Recognizing Scam Notices vs. Genuine IRS Correspondence

Why this matters

Scammers impersonating the Internal Revenue Service aim to steal money and sensitive information. Falling for an impersonation scam can lead to drained bank accounts, stolen identities, or fraudulent tax filings. Knowing how the IRS actually communicates and the verification steps to take reduces risk and saves time when a real notice requires action.

This article condenses practical, field-tested checks I use with clients to separate legitimate IRS correspondence from scams and shows how to respond safely if you receive either.

How the IRS normally contacts taxpayers (and what it won’t do)

• The IRS usually initiates contact through the U.S. Postal Service. Initial contact about an issue with your account or return is typically a mailed notice, not an email, text, or unsolicited phone call (IRS guidance).
• The IRS may call, email, or text only after you’ve given consent through established channels (for example, when you sign up for certain services). However, unsolicited messages demanding money or personal information are red flags.
• Official IRS notices include a notice or letter number (for example, CP2000, CP14, or CP504), explain the issue, state actions required and deadlines, and provide verifiable contact instructions or a reference to irs.gov.

(Source: IRS consumer alerts and impersonation scam pages.)

Common red flags of scam notices

• Calls, emails, or texts that demand immediate payment, threaten arrest, deportation, or license suspension, or insist on payment via gift cards, prepaid debit cards, wire transfer, or cryptocurrency.
• Messages that ask for full Social Security numbers, bank account numbers, or other sensitive credentials over the phone or by email without prior verification.
• Email senders that use free webmail accounts (gmail.com, yahoo.com) or domains that look like the IRS but aren’t exactly irs.gov.
• Poor spelling and grammar, generic greetings (“Dear Taxpayer”), or emotional pressure to act now.
• Caller ID spoofing that shows “IRS” — Caller ID can be faked.

If you notice any of the above, treat the contact as suspicious until verified.

Step-by-step verification process (what I tell clients)

1. Pause and do not click links or call numbers provided in the suspicious message.
2. Check whether you recently filed taxes, owe taxes, or are expecting a notice. The IRS generally sends a notice or letter before taking enforcement action.
3. Identify a notice or letter code on the document (e.g., CP2000, CP503). Search that exact notice code on irs.gov to confirm the content and the IRS’s stated process. If you want practical help decoding a notice, see our guide: Decoding Your IRS Notice: A Step-by-Step Guide (https://finhelp.io/glossary/decoding-your-irs-notice-a-step-by-step-guide/).
4. If the correspondence claims to be an IRS notice, compare the mailing address and return address to known IRS office formats (found on irs.gov). Genuine IRS letters come from IRS offices and include official formatting; scammers often use short or non‑government return addresses.
5. Use the contact information on irs.gov (not the contact info supplied in the suspicious message) to call or verify the notice. Our article How to respond to an IRS notice explains safe response steps (https://finhelp.io/glossary/how-to-respond-to-an-irs-notice/).
6. If the message is an email, forward suspected phishing emails to the IRS at the reporting address listed on IRS.gov and do not forward attachments to others.

If the notice is genuine: immediate next steps

• Read the notice fully to understand the issue, the deadline, and the action requested. IRS notices typically explain the reason (e.g., underreported income on a CP2000) and how to respond.
• If you agree with the IRS’s findings, follow the instructions for payment or correction. If you disagree, follow the instructions for disputing the notice; for practical dispute steps see How to Dispute an IRS Notice (https://finhelp.io/glossary/how-to-dispute-an-irs-notice/).
• Keep copies of all correspondence and document any calls you make to IRS using the verified phone number on irs.gov.

If you suspect a scam: reporting and mitigation

1. Report impersonation scams to the Treasury Inspector General for Tax Administration (TIGTA) and to the IRS using the reporting channels on irs.gov.
2. If you gave account numbers or tax information, notify your bank and credit-card companies immediately and consider placing a fraud alert or credit freeze by contacting the three major credit bureaus. (FTC and IdentityTheft.gov recommend these steps.)
3. If your Social Security number was exposed, file an identity-theft report with the FTC at IdentityTheft.gov and follow their recovery plan.
4. Report phishing emails to the IRS as instructed on the IRS website (do not follow links in the phishing email when reporting).

Real-world examples and lessons

• Client example (phone scam): A client received a high-pressure phone call claiming to be from the IRS demanding immediate payment by gift card. The caller used an urgent, aggressive tone and insisted on secrecy. We confirmed the call was fraudulent: the IRS does not demand gift cards for payment and initial contact is typically by mail. The client reported the call and avoided financial loss.

• Client example (official-looking letter): Another client received a letter that looked official but contained a suspicious return address and lacked a proper notice code. We verified by looking up the notice code and calling IRS contact information from irs.gov; it turned out to be a scam printed to look like official correspondence. The client reported the incident and took no action on the letter.

These real-life cases show why verification and calm, methodical checks matter.

Frequently asked quick checks (decision checklist)

• Did you get a mailed letter with a notice number? Higher chance it’s legitimate.
• Does the sender ask for payment via gift card, wire transfer, or cryptocurrency? Always a scam.
• Does the message pressure you to act immediately and threatens legal action? Red flag—verify through official IRS channels.
• Is the domain in an email exactly irs.gov? If not, suspicious.

What to do if you already paid or shared information

• Contact your bank and card issuers immediately to stop payments and request reversals when possible.
• Change passwords on any accounts that may have been exposed and enable multi‑factor authentication (MFA).
• Contact the three major credit bureaus to place fraud alerts or freezes.
• File a report with the FTC (IdentityTheft.gov) and report the incident to the IRS and TIGTA so they can document the impersonation attempts.

Practical prevention tips (ongoing)

• Use secure, unique passwords and MFA for accounts that store tax records or financial information.
• Shred paper mail with personal data.
• Educate household members (especially older adults) about phone and email scams; scammers intentionally target people who may be less skeptical.
• Sign up for IRS tools (for example, access to your online IRS account) only through irs.gov.

Professional disclaimer

This content is educational and reflects common practices used in tax advising. It is not legal or tax advice specific to your situation. For personalized guidance, consult a licensed tax professional or attorney.

Authoritative resources

• IRS: official consumer alerts and guidance on impersonation scams (irs.gov)
• Treasury Inspector General for Tax Administration (TIGTA) — reporting IRS impersonation scams (tigta.gov)
• Federal Trade Commission (IdentityTheft.gov) — steps to take after identity theft (identitytheft.gov)
• Consumer Financial Protection Bureau (consumerfinance.gov) — consumer guidance on scams and fraud prevention

Internal resources on FinHelp.io:

• Decoding Your IRS Notice: A Step-by-Step Guide — https://finhelp.io/glossary/decoding-your-irs-notice-a-step-by-step-guide/
• How to respond to an IRS notice — https://finhelp.io/glossary/how-to-respond-to-an-irs-notice/
• How to Dispute an IRS Notice — https://finhelp.io/glossary/how-to-dispute-an-irs-notice/

By applying the verification steps above and using the authoritative reporting channels, you can quickly separate scams from legitimate IRS correspondence and respond appropriately.