Fake IRS Letters and Texts: How to Tell a Real Notice From a Scam

People get messages that claim to be from the IRS wrong in one of two directions, and the mistake is the same either way: acting before checking. Some respond fast, tapping a link or calling a number, because the message sounds official and urgent. Others see a scary letter in the mailbox, assume it is a scam and toss it, even though a real notice usually has a deadline that matters.

Both mistakes are avoidable with the same habit: pause and check before you act. Here are five quick checks that work for a letter, a text, an email or a call. They are based on how the IRS says it contacts people, and they cover the scams the IRS has warned about this year.

Check 1: How did it reach you?

The IRS says it normally contacts you the first time by mail delivered by the U.S. Postal Service. It emails or texts only when you have opted in, and it uses specific email addresses and text short codes. A social media direct message is never from the IRS.

The FTC puts it more bluntly: real tax offices will not reach out by text, email or social media to get your information. So an unexpected text saying your refund was "approved" is the first red flag. The FTC says that is not how people find out about a real tax refund.

The IRS can call, but the rules are narrow. It says it never calls to demand payment right now, threaten arrest or tell you about a refund. If someone calls with any of those, hang up. The IRS does use automated phone messages in some cases, but it says they direct you to IRS.gov and do not share specific details.

Check 2: Is it rushing or threatening you?

The IRS lists five warning signs for a call, email or text. It is unexpected, it rushes you, it threatens you, it asks for personal or financial information or it demands payment now. A message with even one of these should slow you down, not speed you up.

Payment method matters too. The IRS says it never asks for or accepts gift cards as payment. If you do owe tax, the real way to pay is through the IRS's own payment options, which you reach by typing the IRS.gov address yourself.

Check 3: Does the notice number check out?

A real IRS letter or notice has a number printed in the upper right or bottom right corner of the first page. It starts with CP or LTR. Taxpayer Advocate Service says to find that number first, then look it up with the IRS's notices and letters search to see what it means.

Here are two real examples. A CP14 means you owe a balance on unpaid taxes. A CP2000 is not a bill or an audit. It says the IRS has information from a third party, such as an employer or bank, that does not match your return and it proposes changes. Both give deadlines, explain your options and tell you how to disagree.

Do not assume a notice is real just because it has a number, though. The IRS has warned that fraudsters sometimes reference a notice or claim they already wrote to you to make a scam seem legitimate. The number is a starting point for checking, not proof.

Check 4: Verify it yourself, without using the message

Never use a phone number, link or QR code from the suspicious message. Instead, try these routes.

Sign in to your IRS online account at IRS.gov and look under Notices and Letters. The IRS says most, but not all, notices appear there, so a missing notice does not prove a letter is fake. You can also search the IRS's notices and letters page for the number, and check IRS.gov for the contact number rather than relying on the one in the letter.

You can also call the IRS at 800-829-1040 for individuals, 7 a.m. to 7 p.m. local time, Monday through Friday. Expect a wait, and be ready to verify your own identity, since IRS representatives must verify who you are before discussing your account. Some real letters come from private collection agencies the IRS uses for certain old tax debts. The IRS says it notifies you by mail before the agency sends its own letter.

Check 5: What is it asking you to share or do?

Be wary of any message that asks for your Social Security number, bank login, card number or crypto wallet details, or tells you to scan a QR code to "verify" an account. The IRS does not ask for your Identity Protection PIN either. It says phone calls, emails and texts asking for it are scams.

If you want to protect yourself ahead of time, an Identity Protection PIN is a six-digit number that helps prevent someone else from filing a return with your Social Security number. The IRS says the fastest way to get one is through your online account, and that it is valid for a calendar year.

What the IRS has warned about this year

Impersonation by email and text, often with QR codes pointing to fake IRS sites, is number one on the IRS's 2026 Dirty Dozen list. The IRS said it had counted over 600 social media impersonators in fiscal year 2025.

In July, the IRS warned about fake letters mailed to people who hold cryptocurrency. They tell people to scan a QR code and register for a "Digital Asset Compliance Portal" before a deadline. The IRS says it does not operate any such portal and did not send the letters. The IRS's scam page, updated in September, still lists it as a current scam. In January, the FTC warned about texts and emails about a "tax refund" that are really phishing attempts. A paper letter can be fake too.

Do not ignore the real ones

Verifying takes a day or two, and real notices usually give you more time than that. A CP14 tells you the due date for your balance, and a CP2000 gives a deadline to respond. If the checks show the notice is real, read it carefully and act before the deadline. If you disagree with it, the notice explains how. Ignoring a real notice can lead to penalties and interest, which is its own expensive mistake.

If you help a parent or relative with their mail, share these checks with them too. Scammers often target older adults, and a second pair of eyes before anyone replies can make the difference.

If you already clicked, paid or shared something

Do not panic and do not reply again. The IRS advises stopping communication with the scammer, changing passwords for affected financial accounts, contacting your bank or crypto exchange right away if you shared credentials and keeping screenshots, emails and letters. If your Social Security number was exposed, visit IdentityTheft.gov to get a recovery plan, and consider an Identity Protection PIN.

How to report it

For an email, send it to phishing@irs.gov with the subject line "IRS." For a text, send the sender's number, the text itself, your phone number and the date and time to phishing@irs.gov with the subject "Text," and forward the text to 7726 so your phone carrier can block similar ones. Then delete it.

For a suspicious call, write down the number, hang up and report it to the Treasury Inspector General for Tax Administration, known as TIGTA, at 800-366-4484. For a fake letter, the IRS says to report it to the U.S. Postal Service and the FTC. You can also report to the FTC at ReportFraud.ftc.gov and submit tips through IRS.gov/SubmitATip.

The simplest rule: if a message about taxes arrives by surprise and asks you to do something quickly, do not act on it. Check first, using your own route to the IRS. Real notices will still be real after you have verified them.