After a major deadline like tax season, it’s common to see a wave of messages that look official: “Your refund is waiting,” “Confirm your account,” or “We noticed unusual activity.” These scams aren’t new—but the themes shift with the calendar, and spring is prime time for refund bait.
If you use crypto (even casually), scammers may add a modern twist: promising a “tax refund in crypto,” claiming your wallet needs “verification,” or posing as support for an exchange. The goal is the same as always—get you to click, share codes, or hand over access. This guide keeps things simple, practical, and prevention-focused, so you can sort real notices from fakes without panic.
Common red flags in texts and emails (without the scare tactics)
Phishing works best when you’re busy and slightly distracted—exactly how many of us feel after filing taxes. The good news: most scam messages reuse the same patterns, whether they mention the IRS, your bank, or a crypto platform.
-
Urgency or pressure: “Act now,” “last chance,” or threats of penalties, account closure, or frozen funds.
-
Unexpected “refund” or “credit”: A surprise payout is meant to override your caution—especially if it claims you can “choose crypto” for faster delivery.
-
Links that don’t match the sender: Mismatched domains, odd spellings, extra characters, or link shorteners that hide where you’re going.
-
Requests for sensitive info: Passwords, one-time codes, Social Security numbers, or any crypto “recovery phrase/seed phrase.” (Legitimate support should never need your recovery phrase.)
-
“Account update” or “wallet verification” traps: Messages that insist you must re-verify immediately to keep access.
-
Support impersonation: A “help desk” number or chat link you didn’t look up yourself, sometimes paired with a fake “case ID.”
One helpful mindset shift: treat any inbound message as “unverified” until you confirm it through a channel you choose—not the one it provides.
A safe verification routine: where to go instead of clicking
You don’t have to be a cybersecurity expert to stay safe. A consistent routine is usually enough—and it lowers the odds you’ll make a snap decision when you’re tired.
-
Start from official websites you type yourself: If a message claims to be from the IRS or a financial platform, don’t use the embedded link. Open a new browser window and type the official site address (for example, the IRS at irs.gov) or use a saved bookmark you created earlier.
-
Log in the normal way: Check your account directly for alerts, notices, or messages. If it’s real, it should generally appear after you sign in through the legitimate portal.
-
Use official support channels: Find contact details on the company’s official website (not in the message). If you’re dealing with a crypto exchange or wallet provider, be extra strict about this step.
-
Pause before you react: Give yourself two minutes to look at the sender address, the full URL (if visible), and the wording. Scammers often rely on speed and stress.
-
Turn on stronger sign-in protections: Enable multi-factor authentication (MFA) wherever possible, and consider an authenticator app or hardware security key when supported.
This routine is boring—and that’s the point. Boring beats frantic every time.
What to do if you already responded or entered information
If you clicked a link, replied, or entered info, try not to spiral. The priority is to contain risk quickly and document what happened.
-
Secure accounts right away: Change passwords on the affected account(s) and anywhere you reused that password. Turn on MFA if it isn’t already enabled.
-
Watch for follow-on scams: After one successful contact, scammers may try again using “verification,” “recovery,” or “support” angles.
-
Check financial activity directly: Review bank and card statements and any relevant account alerts. If you suspect fraud, contact your bank or provider using the number on your statement or official website.
-
Scan and update devices: Run a reputable security scan, update your operating system and browser, and remove unfamiliar extensions/apps.
-
Report it: Reporting helps agencies and platforms spot patterns, even if you didn’t lose money.
If you shared a crypto recovery phrase or private key, treat it as compromised. Because crypto transfers can be irreversible, consider contacting the relevant platform’s official support immediately for guidance on account-level protections (without sharing additional sensitive information).
Sources
Recommended sources to consult (and where to verify current guidance on how agencies contact taxpayers, current scam alerts, and the latest response steps after phishing):
-
Internal Revenue Service (irs.gov) — Verification note: confirm current IRS guidance on impersonation/phishing and how the IRS contacts taxpayers.
-
Federal Trade Commission (ftc.gov) — Verification note: confirm recommended next steps if you clicked, replied, or shared information.
-
Cybersecurity and Infrastructure Security Agency (cisa.gov) — Verification note: confirm current best practices for spotting and reporting phishing, and securing accounts/devices.
-
FBI Internet Crime Complaint Center (IC3) (ic3.gov) — Verification note: confirm reporting pathway for cryptocurrency-related phishing or fraud attempts.
-
USA.gov (usa.gov) — Verification note: confirm up-to-date federal scam reporting guidance and links to official reporting tools.