USPS-Branded Tax Identity Theft Phishing Scam
Criminals impersonate USPS in messages claiming a tax-related document or identity verification letter is awaiting collection, with the goal of harvesting Social Security numbers, birthdates, and financial information to file fraudulent tax returns.
Part of: Tax Identity Theft
Last reviewed: 8 June 2026
Tax identity theft is one of the most damaging forms of fraud, and scammers use the USPS brand to add a layer of credibility to their harvesting campaigns. The message claims that USPS is holding a letter or document from the IRS or a state tax authority at a local post office, but that identity verification must be completed online before the document is released.
The verification form collects precisely the information needed to impersonate the victim: Social Security number, full legal name, date of birth, and address. In some cases a driver-licence image is requested as well. With this data, fraudsters file a fraudulent tax return in the victim's name, redirecting any legitimate refund to a scammer-controlled account before the real taxpayer even files.
USPS does not withhold tax correspondence pending online identity verification. Tax documents from the IRS are delivered as standard mail items and do not require the recipient to complete any online process to receive the physical envelope.
How this scam works on the USPS brand
An email or text says: 'USPS: An IRS identity verification letter addressed to you requires your confirmation before delivery. Verify now to avoid return: [link].' The site presents a government-styled form asking for full personal details.
Some campaigns are timed to tax season (January through April in the US) to seem plausible. They may reference a specific post office branch by name, adding false specificity.
After the form is submitted, victims often receive a confirmation screen suggesting the document will be delivered in two to three business days, giving the scammers time to use the stolen data before the victim realises nothing ever arrived.
Common red flags
- Claim that a tax letter or IRS document is being 'held' at the post office pending online verification
- Link does not go to usps.com or irs.gov
- Request for Social Security number, date of birth, and driver-licence image online
- Message arrives during tax season with urgent deadline language
- Email sender address is not @usps.com
- Post office 'branch' named in the message does not exist at that address
- Confirmation screen after submitting your data provides no real reference number
How to protect yourself
- USPS does not require online identity verification before delivering mail — delete the message
- Check the IRS's official taxpayer account at irs.gov/account for any genuine notices
- Never submit your Social Security number or date of birth via a link in an unsolicited message
- Report the phishing message to [email protected] and [email protected]
- Place a fraud alert on your credit file at equifax.com, experian.com, and transunion.com
- File a report at identitytheft.gov if personal data was submitted
- Consider filing your tax return as early as possible to prevent a fraudulent return being filed first
How to report it
- Email [email protected] and [email protected] with screenshots
- Report to the FTC and file an identity theft report at identitytheft.gov
- Report to the USPIS at postalinspectors.uspis.gov
- File a report with the IRS Identity Protection Specialised Unit at 1-800-908-4490
- Report to your local police if financial loss has occurred
Frequently asked questions
What is tax identity theft and how does it affect me?
Tax identity theft occurs when someone uses your Social Security number and personal details to file a fraudulent tax return in your name, claiming a refund before you do. When you file your legitimate return, the IRS rejects it as a duplicate, triggering a lengthy resolution process.
Does the IRS send notices by mail or email?
The IRS communicates almost exclusively by postal mail. It does not initiate contact by email, text, or social media. Any email claiming to be from the IRS and requiring action is almost certainly a phishing attempt.
How do I find out if someone has already filed a return in my name?
Create or log in to your IRS online account at irs.gov/account. If you receive an IRS notice about a duplicate return or an unexpected refund, call the IRS Identity Protection Specialised Unit at 1-800-908-4490.