The Identity Vault

Kathryn Jones — Founder, The Identity Vault

Kathryn built The Identity Vault to stop scams before they happen. Updated April 2026.

IRS impersonation is one of the most common — and most convincing — forms of identity theft in the United States. Every year, millions of people receive fraudulent calls, texts, and emails from criminals pretending to be the IRS. Many don’t realize they’re being scammed until serious damage has already been done.

The financial loss is real. But what tends to follow — months of untangling your credit, the stress of proving you didn’t file a return you’ve never seen, the exposure of personal information you can’t take back — can be even more disruptive than the initial hit.

Understanding how these scams operate is the most effective form of prevention. Once you know the patterns, they’re hard to miss.

Why IRS Scams Are Getting More Sophisticated

Scammers aren’t guessing anymore. Many are working from data — your name, address, and in some cases partial SSNs — purchased from previous data breaches. That’s what makes modern IRS scams feel so convincing. The caller already knows who you are before you say a word.

Three tools make these scams particularly effective right now:

• Data breach information that gives scammers real personal details to reference during calls
• Caller ID spoofing technology that makes calls appear to come from legitimate IRS phone numbers
• AI-generated scripts that sound calm, professional, and completely authoritative

The psychological playbook is consistent: create fear (“you owe back taxes”), add urgency (“this must be resolved today”), and invoke authority (“this is the IRS”). Taken together, these three levers push people into making fast decisions they’d never make with time to think.

The Most Common IRS Scams Right Now

The IRS Phone Call Scam

You receive a call from someone claiming to be an IRS agent. They tell you that you owe back taxes — sometimes citing a specific dollar amount — and warn that a warrant will be issued if you don’t pay immediately. The urgency is deliberate. The real IRS always sends written notice before making any phone contact. If you owe taxes, there will be letters first.

IRS Email Phishing

A professionally designed email arrives asking you to verify your identity or claim a refund. The link leads to a site that looks identical to IRS.gov but isn’t. Any information you enter goes directly to the scammer. The IRS does not initiate contact via email — if you receive an unsolicited email claiming to be from the IRS, forward it to phishing@irs.gov and delete it.

The Fake Refund Scam

The caller tells you there’s been an error and you’re owed a refund. They just need your bank account number to process it. This is a social engineering attack designed to harvest your banking credentials. No refund exists — only a pathway into your finances.

The Arrest Warrant Scam

Among the most aggressive variations. The caller claims that law enforcement is already on the way and that immediate payment is the only option to stop an arrest. The goal is to bypass rational thinking entirely through panic. No legitimate government agency — including the IRS — demands immediate payment under threat of arrest without prior written notice.

A Real Scam, Reconstructed

A taxpayer received a call from someone who identified themselves as an IRS agent. The caller referenced the taxpayer’s full name and home address — details that made the call feel completely legitimate. They claimed there was an irregularity with a prior year filing and demanded immediate payment via gift card to avoid legal action. The taxpayer nearly complied. What stopped them was one question: “Can I call the IRS directly to confirm?” The caller hung up immediately.

That detail — the caller knowing their name and address — is what makes modern scams so effective. The information was real. The agent was not. Scammers purchase stolen data from breach marketplaces for as little as a few dollars per record.

How to Recognize an IRS Scam

The IRS has clear, consistent policies about how it communicates with taxpayers. Once you know them, scams become obvious. The IRS will never:

• Call you before first sending written notice in the mail
• Demand immediate payment, especially on a first contact
• Request payment via gift cards, wire transfer, or cryptocurrency
• Ask for your full Social Security number over the phone
• Threaten arrest, deportation, or license revocation on an initial call
• Send emails or texts asking you to click a link to verify information

Any contact that violates these norms — regardless of how official it sounds, regardless of what the caller ID shows — is a scam.

What to Do If You’re Targeted

If you receive a suspicious call, text, or email claiming to be from the IRS, the response is the same regardless of how convincing it seems:

1. Hang up or close the message without engaging further
2. Do not call back any number the caller or message provided
3. Verify directly by calling the IRS at 1-800-829-1040 or visiting IRS.gov
4. Report the scam to the Treasury Inspector General at 1-800-366-4484
5. File a report at ReportFraud.ftc.gov
6. Monitor your credit and financial accounts for unusual activity over the following weeks

The key is to act through official channels rather than responding to the contact itself. Engaging with scammers — even to argue — gives them more information and more time.

What to Do If You’ve Already Been Scammed

If you shared personal or financial information with a scammer, time matters. The faster you act, the more damage you can limit. Here’s the order that matters most:

1. Freeze your credit at all three bureaus immediately. Go directly to Equifax, TransUnion, and Experian. This is free, takes about 15 minutes total, and prevents anyone from opening new accounts in your name — even with your full SSN.
2. Request an IRS Identity Protection PIN. A six-digit code that must accompany any tax return filed with your SSN. Without it, fraudulent returns are rejected. Enroll at IRS.gov/ippin.
3. Update your email and financial account passwords. Start with your primary email — it’s the recovery method for everything else. Enable two-factor authentication using an authenticator app, not SMS.
4. Enable two-factor authentication on all financial accounts. Banks, investment accounts, and retirement platforms should all have this turned on.
5. Monitor all accounts daily for at least 30 days. Set up real-time transaction alerts. Check your credit reports at AnnualCreditReport.com.
6. File a report at IdentityTheft.gov. The FTC’s recovery tool generates a personalized recovery plan and documentation you may need later.

The Longer View: Prevention Over Reaction

Protecting yourself from IRS scams isn’t just about knowing how to respond after something goes wrong. It’s about building the kind of layered protection that makes you a much harder target in the first place.

Three protections work together to block the most common IRS fraud attack vectors:

• IRS Identity Protection PIN — prevents anyone from filing a tax return with your SSN without the six-digit code you generate each January
• Frozen credit files — stops new accounts from being opened in your name even if a scammer has your full SSN, name, and date of birth
• Locked Social Security account — blocks electronic access to your SSA record at SSA.gov, preventing benefit fraud

Your personal information is already out there — data breaches have made that unavoidable for most people. What you can control is how much damage can be done with it. These three steps close the doors scammers most commonly walk through.