Watch Out for This New IRS Scam Circulating Right Now
Tax season is one of the busiest times of year — not just for filers, but for scammers too. And this year is no exception. Fraudsters are using AI to impersonate the IRS by phone, sending phishing messages with fake QR codes and spreading viral “tax hacks” that can lead to costly mistakes or even legal trouble.
At the same time, attackers are deploying fake Google security alerts that quietly take control of your device, while fraudulent travel websites lure vacationers with steep discounts that vanish along with their payments. Read on to learn how these scams work and how to avoid becoming the next target.
Where People Are Protecting Their Privacy Online Right Now
- The Dirty Dozen: Every year around filing season, the IRS publishes a list of the most dangerous tax scams circulating at that moment it calls the Dirty Dozen. The 2026 edition, released on National Slam the Scam Day on March 5, flags threats including AI-enabled IRS impersonation by phone, phishing and smishing emails and texts that use fake QR codes to redirect taxpayers to fraudulent IRS websites and viral "tax hack" advice spreading on social media that can push people to file false returns or claim credits they don't qualify for. A notable addition to this year's list is the abuse of Form 2439, which covers undistributed long-term capital gains. If something claiming to be the IRS shows up in your inbox or voicemail demanding immediate action, treat it as a scam until proven otherwise.
- Phantom Security Updates: Cybersecurity experts at Malwarebytes are warning Google users about a convincing new attack that begins with what looks like a routine account security alert. As part of a protective checkup, it prompts users to install what appears to be a legitimate tool which pins itself to your home screen and runs in its own window, causing the browser address bar to disappear so the victim sees what looks and feels like a native Google app. But closing the browser tab isn't enough — the tool can continue to receive commands silently, granting the attacker push notification access, the device's contact list, real-time GPS location and clipboard contents even after the victim thinks they've closed the page. Remember that Google does not conduct security checkups through unsolicited pop-up pages. Legitimate Google account security tools are accessed directly at myaccount.google.com.
- Too Good to Be True Getaways: With spring break and summer travel plans ramping up, it's a good time to be extra cautious about where you're booking. Tech security group BrandShield says it's seeing a surge of scammers flooding the internet with fake travel websites designed to steal your money, with its latest analysis uncovering thousands of suspicious links posing as legitimate travel brands. Scammers create lookalike websites with slightly altered URLs, often fabricating urgency with "last chance" deals designed to rush you into a purchase. Before booking anywhere unfamiliar, make sure the URL starts with "https," look for a working customer support contact and be wary of prices that seem unusually low. When in doubt, go directly to a known, established booking platform rather than clicking through a search result.
Where People Are Protecting Their Privacy Online Right Now
Protect your digital life: See Lifelock's current identity theft plans and get your first year of the standard plan for just $7.99 a month
The most common types of scam you should know
Scammers are constantly upping their game, coming up with new and exciting ways (for them) of fooling their targets. AI-powered scams are one example of this: the technology is being used to reach a larger number of people with increasingly more convincing schemes.
But some tricks never run out of style. Most scams fall into a handful of familiar patterns, and those of yore are still very much a threat today — they’ve just evolved to better fit today’s digital landscape.
- Imposter scams: Scammers often pose as trusted figures like government agencies, banks, employers and even friends or family to pressure victims into sending money or sharing personal information.
- Phishing and spoofing scams: These scams use emails, texts or phone calls that look like they’re from legitimate organizations. The goal is to trick you into clicking a malicious link, downloading malware or handing over sensitive information.
- Online shopping scams: Fraudsters can create fake online stores or listings with hard-to-find items at unusually low prices. After you pay for an article, what you end up getting might be counterfeit — or it may never arrive in the first place.
- Investment scams: This type of scam often arrives with promises of high returns from crypto, forex or other “exclusive” opportunities. Many involve long-term grooming tactics, where victims are encouraged to invest more over time before losing everything.
- Romance scams: Some scammers try to get into your pocket through the heart. They build a relationship with you on dating apps or social media, then convince you to give up money and assets by fabricating emergencies or investment opportunities.
Plans for everyone: Check out Aura's identify theft options for you and your family, starting at $9 a month when you pay annually
What to do if you’re the target — or victim — of a scam
No one is immune to scams or fraud, but a few consistent habits can reduce their danger and the damage they cause.
For starters, be skeptical of unsolicited messages, especially those creating fear or urgency. This might look like an email from your bank threatening to close an account, a text from an online marketplace saying you’ll lose a discount or a call from the IRS claiming they’ll report you to the authorities unless you “act now.”
Scammers love to use this sort of language because it puts the target on the spot, which expects hope will move you to act.
Suffice it to say, always verify any requests from an organization by cross-checking with its official phone numbers, email or website. And don’t click any links, download attachments or respond to messages you suspect may be fraudulent. A legitimate organization will not pressure you for instant action or secrecy.
Now, if you’ve already sent financial information or money to someone you suspect is a scammer, you’ll need to jump through some hoops. Contact your bank, credit card issuer or payment platform immediately and attempt to stop or reverse transactions. Make sure to change any relevant passwords and enable multi-factor authentication to safeguard your accounts, too.
Reporting a scam might also help protect others. You can file a report with the Federal Trade Commission (FTC) at https://reportfraud.ftc.gov and with local authorities at your nearby police department or sheriff’s office. Identity theft victims should also consider momentarily freezing their credit.
Lastly, review your financial statements and credit reports regularly, keep your software updated and limit how much personal information you share online. Scammers often rely on publicly available details to make their schemes more convincing.