Is a VAT or sales tax refund email from the tax authority real?
Unsolicited tax refund emails are almost always phishing. Real tax agencies communicate through official post or verified online portals, not by asking you to click a link to claim a refund.
Last reviewed: 1 August 2026
Explanation
Tax refund phishing emails are sent in waves, often timed around filing seasons. They claim you are owed a refund and ask you to click a link and enter your bank account or card details to receive the money. The page looks like an official tax authority website but is a fake designed to steal your credentials or payment details. In reality, tax authorities process refunds through the bank account you registered during your tax return submission. They do not email you a clickable link to collect money. If you believe you are owed a refund, log in to your tax authority's official website directly — never through a link in an email.
The refund is the perfect phishing lure because it reverses the usual emotional defence: threats put people on guard, but money owed to you invites engagement. The emails are timed to filing seasons when a refund is plausible, the amounts are specific enough to feel calculated rather than invented, and the fake page asks for card details under the reasonable-sounding pretext of knowing where to send your money. That pretext is the tell — a tax authority that owes you money already knows how to pay you, through the bank details in your registered account.
Business owners see a parallel track of these campaigns around VAT and sales tax cycles, sometimes paired with follow-up calls impersonating tax officers to 'help process' the refund. The verification rule scales unchanged: any tax matter, personal or business, gets checked by logging into the official portal directly or calling the authority's published number. Forwarding the phishing email to your tax authority's reporting address takes seconds and feeds the takedown systems that protect people who would have clicked.
Common red flags
- Email promises a refund and asks you to click a link to claim it
- Link goes to a site with a domain slightly different from the official tax authority
- Refund amount is very specific to seem credible but you filed no return
- Email asks for full card details to 'transfer' the refund
What to do now
- Do not click any link in the email
- Log in to your tax authority's official portal directly to check your status
- Forward the phishing email to your national tax authority's fraud reporting address
- If you entered card details, call your bank immediately
Frequently asked questions
Can the tax authority ever email me about a refund?
Some authorities send notification emails telling you a refund has been processed, but they direct you to log in to your existing account — they never ask for bank or card details by email.
Why would a scammer ask for my card details to send me money?
They wouldn't need them — that is the giveaway. Receiving a payment requires at most the account details your tax authority already holds. A form asking for your full card number, expiry, and security code is collecting what's needed to take money, not send it.