Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- Tax scams are turning many people into victims.
- Protect yourself by not responding to a tax-related call or message.
- If you’ve been victimized, report the crime and secure your accounts.
Tax season is upon us, and that means cybercriminals are busy cooking up scams designed to steal money or other sensitive information from unsuspecting taxpayers. Thanks to AI, falling for this type of scam may be easier than you think, at least according to the folks at technology specialist McAfee.
Also: The best tax software for a stress-free tax season
Released on Tuesday, McAfee’s 2026 Tax Season Survey sheds light on how tax scams work, how they reach people, and who’s getting hit the hardest. The survey also offers several tips on how to avoid such scams and how to respond if you’re ever a victim.
The average loss is $1,020
A hefty 82% of Americans said they’re concerned about tax fraud this season, with many seeing just as many, if not more, scammy messages this year than last. Some 40% believe that scam messages are more sophisticated now than last year, with most people worried that AI is making these scams more realistic.
More than 30% of those polled said they’ve been contacted by someone claiming to be from the IRS or another tax authority. As scammers use all available tools, the initial notification can arrive by phone, email, or text. With emails and texts, almost 40% of the respondents said they were asked to click a link or send a payment.
Also: 5 ways AI can help you do your taxes – and 10 tax tasks you shouldn’t trust it with
Tax scams are turning many people into victims. Some 23% of those surveyed said they’ve fallen for a tax scam. That percentage rises even higher for those in the 18-24 age range to a whopping 42%. More than 10% of those polled said they were hit by tax-related identity theft. Almost 20% of the respondents said they’ve lost money to a tax scam, with the average loss hitting $1,020.
Malicious websites
Scammers are also busy creating malicious websites to play out the con beyond the initial call or message. And that ploy doesn’t wait for tax season. Between Sept. 1, 2025, and Feb. 19, 2026, McAfee found 1,468 malicious or suspicious tax-themed unique domains, an average of 43 new fake tax websites every day. In early November alone, the average number of these malicious domains almost doubled in just over a week.
In devising these sites, the scammers try to mimic the look of the actual IRS website or other official government sites. To trick people, the crooks may include misleading subdomains on the page or create additional text around the URL IRS.gov. These phony sites are designed to capture your login credentials, steal your social security number or tax ID, snag your payment details, and even charge fraudulent processing fees. In some cases, McAfee found scammers who wanted to charge people $319 to file for an EIN (Employer Identification Number), something the IRS offers for free.
Also: How to file your taxes for free in 2026 – 4 ways to do it (despite Direct File’s demise)
Tax scammers typically kick things off with a hook to get your attention. They may tell you that there’s a tax issue, such as a refund problem, underpayment, or verification trouble. Next, they’ll assert their alleged authority by claiming to be from the IRS or a state tax authority. They could even provide certain personal details about you that they may have found through social media or a data breach.
From there, they’ll usually provide a link to a “secure portal” or “refund page.” That site will then ask for your login credentials, social security number, bank information, or even details from a previous return. Next, they apply pressure by demanding payment to avoid penalties or fix a mistake. If you don’t comply, they’ll amp up the threat by vowing to contact law enforcement.
If you fall for the con and make a payment, you may realize it was a scam only after finding a strange charge or noticing unexpected login activity.
How to protect yourself
To protect yourself from such scams in the first place, McAfee offered the following tips:
- Don’t engage with a tax-related call, an email, or a text. Instead, head directly to the IRS website (IRS.gov) or your state’s tax agency site to investigate further.
- Ask for a written notice about the alleged tax refund or penalty.
- Never click the link in a text or an email. Again, head to the IRS or state agency website directly.
- If you land on a page that looks legitimate, stop and verify. Even with AI-infused websites, you can often spot mistakes.
- Remember that the IRS never asks for payment by phonecalls, emails, or texts. And the agency won’t ask you to pay a tax penalty through a gift card or cryptocurrency.
Have you already been hit? Do this now
OK, but what if you ever do fall victim to a tax scam? Here, McAfee also had some words of advice.
Also: 5 ways AI can help you do your taxes – and 10 tax tasks you shouldn’t trust it with
Stop replying to the scammer. Don’t click on links or attachments in any follow-up texts or emails. Don’t send any more information or money.
Take screenshots of the phone numbers, email addresses, usernames, the content of the message, any links, and any payment receipts or transaction IDs.
Also: This is the best money management app I’ve tested
Lock down your accounts, especially the one for email. If a scammer manages to infiltrate your email, they may be able to reset the passwords for other accounts. Change the password for your email account as well as the ones for your banking and tax accounts. Turn on two-factor authentication (2FA) for sensitive accounts. Also, change any passwords that you’ve reused across multiple accounts.
Report the scam. File a report with the FTC. Contact your bank or credit card company to alert them to the theft. Forward the initial phishing email to the IRS at phishing@irs.gov.
Consider signing up for a data removal service that can identify where your information has been leaked and how to delete it.
Make sure you’re protected against further attacks. The right security software should warn you about malicious websites before you enter any personal information. McAfee offers a free tool called McAfee WebAdvisor.
Also: No, the IRS didn’t text or email you – 3 ways to protect yourself from scams
Use anti-spam features or apps that can block or warn you about suspicious calls and texts. Look into an identity monitoring service that can alert you if your personal details are leaked online.
Finally, run a virus scan on your PC to make sure no malware has been installed. If you don’t already have security software, you can find several free antivirus programs.
