A message says it is the IRS. Here is how to check it before you answer

The message arrives when you are already watching the mailbox

Picture a Tuesday afternoon in mid-October. You filed on extension a few days ago, or you are still gathering paperwork to file, or you sent a payment in the spring and never saw a confirmation. Then your phone buzzes: "IRS: your account shows an unpaid balance. Resolve today to avoid legal action," followed by a link.

Your stomach drops, and that is the point. Scammers do not need to know anything about your return. They only need a message that fits what many people are already worried about at this time of year: a balance, a missed form, a refund that has not shown up. The message works because the fear is real, even though the sender is not.

This guide gives you a short, repeatable way to check any contact that claims to be the IRS. It will not make you an expert on every scam currently circulating, and it does not need to. The checks below work on the new ones too, because they rely on how the real agency behaves rather than on the scammer’s latest script.

How the real IRS usually reaches you

The IRS describes its own contact habits on a page called "How to know it’s the IRS," and the pattern is consistent. The agency normally contacts you the first time by mail delivered by the U.S. Postal Service. Some of those letters come from private collection agencies the IRS works with for certain tax debts, and the IRS says it notifies you by mail before such an agency writes.

Email is different. The IRS says it emails only when you have opted in, and its legitimate account notifications come from an address ending in irs.gov. Text messages follow the same rule: the IRS sends them only if you opted in, using specific short codes. A social media direct message is never from the IRS, which uses its verified accounts to post updates and scam alerts instead.

Phone calls are the gray area, and it is worth being precise. The IRS or its private collection agencies may call about account matters. Agents conducting an audit may phone after an initial letter. What the agency says it does not do is call to demand payment right now, threaten arrest, or tell you about a refund. An automated message from the real IRS directs you to IRS.gov and does not share specific details.

In-person visits exist but are uncommon, and the IRS generally sends a letter first. If someone does come to your door, the IRS says its revenue officers, revenue agents and fuel inspectors carry an IRS-issued credential and a government ID card with a photo, and you can ask to see both. If you feel unsafe, call 911. If you are unsure, call the number on the official letter or on IRS.gov, not a number the visitor gives you.

Five warning signs that apply to every channel

The IRS lists the same short set of red flags for calls, texts, emails and letters. A contact is suspicious if it:

• Is unexpected. You were not told to expect it, and no earlier letter fits.
• Rushes you. Deadlines measured in hours, "final warning" language, countdowns.
• Threatens you. Arrest, deportation, a frozen bank account, a lawsuit.
• Asks for personal or financial information. Social Security number, bank login, a code that was just texted to you.
• Demands payment now. Especially a method that cannot be undone, such as gift cards or a wire transfer.

One of these is enough to pause. Two or three together is the standard shape of a scam. The IRS adds a related warning about odd or misspelled web addresses that take you somewhere other than IRS.gov, and about offers that sound like a big payday. If a message promises a refund, a credit or a deduction you did not ask about, treat that as a warning sign rather than good news.

Notice what is missing from the list: bad grammar and clumsy logos. Those used to be reliable tells. They are not anymore, and a polished message can still fail every test above. Judge the behavior, not the formatting.

What a real notice looks like, and how to confirm it

A real IRS letter is usually dull. The IRS says it may send a notice or letter if you have a balance due, your refund changed, it has a question about your return, it needs to verify your identity, it changed or corrected your return, or processing is delayed. Most are routine, and the agency states you only need to act if it asks for more information, you owe a balance, or you disagree.

Look in the upper right corner of the paper. The IRS says the CP or LTR number is printed there. That number is your search key. The IRS notices and letters page lets you search by number or topic, and the explanation you find should match what your letter says and asks you to do.

