Meet Priya — 26, earning ₹11 LPA, ITR filed in July 2025. In September, she gets an email: her ₹60,000 refund is "held pending manual verification." The logo looks real. The language sounds official. She almost clicks. Here's what you need to know before you face the same situation: the Income Tax Department will never ask for your OTP, password, bank PIN, or account details via email — not once, not ever.
Run the 6-point forensic checklist below on any suspicious email, and you will never be fooled again.
Fraudsters time these attacks precisely to ITR filing season and the refund-waiting window — the exact period when anxiety is highest and your guard is lowest. Between July 2025 and March 2026 alone, at least five distinct phishing campaigns were confirmed active by PIB Fact Check and the IT Department.
In my research, the number that surprised me most was how recent and how frequent these are — roughly one new phishing variant every six weeks. This is not a 2018 problem.
Here are the five confirmed campaigns:
I've seen many young professionals in the ₹10–20 LPA range fall for the "Compliance Gaps" framing specifically — because if you have recently switched tax regimes or claimed deductions for the first time, a message suggesting your filing has gaps feels entirely plausible. If you receive this email and feel even 10% uncertain about your last filing, go directly to incometax.gov.in → e-Proceedings. Genuine compliance queries will be waiting there. If there's nothing in e-Proceedings, the email is fake — full stop.
Before walking through the checklist, here is the full picture at a glance — built exclusively from confirmed, documented examples.
| Feature | Legitimate IT Department Email | Documented Phishing Email |
|---|---|---|
| Sender domain | @incometax.gov.in or @cpc.gov.in | @incometaxindiafilling.gov.in ("filling" not "efiling") |
| DIN present? | Yes — mandatory 20-digit number | No DIN, or unverifiable number |
| Link destination | incometax.gov.in only | incometax-refund-claim.xyz (.xyz, not .gov.in) |
| What it asks for | No OTPs, passwords, or bank details — ever | OTP, bank account number, PAN confirmation |
| Regulatory authority cited | Specific section of Income Tax Act | Fabricated "RBI & PMLA norms" on ₹25,000 threshold |
| Urgency language | None — formal procedural tone | "Act within 48 hours or face penalty" |
| Refund communication | SMS from ITDEPT / ITDEFL / ITDCPC sender ID | Clickable link in email to "verify" or "claim" refund |
| Documented example | Section 143(1) intimation via CPC portal | "Refund eligible: ₹60,000 — verify now" (ET, July 21, 2025) |
What surprised me when I mapped these side by side was how deliberate the "realness" engineering is. Every element — the sender address, the regulatory language, the refund amount — is designed to pass a casual glance. The trap is in the details.
Each check takes under 30 seconds. Run them in order.
Check 1 — The Sender Domain Test
Real IT Department emails come only from these verified domains: @incometax.gov.in, @incometaxindiaefiling.gov.in, @cpc.gov.in, @tdscpc.gov.in, and @insight.gov.in. The IT Department's official Facebook post (August 13, 2025) exposed a documented fake: donotreply@incometaxindiafilling.gov.in — "filling" instead of "efiling," a single-letter difference. Look at what comes after the @ symbol — that is the only thing that matters.
Check 2 — The DIN Test
Every genuine Income Tax Department communication must contain a 20-digit Document Identification Number (DIN). This has been a mandatory requirement since CBDT Circular No. 19/2019. Any notice, letter, or order issued without a valid DIN is legally "non-est"—meaning it is treated as if it never existed. If you see a 20-digit number, don't take it at face value. Go to the incometax.gov.in homepage and use the 'Authenticate' tool under 'Quick Links' to verify that the DIN is actually registered in the department's system.
Check 3 — The Link Destination Test
Hover over any link before clicking. Real IT communications only direct to incometax.gov.in. The documented fake SMS from February 2026 directed victims to incometax-refund-claim.xyz — note the .xyz extension, which no government body uses. Paste any suspicious URL into Google Safe Browsing at transparencyreport.google.com before clicking.
Check 4 — The "What They're Asking For" Test
The official statement from incometaxindia.gov.in is unambiguous: "The Income Tax Department NEVER asks for your PIN numbers, passwords or similar access information for credit cards, banks or other financial accounts through e-mail." If any email requests your OTP, bank account number, Aadhaar, or any password — it is fake, regardless of how legitimate everything else looks.
I used to assume the "never ask for OTPs" rule was obvious — then I saw the March 2026 "Compliance Gaps" email. It doesn't ask for your OTP upfront. It asks you to log in to "review your filing errors." That login page is fake.
Check 5 — The Fake Authority and Urgency Language Test
Real IT communications cite specific sections of the Income Tax Act. They do not invent regulatory authority from other bodies. The documented July 2025 phishing email stated verbatim: "As per latest RBI & PMLA norms, all refunds above ₹25,000 require recipient confirmation to prevent unauthorized payouts." The phishing email exploited the existence of real verification norms — but the Income Tax Department will never ask you to confirm these via a clickable email link. Real refund communications arrive via SMS from ITDEPT, ITDEFL, or ITDCPC — never as clickable links inside an email.
Check 6 — The Portal Verification Test
This is the most important check: do not click the email link. Log in directly at incometax.gov.in → e-File → Income Tax Returns → View Filed Returns for refund status, or Pending Actions → e-Proceedings for any notices. If a refund or notice is real, it will be on your portal dashboard without you clicking anything in an email. If it's not there, the email is fake — full stop.
Myth 1: "If the email has a .gov.in domain in it somewhere, it's real."
The documented fake sender was donotreply@incometaxindiafilling.gov.in. It contains ".gov.in" — but the actual domain is "incometaxindiafilling.gov.in," not "incometax.gov.in." One missing letter cost a real taxpayer ₹1.5 lakh (Economic Times, February 24, 2026). Read the domain character by character, not at a glance.
Myth 2: "If the email cites real laws like RBI guidelines or PMLA, it must be official."
Citing real acronyms is precisely how sophisticated fraudsters manufacture legitimacy. The documented July 2025 phishing email cited RBI and PMLA norms on the ₹25,000 refund threshold using the language of real regulatory frameworks — but the Income Tax Department will never ask you to act on those norms via an email link. Real IT notices cite specific sections of the Income Tax Act — Section 143(1), Section 139(9) — not external regulators as the basis for clicking a link.
Myth 3: "A phishing email will have obvious spelling errors or look unprofessional."
All five confirmed campaigns from 2025–2026 used polished, professional language. The "Compliance Gaps" email used formal legal language and formatting that closely replicated official communications. Relying on visual professionalism as a trust signal is exactly how the ₹1.5 lakh loss happened — the victim's brain read "official" before their eyes read the domain.
✅ Quick Recap:
If you receive a suspicious email, do this immediately:
Priya ran Check 1, saw "efiling" spelled as "filling," and never clicked. Her ₹60,000 refund arrived via the portal. You now have exactly what she used — a 30-second checklist that puts official communication in your hands, not a countdown timer in your inbox.