TLDR
The IRS 2026 Dirty Dozen list, released March 5-6, explicitly calls out smishing (SMS phishing) as a top threat during tax season. ScamVerify™ data shows 684,045 FTC impersonation complaints, and tax-related text scams are surging between January and April. AI-generated phishing has grown 14x, from 4% to 56% of all reported attacks. Scammers send fake "refund approved" texts, QR codes linking to counterfeit IRS sites, and "verify your identity" messages designed to harvest Social Security numbers. The IRS has one absolute rule: it never initiates contact by text message.
The 2026 Dirty Dozen: Smishing Gets Top Billing
The IRS publishes its Dirty Dozen list annually to warn taxpayers about the year's most dangerous tax scams. The 2026 edition, published March 5-6, puts smishing front and center alongside these related threats:
| Dirty Dozen Category | Text Scam Connection | Risk Level |
|---|---|---|
| Smishing/phishing | Direct: fake IRS texts with malicious links | Critical |
| QR code phishing | Fake QR codes in texts linking to IRS login clones | Critical |
| Identity theft refund fraud | Texts harvest SSNs used to file fraudulent returns | High |
| Fake tax preparers | Promoted through scam texts and social media | High |
| "Ghost" preparers | Texts offering cheap tax prep with no signature | Medium |
This is not the first year smishing made the list. But 2026 marks the first time the IRS highlighted QR code phishing as a specific text-based attack vector, reflecting a shift in how scammers deliver malicious payloads through SMS.
Why Tax Season Is Peak Scam Season
Tax season creates a perfect storm for text scammers. 155 million individual returns are filed between January and April. During that window, Americans are actively expecting communications about refunds, payments, and filing status. A text that says "Your refund has been approved" feels plausible in March. In August, the same text would raise immediate suspicion.
ScamVerify tracks 8 million+ threat records across FTC, FCC, URLhaus, and ThreatFox databases. The data shows clear seasonal spikes:
| Month | Tax Scam Activity | Why It Spikes |
|---|---|---|
| January | High | W-2 distribution, early filers |
| February | Very High | Peak filing period begins |
| March | Peak | Dirty Dozen publicity, refund expectations |
| April | Very High | Deadline pressure, "last chance" urgency |
| May-December | Low-Moderate | Audit threats, amendment scams |
What These Scam Texts Look Like
Fake Refund Approval Texts
"IRS Notice: Your 2025 tax refund of $4,218.00 has been approved. Confirm your direct deposit details to receive payment within 48 hours: [malicious-link]"
"IRS.gov Update: Refund held due to verification error. Submit your SSN and bank routing number to release funds: [malicious-link]"
These texts work because the dollar amounts are specific and plausible. Scammers pull average refund data from public IRS statistics to make the numbers convincing. The IRS reported an average refund of $3,167 in 2025, so amounts between $2,500 and $5,000 feel realistic to most recipients.
QR Code Tax Scam Texts
"IRS: Scan below to verify your 2025 return status. Immediate verification required to release your refund. [QR code image]"
QR code phishing has become particularly dangerous for three reasons. First, the IRS itself started using QR codes on legitimate paper correspondence in 2025, training taxpayers to associate QR codes with the IRS. Second, QR codes hide the destination URL, so you cannot preview where the link goes before scanning. Third, most carrier spam filters cannot read QR code images embedded in MMS messages, allowing these texts to bypass automated detection.
Identity Verification Texts
"IRS Identity Protection: Unusual activity on your tax account. Verify your identity within 24 hours or your return will be suspended: [malicious-link]"
These texts create artificial urgency. The 24-hour or 48-hour deadline is designed to override critical thinking. In reality, the IRS provides weeks or months for identity verification and always initiates the process through U.S. mail, never text.