There are three independent ways to confirm a letter without relying on anything in the letter itself:

1. Check your IRS online account. The IRS says certain notices and letters are available in your online account. If you do not have an account, you can create one yourself at IRS.gov by typing the address into your browser, not by following a link from a message.
2. Search the number on IRS.gov. If the letter does not appear in the search, or looks suspicious, the IRS tells you to call 800-829-1040 and follow the representative’s instructions.
3. Call the agency on a number you found yourself. Do not use the phone number, QR code or website printed on a document you are trying to authenticate.

For a letter from a private collection agency, the IRS says it mails you advance notice, so you should already have a prior IRS letter on file. If you cannot find one, treat the collection letter as unconfirmed until you have verified it through the steps above.

A text or email you did not ask for

Because the IRS texts and emails only with your permission, an unsolicited message is suspect by default. Resist two reflexes: replying to the sender, and tapping the link to "see what this is about." Opening a link can lead to a copy of the IRS website built to capture your login or Social Security number, or to software that harms your device.

If you want to double check without clicking, open your browser, type IRS.gov yourself, and sign in to your online account. Anything real that needs your attention will be there or will arrive by mail. If nothing is there, you have your answer.

Our guide on how to check a convincing message before you click walks through the habit in more detail, and the piece on QR code and “pay now” text scams covers the parallel tricks aimed at drivers and online shoppers. The tax versions use the same machinery with a more frightening label.

One current example the IRS flags on its scam page: fake letters mailed to people with cryptocurrency, directing recipients to a copycat website and a so-called Digital Asset Compliance Portal that, according to the IRS, does not exist. The letters carry a QR code, and the agency’s advice is not to scan it or respond. The lesson applies beyond crypto: paper mail can be fake too, and a QR code on a letter deserves the same suspicion as a link in a text.

The phone call that tries to scare you

Calls are where scammers lean on pressure, because a live voice can keep you from stopping to think. The IRS says it does not leave urgent or threatening messages, and it does not call to demand immediate payment or threaten arrest. A voicemail warning of an arrest warrant is, by the IRS’s own description, a scam pattern.

Payment method gives the game away. The IRS says it never asks for payment by prepaid card or gift card, and its authorized private collection agencies do not either. The IRS also lists wire transfers and cryptocurrency among the payment requests scammers make of seniors. Real payment options are listed on IRS.gov/payments: paying from a bank account is free, while debit or credit card and digital wallet payments carry fees. Cash and checks or money orders payable to the United States Treasury are also options.

A practical script helps when you are rattled: "I will call the IRS back on the number from IRS.gov." Then hang up. You are not being rude. A legitimate agent has no problem with that sentence, and a scammer usually cannot continue without the pressure. Record the caller’s number first if you can, since you may want to report it.

Older relatives are frequent targets. The IRS says scammers calling seniors may impersonate the IRS, the Social Security Administration or Medicare, claim there is a problem, refund or prize, and pressure for immediate action. If you have a parent or grandparent who answers unknown numbers, the single most useful thing you can give them is permission to hang up.

Why the “refund” angle also deserves suspicion

Not every IRS-themed scam threatens you. Some flatter you. The IRS warns about social media posts and paid promoters that push big refunds by encouraging people to claim credits they do not qualify for, or to make up income or withholding numbers on forms such as a W-2. Some charge large upfront fees or a fee tied to the size of your refund.

The IRS says people who file false claims can face penalties and criminal prosecution, and that people who followed bad advice can amend a return or file a past-due return. That is the cost of a bad shortcut: the refund you were promised can become a bill later, and the promoter who took a fee is long gone.

A few filters help. A legitimate credit has eligibility rules you can read on IRS.gov without paying anyone. A preparer who will not sign your return, who has no Preparer Tax Identification Number (PTIN), or who wants your refund deposited into their own account is a red flag; the IRS lists these among warning signs of dishonest preparers. And a claim that the IRS is hiding a credit from you is just marketing.

If you want the underlying difference between the two things a return can do for you, our article on how a deduction differs from a credit explains why a real credit never needs a secret.

