TLDR
The IRS released its 2026 Dirty Dozen list on March 5-6, and smishing (SMS phishing) is once again a top threat. Tax-related scam texts spike dramatically between January and April each year, with fake refund status messages, QR codes linking to phishing sites, and "verify your identity" texts designed to steal Social Security numbers. ScamVerify™ tracks these attacks in real time. The IRS has one absolute rule: it never initiates contact with taxpayers via text message, email, or social media.
The IRS Dirty Dozen 2026: What Changed
The IRS publishes its Dirty Dozen list annually to warn taxpayers about the most prevalent tax scams. The 2026 list, released March 5-6, highlights several text-based threats:
- Smishing attacks impersonating the IRS with fake refund notifications
- QR code phishing directing victims to fake IRS login pages
- Fake tax preparer scams promoted through text and social media
- Identity theft refund fraud fueled by stolen personal data
- "Ghost" tax preparers who refuse to sign returns
The inclusion of QR codes is notable. In 2025, the IRS itself began using QR codes on legitimate paper correspondence to link taxpayers to online resources. Scammers immediately exploited this by embedding malicious QR codes in text messages, knowing that recipients had been trained to scan IRS QR codes.
What IRS Scam Texts Look Like
Fake Refund Status Texts
"IRS Notice: Your 2025 tax refund of $3,847.00 has been approved. Verify your direct deposit information to receive payment: [fake-link]"
"IRS.gov: Refund status update. Your refund is being held due to a verification error. Confirm your SSN to release payment: [fake-link]"
QR Code Texts
"IRS: Scan the QR code below to check your 2025 refund status and verify your filing. [QR code image]"
These QR codes lead to convincing replicas of the IRS.gov website, complete with login forms that capture usernames, passwords, Social Security numbers, and bank account details. For a deeper look at how IRS phone scams work alongside these text attacks, see our IRS phone scam explainer.
"Verify Your Identity" Texts
"IRS Identity Verification: Unusual activity detected on your tax account. Verify your identity within 48 hours to prevent account suspension: [fake-link]"
"Action Required: The IRS needs to verify your identity before processing your 2025 return. Complete verification here: [fake-link]"
Tax Season Timing: January Through April Peak
Tax-related scam activity follows a predictable calendar:
| Month | Activity Level | Common Scam Types |
|---|---|---|
| January | High | "File early" scams, fake W-2 requests |
| February | Very High | Fake refund status, early filing fraud |
| March | Peak | IRS impersonation, Dirty Dozen publicity exploited |
| April | Very High | Last-minute filing pressure, "penalty" threats |
| May-December | Low-Moderate | Audit threats, back-tax scams |
The January-April window represents the highest concentration of tax-related smishing because 155 million individual returns are filed during this period. Scammers know their messages are more believable when recipients are actively expecting IRS communications.
The IRS Golden Rule: They Never Text First
The IRS has stated this clearly and repeatedly: the IRS does not initiate contact with taxpayers by text message, email, or social media to request personal or financial information. This single rule eliminates nearly all tax-related text scams.
How the IRS actually communicates:
| Method | IRS Uses It? | Details |
|---|---|---|
| U.S. Mail | Yes | Primary communication method for all official notices |
| IRS.gov online account | Yes | Refund status at irs.gov/refunds only |
| Phone (IRS-initiated) | Rarely | Only after multiple mailed notices go unanswered |
| Text message | Never | The IRS never sends unsolicited texts |
| Never | The IRS never sends unsolicited emails | |
| Social media DMs | Never | The IRS never contacts via social platforms |
QR Codes: The New Attack Vector
QR code phishing (sometimes called "quishing") has become the fastest-growing smishing technique in tax scams for three reasons:
- QR codes hide the destination URL. Unlike a text link that you can preview, a QR code reveals nothing about where it leads until you scan it.
- The IRS legitimized QR codes. Real IRS paper correspondence now includes QR codes, training taxpayers to associate QR codes with the IRS.
- QR codes bypass spam filters. Most carrier spam filters analyze text and links but cannot read QR code images embedded in MMS messages.
If you receive any QR code claiming to be from the IRS via text or email, do not scan it. Navigate directly to irs.gov in your browser instead. Understanding how to spot scam text messages is critical during tax season.
Tax-Related Fraud by the Numbers
| Metric | Value | Source |
|---|---|---|
| IRS identity theft reports (2024) | 294,138 cases | IRS Data Book |
| Tax-related fraud losses | $5.7 billion annually | Treasury Inspector General |
| Dirty Dozen list first published | 2002 | IRS |
| Individual returns filed Jan-Apr | 155 million | IRS |
| Average fraudulent refund claimed | $7,000-$10,000 | IRS Criminal Investigation |
| Smishing attacks (all types) growth | 300%+ since 2020 | FBI IC3 |
How to Check Your Real Refund Status
The only legitimate way to check your IRS refund status:
- Visit irs.gov/refunds directly (type it in your browser, never click a link)
- Use the IRS2Go mobile app (download only from Apple App Store or Google Play)
- Call the IRS refund hotline at 1-800-829-1954
You need three pieces of information: your Social Security number, filing status, and exact refund amount. The "Where's My Refund?" tool updates once daily, usually overnight.
What to Do If You Receive an IRS Scam Text
- Do not click any links or scan any QR codes
- Do not reply to the message
- Forward the text to 7726 (SPAM) to report it to your carrier
- Report the scam to the IRS by forwarding the message to phishing@irs.gov
- Report it to the FTC at reportfraud.ftc.gov
- If you clicked a link and entered information, file IRS Form 14039 (Identity Theft Affidavit)
- Verify suspicious texts at ScamVerify text checker
If you already responded to a scam text, see our guide on what to do after being scammed for step-by-step recovery instructions.
FAQ
Can the IRS really text me about my refund?
No. The IRS has confirmed it never sends unsolicited text messages to taxpayers. Any text claiming to be from the IRS about a refund, payment, or identity verification is fraudulent. The only way to check your refund status is through irs.gov/refunds, the IRS2Go app, or by calling 1-800-829-1954.
What is the IRS Dirty Dozen list?
The IRS Dirty Dozen is an annual list of the 12 most common tax scams, published every year since 2002. The 2026 list was released March 5-6 and includes smishing, QR code phishing, fake tax preparers, and identity theft refund fraud. It serves as a public awareness campaign during peak tax filing season.
Are QR codes from the IRS ever legitimate?
Yes, but only on official paper correspondence mailed to your address. The IRS began including QR codes on some mailed letters and notices to help taxpayers access online resources. However, the IRS never sends QR codes via text message, email, or social media. If you receive a QR code in a text claiming to be from the IRS, it is a scam.
What happens if I filed a tax return and someone stole my identity?
If someone files a fraudulent return using your Social Security number, the IRS will reject your legitimate e-filed return. You will need to file a paper return along with IRS Form 14039 (Identity Theft Affidavit). The IRS Identity Protection Specialized Unit can be reached at 1-800-908-4490. Resolution typically takes 120-180 days.
How do I report IRS-related text scams?
Forward the text to phishing@irs.gov (take a screenshot if forwarding is not possible). Also forward it to 7726 (SPAM) to alert your carrier. File a report with the FTC at reportfraud.ftc.gov. If you lost money or shared personal information, file a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.
