Fake Income Tax Refund Alert Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: CRITICAL | View Full Scam Details

Beware the Fake Income Tax Refund Alert Scam in India 2026: Stay Safe from UPI and KYC Phishing Threats

Millions of Indians eagerly wait for their income tax refunds, but scammers are exploiting this by sending fake refund alerts that steal your money and personal data.

What Is the Fake Income Tax Refund Alert Scam?

The Fake Income Tax Refund Alert Scam is a critical cybercrime hitting taxpayers in India, especially during the tax filing season. Scammers send fraudulent messages—often by SMS, email, or WhatsApp—that claim you are eligible for an income tax refund. These messages look official, mimicking the Income Tax Department or banking institutions to trick you into clicking malicious links or sharing sensitive details like your Aadhaar, PAN, or UPI PIN.

This scam targets working professionals, self-employed individuals, and anyone expecting a tax refund. It exploits the trust Indians place in official government communication. Recent waves of complaints have risen sharply across India in 2025 and early 2026, with several victims losing money via UPI payments or sharing KYC data that enables identity theft.

The Indian Computer Emergency Response Team (CERT-In) and the Indian Cyber Crime Coordination Centre (I4C) have flagged this scam as a high-risk threat, urging citizens to be vigilant. The Reserve Bank of India (RBI) has also warned about phishing scams linked to UPI transactions and personal data compromises during tax season.

How This Scam Works — Step by Step

1. Initial Contact: You receive a sudden SMS, email, or WhatsApp message claiming you have an “Income Tax Refund” pending. The message often includes a refund amount in INR and an urgent call to action like “Claim now” or “Verify your details to get the refund immediately.”
2. Phishing Link: The message contains a URL that looks genuine but leads to a fake Income Tax or bank website designed to harvest your credentials such as PAN, Aadhaar number, date of birth, and UPI PIN.
3. Fake Verification: You are asked to complete a “verification process” by entering KYC details or linking your UPI to receive the refund.
4. Data Theft and Money Withdrawal: Once you share your details and UPI PIN, scammers use this information to enable unauthorized transactions—transferring money directly from your bank accounts via UPI apps like Google Pay or PhonePe.
5. Further Spread: The scam often uses WhatsApp to spread to your contacts, who may trust the link since it believes it’s coming from you.

The scam thrives on psychological pressure, making you feel you must act fast or lose your refund, which pushes people to overlook security.

Real Warning Signs to Watch For

• Messages from unofficial or overly complicated URLs, not matching official Income Tax or government domains (.gov.in).
• Requests for personal information or KYC data via links or messages without prior official intimation.
• Urgent language pushing you to act immediately (“Claim refund in 24 hours”).
• Messages asking for UPI PIN, OTP, or bank account passwords—official agencies never ask for these.
• Poor grammar, spelling mistakes, or inconsistent formatting in messages.
• Unexpected messages on WhatsApp or SMS about refunds when you have not checked your tax filing status.
• Links that redirect you to unfamiliar apps or websites seeking app installation or personal detail uploads.

What Happens to Victims

Falling prey to this scam often leads to immediate financial loss through unauthorized UPI transfers. Unlike credit or debit cards, UPI payments typically cannot be reversed once completed, making stolen funds difficult to recover.

Beyond the financial damage, victims face severe emotional distress—from anxiety to mistrust of digital financial services. Many have reported identity theft cases where Aadhaar and PAN details were misused later to create fake bank accounts or avail loans fraudulently.

Victims also face the hassle of SIM swap scams, where fraudsters take control of mobile numbers linked to their bank accounts, further escalating financial risks.

What RBI and CERT-In Say

The Reserve Bank of India regularly issues advisories warning the public about phishing scams linked to UPI and online banking, especially around tax season. RBI emphasizes never sharing UPI PINs or OTPs with anyone and recommends verifying sources before clicking on any links requesting financial information.

CERT-In advises users to report suspicious messages immediately to the National Cyber Crime Reporting Portal and avoid sharing KYC data via unofficial channels. The Ministry of Home Affairs, through I4C, coordinates swift action against such digital frauds, urging vigilance and collaboration among internet users.

For assistance, the government recommends calling the cybercrime helpline number 1930 or the RBI helpline for banking frauds.

How to Protect Yourself

1. Verify Official Sources: Always check your income tax refund status only on the official Income Tax Department website or app, not via links received in messages.
2. Avoid Clicking Unknown Links: Never click links from unknown or suspicious senders. Type the official website URL manually.
3. Never Share UPI PIN or OTP: No legitimate agency will ask for your UPI PIN, OTP, or password via SMS, email, or calls.
4. Use App Notifications: Download and use the official Income Tax or banking apps for notifications.
5. Enable Two-Factor Authentication: Protect your bank and UPI apps with two-factor authentication or biometric locks.
6. Check Sender Details: Inspect sender phone numbers or email addresses carefully for authenticity.
7. Report Immediately: If you receive such messages, report them to CERT-In and do not forward them on WhatsApp or social media.

What to Do If You’ve Been Targeted

• Immediately block and report the sender number or email.
• Contact your bank’s customer care to freeze or block UPI transactions temporarily.
• Change passwords and PINs of your bank and UPI apps without delay.
• File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in.
• Call the cybercrime helpline number 1930 for guidance.
• Inform your mobile operator to watch for SIM swap attempts and secure your SIM.
• Report to the Income Tax Department via their official grievance channels.

Frequently Asked Questions

Q: How can I confirm if my income tax refund message is genuine?
A: Genuine refund alerts come only from official sources like NSDL or the Income Tax Department’s verified communication channels. Always cross-check by logging into your e-Filing account directly without clicking on links in unsolicited messages.

Q: What should I do if I accidentally shared my UPI PIN or OTP?
A: Immediately contact your bank to block all online transactions, change your UPI PIN and passwords, report the fraud to the cybercrime helpline 1930, and file a complaint on cybercrime.gov.in.

Q: Can I get my money back if the scammers withdraw using UPI?
A: UPI transactions are mostly irreversible. Your best option is to notify your bank promptly and report the fraud to law enforcement. Early reporting increases chances of recovery but there is no guaranteed refund.

The Fake Income Tax Refund Alert Scam is hitting thousands across India with devastating impact in 2026. Stay alert, verify all refund messages through official channels, and never share your UPI PIN or personal identification over SMS, WhatsApp, or email. When in doubt, verify suspicious messages and links only at BharatSecure.app — your trusted partner in digital fraud protection.