Fake Income Tax Penalty Emails Target Taxpayers: How to Identify and Avoid This Scam

The Latest Phishing Threat: What’s Happening

On September 3, 2026, reports surfaced of a new income tax phishing scam. Taxpayers received emails styled as ‘Tax Recovery and Penalty Notices’—allegedly from the Income Tax Department—warning them of under-reported income, undisclosed foreign assets, and imminent penalties unless action is taken within 72 hours. The communication weaponises panic, using the appearance of government authority and fabricated details to trick recipients into sharing sensitive information or downloading malware.

What Makes This Scam Look Official

Scammers increasingly mimic government communications to deceive taxpayers. Here’s how this scam attempts authenticity:

• Sender’s Email Address: The email displays ‘incometax.gov.in’ before the @ symbol, but the actual domain is ‘cdshlb.com’—a non-government source. This is a classic spoofing trick.
• Fake Reference Number: A seemingly official reference number (ITD/TAX/2026/01987) is used, but such numbers are meaningless without government verification.
• Government Branding & Language: The email uses logos, formatting, and language similar to real Income Tax notices.
• Urgency & Threats: Recipients are threatened with jail and heavy financial penalties unless they respond within 72 hours.
• Suspicious Download Links: The notice asks recipients to download a file from a non-official domain (e.g., ‘youxian.s.gy’), risking malware infection.

How Genuine Income Tax Notices Work: Document Identification Number (DIN)

From October 1, 2019, the Income Tax Department mandates that every official online or physical tax communication must carry a unique Document Identification Number (DIN). This allows taxpayers to:

• Verify the authenticity of tax notices, orders, and communications
• Check the legitimacy of emails on the Income Tax e-filing portal using the DIN

If a communication lacks this mandatory DIN, it is not legally valid and should be treated with suspicion. Scammers may fabricate their own ‘reference numbers’, but only a valid DIN can be checked on the official portal.

How to Verify a Tax Email or Notice

To authenticate a notice:

1. Log in to the official Income Tax e-filing portal.
2. Use the DIN search facility to verify any communication.

Never click on email links or download files from unexpected, non-government addresses.

Common Red Flags: How to Spot a Phishing Email

This fraud highlights several warning signs:

1. Email address is not from ‘@incometax.gov.in’
2. Reference or case numbers that can’t be checked with the government
3. Unexpected threats of major penalties or prison
4. Strict, artificial deadlines—usually 24 or 72 hours
5. Non-official download or verification links
6. Requests for sensitive details like PAN, Aadhaar, passwords or OTPs
7. General formatting errors or suspicious attachments
8. Absence of verifiable particulars or legitimate contact information

What To Do If You Receive Such an Email

• Do not respond or provide any information.
• Do not click on links or download any attachments.
• Report the email to phishing@incometax.gov.in and your organisation's IT security team.
• Use the Income Tax portal to verify any suspicious notice with the provided DIN.
• If you’ve already acted on a fraudulent notice or downloaded suspicious files, immediately change your passwords and scan your system for malware.

Why Awareness Matters

Raising awareness is critical: such scams can lead to financial loss, identity theft, and compromise of sensitive credentials for taxpayers, professionals, and businesses alike. Verifying every tax-related email on the official portal is the only safe way to engage with Departmental communication.

Quick Example: Fake vs. Real Notice Comparison

Final Take: Stay Vigilant

Every taxpayer, professional, and business should scrutinise income tax emails carefully. Never rush into compliance before authenticating the notice. The Income Tax Department and CBDT repeatedly warn against phishing—be sceptical, verify every detail, and report suspicious communications promptly.