The only official IRS website is IRS.gov. Any other address that claims to be the IRS, whether it ends in .com, .net, .org or anything but .gov, is not the agency. That one rule settles most cases. The hard part is that fake IRS sites now look polished, arrive through messages built to rush you, and sometimes hide behind a QR code on a letter that appears to be on official letterhead.
This guide covers how fake IRS sites work, the red flags you can check in under a minute, what to do when you land on one, and how to confirm that a notice is real without clicking anything it gives you.
TL;DR
- The real IRS website is IRS.gov. The IRS says legitimate links must end in .gov, and lookalikes such as irs.com are not the agency.
- Do not trust a link, text, email or QR code that claims to be from the IRS. Type IRS.gov into your browser yourself, or sign in to your IRS Online Account to see whether a notice exists.
- Urgency, threats of arrest, and demands for gift cards, crypto or wire transfers are classic red flags. The IRS does not work that way.
- If you entered data on a suspicious site, act quickly: change passwords, watch your accounts, and report the site to the IRS.
Table of Contents
- How fake IRS websites work
- The domain test: five checks in under a minute
- Red flags that go beyond the website
- The QR code problem on IRS letters
- How to confirm a notice is real
- What to do if you already clicked or entered information
- Our perspective: why the address beats the design
- Checking a suspicious site with our free tool
- Real IRS sites versus fakes at a glance
- FAQ
- Sources
How fake IRS websites work
A fake IRS site is a phishing page. Its job is to get something from you: your Social Security number, bank login, a payment, or, increasingly, cryptocurrency wallet credentials. The site itself is only the last step. Before it comes a message that gets you there.
The usual delivery routes are:
- Text messages and emails that say you have a refund waiting, a problem with your return, or an account to "verify."
- Social media posts and direct messages promising a large refund or a shortcut.
- Letters in the mail with a web address or QR code.
- Search ads and lookalike domains that catch people who type the wrong address.
The IRS notes that it does not start contact by email, text or social media to ask for personal or financial information. So an unexpected message that does exactly that is already suspect before you open the link.
Why they look so convincing
Ten years ago, a bad logo and broken grammar gave scammers away. That is less reliable now. Reporting on this trend notes that scammers use AI to produce high-fidelity spoofed sites and emails, so the appearance of a page can no longer be your test. The same coverage reports that imposter-scam losses nearly doubled to $797 million in 2025.
Your eye glosses over a typo in a domain. A browser does not. That is why the address, and how you arrived at it, matters more than the design.
The domain test: five checks in under a minute
Start with the address bar. These checks work on any suspicious page, and they are especially useful here because the IRS has one official domain.
- Read the ending. The address must end in .gov, and the part right before it should be "irs." Scammers use typos or subtle variations, such as irs.com instead of irs.gov.
- Read from the right. The real owner of a web address is the part immediately left of the final extension. In a link such as irs.gov.refund-center.example, the real domain is the last part, not "irs.gov" at the front.
- Check how you got there. If the path was a text, an email, a social post, a QR code or an ad, do not continue. Close it and type IRS.gov yourself.
- Look at what it asks for. A page that wants wallet keys, passwords, or a payment in a hard-to-trace form is a scam. The IRS will never demand payment by gift card, cryptocurrency or wire transfer.
- Notice the pressure. A countdown, a threat of arrest, or a claim that your assets will be seized is a hallmark of impersonation, not of a tax agency.
A padlock icon does not clear a site. It only means the connection is encrypted. Criminals can get encryption certificates for their own domains too.
For a broader checklist that applies beyond tax sites, see our guide on phishing website warning signs.
Red flags that go beyond the website
The fake site is usually the end of a chain. If you catch the earlier link, you never have to judge the page at all. The IRS lists the warning signs: a call, email or text is not from the IRS if it is unexpected, rushes you, or threatens you.
Add these to your mental list:
- Caller ID and sender names can be faked. The FBI's Internet Crime Complaint Center has described a significant increase in IRS-themed smishing, meaning phishing by text message. A message that seems to come from a familiar source is not proof.
- Timing. Scammers favor tax season and moments when government programs are in the news. CISA also warns that scam artists pose as the IRS and other agencies all year, not only in spring.
- An unusual payment method. Real tax payments go through channels the IRS publishes on IRS.gov. If the payment option arrives in a message, do not use it.
- Contact by phone or text first. The IRS says it contacts people by mail first for audits and account problems.
The FTC describes how these schemes exploit emotion: urgency, fear of arrest or deportation push people to act before they think. If a message makes your stomach drop, that is a reason to slow down, not speed up.
The QR code problem on IRS letters
QR codes complicate things. The IRS has said it sometimes sends genuine notices that include them, such as the CP53E notice, so you cannot assume every QR code on an IRS-looking letter is fake. That ambiguity is the opening scammers use.
The safe approach is to skip the scanning entirely. Experts advise against scanning QR codes in letters that claim to be from the IRS, however official they look. Go to IRS.gov by typing it yourself and check your account.
The fake "Digital Asset Compliance Portal"
A current example is aimed at people who hold cryptocurrency. In a fraud alert dated July 30, 2026, the IRS warned about letters mailed to crypto holders that direct them to a fraudulent site and tell them to register for a "Digital Asset Compliance Portal." The agency confirmed that no such portal exists. The aim is to steal personal information and digital assets, including wallet keys and exchange credentials.
If you hold crypto and receive a letter like this, do not register, do not scan the code, and do not enter any wallet phrase anywhere. Report it using the steps below.
How to confirm a notice is real
You do not need to judge the fake site at all if you route around it. Use this routine whenever something claims to be from the IRS.
- Do not click, call back or scan. Use none of the contact details in the message.
