What the fake refund message looks like
Scammers send a message that looks official. It may read: "You have been approved for a tax refund of Rs 15,490. The amount will be credited to your account number 5xxxxx6755. If this is not correct, please update your bank account information by visiting the link below."
The sender ID often mimics the Income-Tax Department and includes a short link such as tax-update[.]top.
How the scam works and what they want
When you tap the link you are taken to a fake portal that asks for full bank-account number, IFSC, one-time password, PAN, Aadhaar or even a credit-card PIN. The information is captured in real time.
The fraudster then uses the bank details to move money, the OTP to complete unauthorized transactions, and the identity documents to open new accounts or commit identity theft.
Warning signs to identify the scam
Unsolicited SMS about a refund you did not expect is a primary red flag.
Requests for PIN, OTP, password, PAN, Aadhaar, or a link that says you must “update now” or “verify within 30 minutes” are warning signs. Shortened or unfamiliar URLs such as tax-update[.]top are also suspicious.
The official Income-Tax Department never asks for any of those details via SMS, email or phone.
What to do if you receive such an SMS
Do not click the link. Open a browser and log in directly at incometax.gov.in, the official e-filing portal, to check your refund status.
Forward the entire SMS as you received it to [email protected] and [email protected]. Then file a complaint on cybercrime.gov.in or visit your nearest cyber-crime cell.
Block the sender’s number, change any passwords or OTPs that may have been shared, and call your bank using the number printed on your card or in the bank’s official app to freeze the account if needed.
You can also report the SMS on Chakshu at sancharsaathi.gov.in. If you lost money, call the national cyber fraud helpline 1930 straight away.
If you have already shared details or clicked the link
Contact your bank immediately, request a block on the account or a new card, and inform them about the compromised details.
Change your online banking passwords, enable transaction alerts, and reset any mobile-linked OTP services that may have been exposed.
File a police FIR and keep the reference number for follow-up. Monitor your credit reports and the Aadhaar portal for any unauthorized activity.
Questions
Does the Income Tax Department send refund messages via SMS?
It can send updates about your return or refund to your registered mobile number and email. But it never asks you to click a link to update bank details, and never asks for your PIN, OTP, password, PAN, Aadhaar or bank customer ID. Check any refund yourself by logging in at incometax.gov.in.
How can I safely check my tax refund status?
Type incometax.gov.in into your browser yourself and log in to the e-filing portal. Do not use any link received in an unsolicited SMS.
Where do I report an income tax refund SMS scam in India?
Forward the SMS to [email protected] and [email protected]. File a complaint on cybercrime.gov.in or at your local cyber-crime cell, call the helpline 1930, and report on sancharsaathi.gov.in.
Is it safe to click the short link in the message?
No. Scammers use shortened or unfamiliar URLs to hide the destination. Clicking the link leads to a fake portal that harvests your personal and banking details.