Fake Tax Refund OTP Verification Scams in India
How scammers in India impersonate Income Tax Department staff, claiming an unclaimed refund is ready, then use a shared one-time password to authorize unauthorized bank transactions.
Part of: Fake Tax Refund OTP Verification Scam
Last reviewed: 14 July 2026
India's widespread reliance on one-time passwords (OTPs) for bank and UPI authentication is exactly what this scam exploits. A call, SMS, or WhatsApp message claiming to be from the Income Tax Department tells the recipient a tax refund is ready for transfer, but that an OTP sent to their phone must first be shared to 'verify' their bank account before the refund can be processed.
Because OTPs are a genuine, everyday part of legitimate Indian banking security, and refund season creates real anticipation among taxpayers, the request feels procedurally normal to many recipients — even though sharing an OTP with anyone, for any reason, is something no legitimate bank or government agency ever actually requires.
How this scam works on India
The scam typically begins with a call, SMS, or WhatsApp message claiming to be from the Income Tax Department, informing the recipient that a tax refund of a specific amount is pending and that final verification is required to release it. The message may include a link to a fake portal resembling the official Income Tax e-filing website, or the caller may simply request bank account details directly over the phone.
As the final step, the scammer says an OTP has been sent to the victim's registered mobile number and asks them to read it out or enter it on the fake portal to 'confirm' the refund. In reality, this OTP is the authorization code for a transaction the scammer has already initiated on the victim's actual bank account or a linked UPI app, and sharing it completes an unauthorized transfer out of the victim's account rather than a refund into it.
By the time the victim realizes money has left their account rather than arrived, the transaction is typically already complete, and the scammer's contact details go unanswered.
Common red flags
- A call, SMS, or WhatsApp message claims a tax refund is ready and asks you to 'verify' your bank account
- You are asked to share an OTP that was just sent to your phone to complete the refund process
- A link leads to a website that resembles, but is not exactly, the official Income Tax e-filing portal (incometax.gov.in)
- The message creates urgency, claiming the refund will be forfeited if you do not act quickly
- You are asked for your full bank account number, UPI PIN, or debit card details over the phone or via message
- The claimed refund amount is round or unusually generous compared to what you would actually expect
How to protect yourself
- Never share an OTP with anyone over the phone, SMS, WhatsApp, or any website — legitimate refunds do not require sharing an OTP to 'verify' your account
- Check your actual refund status only by logging in directly at the official Income Tax e-filing portal, incometax.gov.in
- Do not click links in unsolicited tax refund messages — type the official portal address directly into your browser instead
- Remember that genuine tax refunds are credited directly to your bank account based on your filed return, with no separate 'verification' step required from you
- Verify any suspicious message by contacting the Income Tax Department through its official helpline rather than any number provided in the message
- Enable transaction alerts on your bank account and UPI app so you notice any unauthorized activity immediately
How to report it
- Report to the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930
- Report phishing attempts to the Income Tax Department at [email protected]
- Contact your bank's fraud helpline immediately to report any unauthorized transaction and request a freeze
- File a complaint at your local police cybercrime cell
Frequently asked questions
Does the Income Tax Department ever ask for an OTP to process a refund?
No. Genuine tax refunds are credited automatically to the bank account linked in your filed return, based on your PAN and bank details already on record. No legitimate refund process requires you to share an OTP with anyone by phone, SMS, or a linked website.
I shared the OTP and money left my account instead of a refund arriving — what happened?
The OTP you shared was very likely the authorization code for a withdrawal or transfer transaction the scammer had already initiated, not a refund confirmation code. Sharing it completed that unauthorized transaction rather than releasing any refund.
Can I get my money back after sharing an OTP that led to an unauthorized transaction?
Recovery may depend on the payment method and timing — contact your bank's fraud helpline immediately to report the unauthorized transaction and request a freeze or reversal, and file a report on the National Cyber Crime Reporting Portal (cybercrime.gov.in) as soon as possible, since faster reporting improves the chance of intercepting funds.
How can I check my real tax refund status safely?
Log in directly at incometax.gov.in by typing the address yourself, rather than clicking a link from an SMS, WhatsApp message, or email, and check your refund status through the official 'Refund/Demand Status' section of your account.