- Open your browser and type IRS.gov. Do not use a search ad, which can lead to a lookalike.
- Sign in to your IRS Online Account. The IRS says you can check whether a notice appears in your records by logging in directly through IRS.gov.
- Compare. If the notice is not there and you have no reason to expect one, treat it as fake.
- If unsure, call a number you found yourself on IRS.gov, not the one in the message.
This routine also applies to related finance scams that invoke the IRS. Retirement investors, for example, are sometimes told that a depository or custodian is "IRS approved" as a sales pitch. If that applies to you, a walkthrough on how to verify an IRS approved depository shows the same principle at work: confirm through official channels, not through the party selling to you.
What to do if you already clicked or entered information
Do not blame yourself. These pages are built by people who do this for a living. What matters is speed.
- Stop interacting with the site. Close the tab. Do not follow further prompts.
- Change the passwords for any account whose credentials you entered, and for any other account that uses the same password. Turn on two-factor authentication where available.
- If you gave your Social Security number, read the IRS's identity protection tips and consider contacting the IRS about identity theft.
- If you gave bank or card details, call the number on the back of your card or on your bank's official website, and ask about monitoring or replacing the account.
- If you gave wallet keys or seed phrases, move any remaining funds to a new wallet that you create fresh, since the old keys are compromised.
- If you paid, contact the payment provider right away. Payments by gift card, crypto or wire are very hard to recover, which is why scammers ask for them.
Reporting a fake IRS website
Reporting helps shut these sites down. The IRS asks you to send the suspicious site's URL to [email protected] with the subject line "Suspicious website," and its page on reporting fake IRS or Treasury messages lays out the steps for email, text, social media, phone and mail. For emails, do not click anything: forward the message as an attachment, or save it as a file and attach it.
Our perspective: why the address beats the design
At verified.fyi, we look at websites all day, and the pattern holds across scams of every kind: the page rarely gives the scam away, the surrounding facts do. Who registered the domain and when, what the infrastructure looks like, whether the site shows up on security blocklists, and whether anyone has reported it. Our checker analyzes more than 200 security, ownership, reputation, infrastructure, transparency and compliance signals and turns them into a 0 to 100 trust score.
Fake IRS sites are a special case, though, and we want to be direct about it. For a government agency, you do not need a score. You need the official address. If a message claims to be the IRS, the right answer is not "is this site safe?" but "why am I being sent anywhere?" No checker, ours included, should replace typing IRS.gov yourself.
Where a tool like ours helps is the gray zone around the IRS: the tax-prep service that texted you, the "refund tracker" an ad pushed, the crypto compliance service a letter named. Those are third-party sites, and you can check them before you trust them. We also do not take payments to change a verdict, and no one can buy a better score. That independence is the point.
One habit worth building: treat any unexpected message that creates urgency as a reason to verify, never as a reason to hurry.
— Nick
Checking a suspicious site with our free tool
If you land on a page you are unsure about, whether it claims to be the IRS or a company that says it can help with your taxes, paste the address into the free website trust checker. You get a score, a breakdown of the risks found, and a verdict ranging from dangerous to trusted, with no registration. You can also browse recently checked websites to see how other suspicious domains were rated.
Remember the limit: for anything that claims to be the IRS itself, the domain rule decides. A trust score is for third parties.
For more depth, our guides on how to tell if a website is legit and how to spot an AI scam cover the same habits across other kinds of fraud. If you run a small business and are vetting a partner or vendor before paying, six checks before you pay is a good starting point.
Real IRS sites versus fakes at a glance
| Feature | Real IRS | Typical fake |
|---|---|---|
| Domain | IRS.gov | irs.com, irs-refund.net, or a long address with "irs" in it |
| How you got there | You typed it or used a bookmark | Text, email, QR code, social post, ad |
| First contact | Mail for audits and account issues | Call, text, email or DM |
| Tone | Formal, no threats of immediate arrest | Urgent, threatening, countdowns |
| Payment requests | Methods published on IRS.gov | Gift cards, crypto, wire transfer |
| What it asks for | Account sign-in through official channels | Wallet keys, passwords, full card numbers |
FAQ
Is IRS.gov the only real IRS website?
Yes, IRS.gov is the official site of the Internal Revenue Service. Addresses ending in .com, .net, .org or other extensions are not the agency, even if they use the IRS name and logo. Always type the address yourself rather than following a link.
How can I tell if an IRS letter or notice is real?
Do not use the web address, QR code or phone number printed in a notice you are unsure about. Sign in to your IRS Online Account through IRS.gov and see whether the notice appears there. The IRS says it contacts people by mail first for audits and account issues, so unexpected threats by text or email are a warning sign.
What should I do if I entered my information on a fake IRS site?
Change the passwords for the accounts involved, turn on two-factor authentication, and contact your bank or card issuer if you shared financial details. If you gave your Social Security number, follow the IRS's identity protection guidance. Then report the site to [email protected].
Does the IRS ever send QR codes?
Sometimes, on certain genuine notices such as the CP53E. Because fakes copy that format, the safest course is not to scan the code at all. Go to IRS.gov yourself and check your account.
Sources
- Beware of scammers posing as the IRS (IRS)
- Fraud alert: Fake IRS letters target cryptocurrency holders (IRS)
- Tax scams (IRS)
- How to know it's the IRS (IRS)
- Report fake IRS, Treasury or tax-related emails and messages (IRS)
- Identity protection tips (IRS)
- How To Avoid a Government Impersonation Scam (FTC)
- IRS Imposter Scams And QR Code Fraud: What You Must Know (Forbes)
- Significant Increase in IRS-themed Smishing Campaigns (IC3)
- Preparing for Tax Season (CISA)