Follow ZDNET: Add us as a favorite source On Google.
ZDNET Highlights
- Tax scams are making many people victims.
- Protect yourself by not responding to tax-related calls or messages.
- If you have been a victim, report the crime and secure your accounts.
Tax season is here, and that means cybercriminals are busy devising scams designed to steal money or other sensitive information from unsuspecting taxpayers. Thanks to AI, falling into this type of scam may be easier than you think, at least according to the folks at technology expert McAfee.
Also: Best Tax Software for a Stress-Free Tax Session
Released on Tuesday, McAfee’s 2026 Tax Season Survey Highlights how tax scams work, how they reach people, and who is being affected most. The survey offers several tips on how to avoid such scams and how to respond if you are ever a victim.
Average loss is $1,020
With 82% of Americans saying they are worried about tax fraud this season, many have received as many, if not more, scam messages this year than last year. Nearly 40% believe scam messages are more sophisticated now than last year, with most worried that AI is making these scams more realistic.
More than 30% of those surveyed said they have been contacted by someone claiming to be from the IRS or other tax authority. Since scammers use all available tools, initial notification may come by phone, email or text. With email and text, nearly 40% of respondents said they were asked to click on a link or send payment.
Plus: 5 ways AI can help you tackle your taxes — and 10 tax tasks you shouldn’t trust it to
Tax scams are making many people victims. About 23% of the people surveyed said that they have fallen into a tax scam. This percentage increases even more to 42% for people aged 18-24. More than 10% of those surveyed said they have been affected by tax-related identity theft. Nearly 20% of respondents said they lost money to a tax scam, with the average loss reaching $1,020.
Malicious Websites
Scammers are also busy creating malicious websites to carry out fraud beyond the initial call or message. And that move doesn’t wait for tax season. Between September 1, 2025, and February 19, 2026, McAfee found 1,468 malicious or suspicious tax-themed unique domains, an average of 43 new fake tax websites every day. In early November alone, the average number of these malicious domains nearly doubled in just one week.
In creating these sites, scammers try to mimic the real IRS website or other official government sites. To deceive people, crooks may include misleading subdomains on the page or create additional text around the URL IRS.gov. These fake sites are designed to capture your login credentials, steal your Social Security number or tax ID, siphon your payment details, and even charge fraudulent processing fees. In some cases, McAfee found scammers who wanted to charge people $319 to file an EIN (Employer Identification Number), which the IRS provides for free.
Also: How to File Your Taxes for Free in 2026 – 4 Ways to Do It (Despite Direct File Ending)
Tax scammers usually shake things up to get your attention. They can let you know if there is a tax issue, such as a refund issue, underpayment, or verification issue. Next, they will assert their alleged authority by claiming to be from the IRS or state tax authority. They may also provide some personal details about you that they may have obtained through social media or a data breach.
From there, they will usually provide a link to a “secure portal” or “refund page.” The site will then ask for your login credentials, Social Security number, bank information, or even details of past returns. Next, they apply pressure by demanding payment to avoid penalties or fix the mistake. If you do not comply, they will escalate the threat by vowing to contact law enforcement.
If you fall for the scam and make a payment, you may only realize it was a scam after noticing a strange charge or seeing unexpected login activity.
how to protect yourself
To protect yourself from such scams in the first place, McAfee offered the following tips:
- Do not engage in tax-related calls, emails or texts. Instead, go directly to the IRS website (irs.gov) or your state’s tax agency site for further investigation.
- Ask for written notice of the alleged tax refund or penalty.
- Never click on a link in a text or email. Then, go directly to the IRS or state agency’s website.
- If you reach a page that looks legitimate, stop and verify. Even with AI-enabled websites, you can often see mistakes.
- Remember that the IRS never asks for payment by phonecall, email or text. And the agency won’t ask you to pay tax penalties through gift cards or cryptocurrencies.
Have you already been hit? do this now
Okay, but what if you ever become a victim of a tax scam? Here, McAfee also offered some words of advice.
Plus: 5 ways AI can help you tackle your taxes — and 10 tax tasks you shouldn’t trust it to
Stop responding to scammers. Do not click on links or attachments in any follow-up text or email. Do not send any further information or money.
Take screenshots of phone numbers, email addresses, usernames, message contents, any links, and any payment receipts or transaction IDs.
Also: This is the best money management app I’ve tested
Lock your accounts, especially email accounts. If a scammer is successful in breaking into your email, they may be able to reset the passwords of other accounts. Change the password of your email account as well as your banking and tax accounts. Turn on two-factor authentication (2FA) for sensitive accounts. Also, change any passwords that you’ve reused across multiple accounts.
Report Scam. File report with ftc. Contact your bank or credit card company to alert them of the theft. Forward the initial phishing email to the IRS here phishing@irs.gov.
Consider signing up for a data removal service that can identify where your information was leaked and how to remove it.
Make sure you are protected from further attacks. The right security software should warn you about malicious websites before you enter any personal information. McAfee offers a free tool called McAfee WebAdvisor.
Also: No, the IRS didn’t text or email you – 3 ways to protect yourself from scams
Use anti-spam features or apps that can block or warn you about suspicious calls and texts. Look for an identity monitoring service that can alert you if your personal information is leaked online.
Finally, run a virus scan on your PC to make sure no malware has been installed. If you don’t already have security software, you can find many free antivirus programs.
