ITR Filing Ends Soon: Fake Tax Emails Are on the Rise—Here's How to Stay Safe And What to Watch For

As the ITR filing deadline approaches, scammers are intensifying efforts by sending fake emails pretending to be from the Income Tax Department. These phishing attempts use a false sense of urgency to trick recipients into clicking malicious links or opening infected attachments.

The clock is indeed running out if you haven't submitted your income tax return yet. The deadline for AY 2026–2027 for the majority of salaried taxpayers is July 31, 2026, which is only four days away. Additionally, scammers increase their activity during this precise window each year, sending emails that appear to be from the Income Tax Department in the hopes that individuals will click before they consider.

Recently, cybersecurity company Shreshta IT Technologies discovered a phishing attempt that was particularly scheduled around the AY 2026–2027 reporting season and was connected to China. A multilingual (Hindi-English) "office memorandum" that seems official is sent to victims, claiming a tax error and requesting papers within 72 hours or threatening legal action. However, the malware installed by the associated file silently infects the victim's machine and grants attackers remote access.

In March 2026, the Fact Check unit of the Press Information Bureau discovered another fraudulent email that was making the rounds, alleging that a person's return file included "compliance gaps." "This email is FAKE and a phishing attempt to trick citizens into losing money," PIB stated bluntly.

These all adhere to the same basic strategy, which includes an official-looking communication, a fake feeling of urgency, and an attachment or link intended to steal your personal data.

How To Spot Fake ITR Email?

The domain @incometax.gov.in appears in all legitimate emails from the Income Tax Department. A communication purporting to be from the department is not legitimate if it originates from anything else, even if it seems similar, has a little different spelling, an extra word, or a.com or.in domain instead of.gov.in. The great majority of these frauds are detected by this one check before you even need to look at the content.

Detailed personal information is not requested by email by the Income Tax Department. It doesn't send emails asking for passwords, PINs, or other access details for bank accounts, credit cards, or other financial accounts.

This alone rules out a huge share of scam emails. If a message asks you to confirm your bank details, card PIN, or net banking password to “process" a refund or “avoid penalty," it is not from the department, full stop.

What To Do If You Get One?

The department's advice is detailed and should be strictly adhered to:

• Don't respond to the email.
• Avoid opening any attachments. They could have dangerous code that, like the latest malware campaign, infects your device.
• Avoid clicking on any links. If you've already clicked one, avoid entering your password, credit card information, or bank account information on the screen that appears.
• Additionally, avoid copying and pasting the link into your browser. Phishers have the ability to make a link appear one way while really rerouting it to a whole different location.

Maintain an up-to-date firewall, antivirus software, and anti-spyware. Certain phishing emails contain malware that may monitor your activities or harm your device covertly.

Scammers rely on deadline pressure to affect judgement. The real protection in this case is straightforward and doesn't involve any technological knowledge: verify the sender's domain, never submit PINs, passwords, or OTPs by email, and stop and check immediately through the official site if anything makes you feel urgent.