Review account activity and recovery settings, and change the password on any other account where it was reused. Do not send a code to a person who offers to “confirm” that the reset worked.
For bank or card details, contact the financial institution directly. Explain what was disclosed and whether you authorized any transaction. Ask what monitoring, replacement, or other protection is appropriate to the actual exposure.
Keep your recovery actions separate from the suspicious correspondence. A new support-looking message may be another unverified approach, even if it mentions the incident you just reported publicly.
If a release or processing fee was paid
Contact the payment provider promptly with the amount, date, recipient, and transaction reference. Ask what options remain for a suspected scam payment. The outcome depends on the payment method and circumstances; do not assume all transfers are reversible.
Do not pay a second fee to unlock the first payment or to receive a larger refund. An on-screen balance or emailed receipt from the sender is not proof that the promised tax money exists.
If you posted about the incident online, be cautious about private offers from “recovery experts.” Keep financial details out of public screenshots and use official support routes for the account or payment involved.
Report the impersonation through the real agency
The IRS phishing-reporting page explains how to report suspicious communications claiming to be from the IRS. Follow its current instructions for the type of message you received, and avoid opening unexpected attachments to collect more evidence.
For state-agency impersonation, find that agency’s verified reporting route. You can also report suspected consumer fraud to ReportFraud.ftc.gov. A report helps document the pattern; it is not a substitute for contacting your bank when payment information was exposed.
Do not confuse a refund lure with a genuine account notice
Tax authorities have real verification and correspondence procedures. The objective is not to ignore every administrative request. It is to establish that the request belongs to an actual process before submitting information.
The same principle applies to loan-application cancellation texts and benefit-boost offers. A promised benefit does not justify an unverified data collection route. Check the record with the responsible institution, then respond only through the process you confirmed.
Found a factual error or a source that has changed?
Send a correction →