The Numbers Behind Tax Scam Texts
| Metric | Value | Source |
|---|---|---|
| FTC impersonation complaints | 684,045 | FTC Consumer Sentinel |
| AI-generated phishing share | 56% of all attacks | SlashNext 2026 |
| AI phishing growth rate | 14x surge (4% to 56%) | SlashNext |
| IRS identity theft cases (2024) | 294,138 | IRS Data Book |
| Tax fraud losses (annual) | $5.7 billion | Treasury Inspector General |
| Average fraudulent refund claimed | $7,000-$10,000 | IRS Criminal Investigation |
| ScamVerify threat records | 8 million+ | ScamVerify database |
The 14x surge in AI-generated phishing is the most alarming trend. AI tools now produce scam texts that are grammatically perfect, use IRS-specific terminology accurately, and reference real filing deadlines and refund amounts. The days of spotting scams by looking for typos are over.
The IRS Golden Rule: They Never Text First
The IRS has stated this clearly and repeatedly: the IRS does not initiate contact with taxpayers by text message, email, or social media to request personal or financial information.
This single rule eliminates every tax-related scam text. If you receive a text claiming to be from the IRS, it is a scam. No exceptions.
How the IRS actually communicates:
- U.S. Mail: Primary and preferred method for all official notices
- IRS.gov online account: Refund status at irs.gov/refunds only
- IRS2Go mobile app: Official app for refund tracking (Apple App Store and Google Play only)
- Phone (IRS-initiated): Extremely rare, only after multiple mailed notices go unanswered
- Text, email, social media: Never. Under any circumstances.
How to Protect Yourself During Tax Season
- Ignore any text claiming to be from the IRS. The IRS does not text. Period.
- Check refund status at irs.gov/refunds only. Type the URL directly, never follow a link from a text or email.
- Never scan QR codes from texts or emails claiming to be the IRS. Legitimate IRS QR codes appear only on paper mail.
- Forward suspicious texts to 7726 (SPAM) to report them to your carrier.
- Report to the IRS by forwarding scam texts and emails to phishing@irs.gov.
- File with the FTC at reportfraud.ftc.gov to add the scam to the national database.
- Verify suspicious texts at the ScamVerify text checker before taking any action.
If you already clicked a link or entered information, the damage control steps are critical. File IRS Form 14039 (Identity Theft Affidavit). Place a fraud alert with all three credit bureaus (Equifax, Experian, TransUnion). Monitor your IRS account at irs.gov for unauthorized filings.
For a deeper dive into IRS-specific text scam patterns, see our IRS tax refund scam texts guide. For the phone call version of these scams, read our IRS phone scam explainer.
Analyze a suspicious text
Paste the text message you received for instant AI-powered scam analysis.
FAQ
Can the IRS really text me about my refund?
No. The IRS has confirmed it never sends unsolicited text messages to taxpayers. This applies to refund notifications, payment demands, identity verification requests, and any other tax-related communication. The only way to check your refund status is through irs.gov/refunds, the IRS2Go app, or by calling 1-800-829-1954.
What makes the 2026 Dirty Dozen different from previous years?
The 2026 Dirty Dozen, released March 5-6, is the first edition to explicitly highlight QR code phishing as a text-based attack vector. Previous editions mentioned smishing generally, but the QR code emphasis reflects the rapid growth of this technique after the IRS began using QR codes on legitimate paper correspondence in 2025. The list also warns about AI-enhanced phishing for the first time.
I received a text about a tax refund. How do I know if it is really from the IRS?
It is not from the IRS. The IRS never initiates contact by text message. Any text about a tax refund, payment, or identity verification is fraudulent. Do not click any links or scan any QR codes. Forward the text to 7726, report it to phishing@irs.gov, and check the message at the ScamVerify text checker.
What should I do if I already entered my Social Security number on a fake IRS site?
File IRS Form 14039 (Identity Theft Affidavit) immediately. Contact the IRS Identity Protection Specialized Unit at 1-800-908-4490. Place fraud alerts with Equifax (800-525-6285), Experian (888-397-3742), and TransUnion (800-680-7289). File a report with the FTC at identitytheft.gov. Monitor your IRS account online for any unauthorized tax filings.
Are QR codes from the IRS ever legitimate?
Yes, but only on official paper correspondence mailed to your physical address. The IRS began including QR codes on some mailed letters in 2025 to help taxpayers access online resources. The IRS never sends QR codes via text message, email, or social media. If you receive a QR code in a text claiming to be from the IRS, it is a scam.