If you already clicked, paid or gave information away

It happens to careful people. What matters is what you do in the next hour. The IRS’s "if you were scammed" guidance starts with the same sequence for money and identity:

1. Stop interacting. Do not send more money or share more information, even if the person offers to "fix" it. The IRS warns that some scam victims get scammed again, so be cautious about anyone offering to recover your money.
2. Contact your bank or card issuer right away and tell them what you sent and how.
3. Follow the steps at IdentityTheft.gov if personal information was exposed.
4. Report the scam (next section).

If your Social Security number was stolen, the IRS suggests reporting it to IdentityTheft.gov, reporting it to the IRS, and considering your state tax agency. If someone filed a return using your information, the IRS directs you to get a copy of it and submit Form 14039, the Identity Theft Affidavit. If your own return is rejected because someone already filed with your number, report that to the IRS. For stalled situations the agency lists 800-908-4490, open 7 a.m. to 7 p.m. Eastern time, and the independent Taxpayer Advocate Service as another source of help.

Consider an Identity Protection PIN. It is a six-digit number that helps prevent someone else from filing a return with your Social Security number or ITIN. Only you and the IRS know it, and it is valid for one calendar year. The fastest way to get one is through your IRS online account. One firm rule from the IRS: it will never ask for your IP PIN, so any call, email or text requesting it is a scam.

Where to report it

Reporting feels pointless when no money was lost, but the IRS asks for it because reports help shut down scams. The method depends on the channel, according to its report-a-scam page:

• Email: do not reply, click links or open attachments. Send it to phishing@irs.gov with the subject line “IRS” (or “Treasury”), ideally saved as a file and attached, since plain forwarding strips information used to trace the sender. You can also report to the Treasury Inspector General for Tax Administration (TIGTA).
• Text: do not reply or click. Send the sender’s number, the message text, your own number, and the date, time and time zone to phishing@irs.gov with the subject “Text.” You can also forward the text to 7726 (SPAM), which helps your carrier block similar messages. Then delete the original.
• Phone: record the number and hang up, then report to TIGTA through its hotline or at 800-366-4484.
• Mail: for a fake letter about an unclaimed refund, a tax lien or tax debt relief, the IRS points to the U.S. Postal Service and the Federal Trade Commission, and to your state attorney general’s consumer protection office.
• Social media: the IRS never sends direct messages, so any one is fake. Report it using the IRS’s instructions and the platform’s own report tool.

If you lost money or your identity, report the fake message and also follow the “if you were scammed” steps above. Reporting is not a substitute for calling your bank.

A two-minute checklist and a filing habit

Keep this routine where you will find it. Before you respond to anything that claims to be the IRS:

1. Name the channel. Mail, call, text, email, social media or a visit? The last four are suspect if they were the first contact.
2. Count the warning signs. Unexpected, rushed, threatening, asking for information, demanding payment now.
3. Leave the message. Do not click, scan, call back or reply using anything in it.
4. Check independently. Sign in to your IRS online account, search the notice number on IRS.gov, or call a number you found there.
5. Pay only through IRS.gov. The official payments page lists the legitimate methods.
6. Report it, then delete it.

Real notices still deserve prompt attention. The IRS says to read a notice carefully, keep it, and respond by the due date if it asks for something. If you owe money, it advises paying by the due date even when you cannot pay in full, which can reduce interest and penalty charges. If you disagree, follow the dispute instructions and reply by the due date to protect your appeal rights.

That is where record keeping pays off. Keep every genuine notice with your return in the system described in our guide to a simple tax record system, and if you are catching up after a late filing, start with what to do about a missed October 15 extension deadline. When a suspicious message shows up, a tidy folder of real correspondence makes the fake one easier to spot.

One last point of calm. The IRS is not going to arrest you over a text, close your accounts by voicemail, or accept a gift card for a tax bill. When a message insists otherwise, you have already learned what you need to know about who sent it.