IRS and CRA Scam Alerts, Plus Fake Income Tax Messages in India

IRS and CRA scam alerts matter more for cross-border families than for most taxpayers, because people who live between countries expect letters, calls and portals from several tax offices and cannot always tell which are real. Scammers copy the look of the IRS, the Canada Revenue Agency and the Indian Income Tax Department, then press for payment or personal data. This guide shows how each agency really contacts you, the red flags, a verification routine you can follow in minutes and what to do if you already responded.

How do the IRS, CRA and Indian Income Tax Department contact you?

What are the warning signs in IRS and CRA scam alerts?

The IRS says a call, email or text is not from the IRS if it is unexpected, rushes you, threatens you, asks for personal or financial information or demands payment now. The CRA adds that it will not use aggressive or threatening language, charge a fee to speak to a call-centre agent, ask for personal information in a voicemail or email, send emails with a link asking you to enter personal or financial information, or use instant messaging such as WhatsApp or Facebook Messenger. Official CRA web addresses start with canada.ca or end in cra-arc.gc.ca; an IRS or CRA message from a lookalike domain is a scam signal.

The IRS lists scams that target readers of this site in particular:

• Fake digital asset compliance letters that direct you to a nonexistent "Digital Asset Compliance Portal"; the IRS says do not respond or scan the QR code.
• Form W-8BEN requests. Form W-8BEN is legitimate, but you submit it only to a withholding agent; scam messages use it to collect your passport number, PINs and passcodes.
• IRS online account "help." Scammers offer to create an account for you; you can create your own.
• Gift card payment demands for a supposed tax bill.
• Credit and refund scams that urge false claims on Form W-2 or amended returns for a fee.

In India, the Income Tax Department has said that fake emails and SMS asking you to submit a refund request through a link are not sent by the Department, that it never asks for passwords or bank details by email or SMS, and that updates to personal details, such as address and bank account number, are made only by logging into your own e-filing account on the official website.

How to verify a tax message step by step

1. Stop and do not click, call back or reply. Treat links, QR codes and numbers in the message as unverified.
2. Check the channel against the table above. Does that agency ever contact people this way?
3. Use your own account. For the IRS, search the notice or letter number on irs.gov under notices and letters and sign in to your online account (see what to do when you get an IRS notice). For the CRA, sign in to your CRA account and check Mail; our CRA assessment guide shows where notices appear. For India, sign in to the e-Filing portal and check the e-Proceedings worklist, described in our India notices overview.
4. Authenticate an Indian notice. The e-Filing portal has a pre-login "Authenticate Notice/Order Issued by ITD" link. You can look up a notice using the Document Identification Number and a mobile number, or using your PAN, document type, year, issue date and mobile number; a 6-digit OTP is valid for 15 minutes with three attempts. The Department says every communication issued on or after October 1, 2019 bears a unique DIN and that a communication without one is treated as invalid, and it adds that you need not respond. Still show it to your Chartered Accountant before ignoring it.
5. Call an official number you find yourself. End a suspicious call, then look up the agency's number on its website.
6. Write down what happened and keep screenshots.
7. Report it. See the next section.

What should I do if I already paid or shared information?

The IRS tells victims to stop interacting with the scammer, not to send money or share personal information, to contact their financial institution and to follow the steps on IdentityTheft.gov. If your Social Security number or ITIN was stolen, report it to IdentityTheft.gov and to the IRS, consider reporting to your state tax agency, get an Identity Protection PIN and set up your own IRS online account. If someone filed a return in your name, submit Form 14039, the Identity Theft Affidavit.

The CRA says to report fraud to your local police and the Canadian Anti-Fraud Centre, and to use its report a scam or identity theft page; contact the CRA as soon as possible if you suspect unauthorized changes to your account. In India, contact your bank at once if you shared card or account details, change portal passwords, and follow the reporting instructions on the Income Tax Department's official website. Report IRS impersonation through the IRS report phishing page.

Cross-border patterns to watch

• A caller claims to be from the IRS and says you owe tax because of an Indian or Canadian account. Real IRS contact about foreign accounts arrives by mail; see IRS foreign reporting penalties.
• A "CRA refund" text to a US resident who has not filed a Canadian return.
• A fake Indian notice about a high-value transaction asking for an immediate payment link; check the portal and your Annual Information Statement.
• A letter that looks like it comes from a government tax office but asks you to pay "to avoid deportation." The CRA says it never threatens deportation or arrest.

A worked example

Sunita lives in Aurora and receives a text: "IRS: confirm your refund, tap here." She knows she did not opt in to IRS texts. She does not tap the link, searches the notice type on irs.gov, signs in to her online account and finds no refund notice. A day later a caller claiming to be the CRA says her mother's Canadian account is frozen and demands a gift card payment. Sunita hangs up because the CRA never takes gift cards. She sends both items to her family's tax advisers, who confirm nothing was due. These facts are hypothetical.

Mistakes to avoid

• Calling the number printed in the message instead of one you looked up.
• Paying first and checking later.
• Sharing a PAN, SSN, SIN or bank login to "verify" a refund.
• Ignoring a real notice because it looks like a scam. Verify it through your account instead.
• Assuming your own tax preparer sent an email without checking.

How we can help

If a letter claims to be from the IRS or Illinois Department of Revenue, we can check it against your account with a signed authorization and reply if it is genuine. Based in the Aurora, Illinois area, we handle the U.S. side and coordinate with your Canadian CPA or Indian Chartered Accountant to verify CRA and Indian Income Tax Department communications. See IRS and state tax representation, our response checklist and authorized representatives. Browse the notices hub for every guide in this series.

Frequently asked questions

General information only. It is not tax, legal, accounting or immigration advice for your situation, and rules change; confirm the current rules with the official source or a licensed professional in the relevant country.