Loading story…
Criminals are running IRS impersonation scams during tax filing season, using phone calls, emails, and texts to pressure victims into paying alleged tax debts or “fines,” or to trick them into disclosing sensitive personal and financial information. Common tactics include spoofed caller ID/sender details, use of official-looking IRS branding, and urgent threats (e.g., arrest or penalties) designed to short-circuit normal verification steps.
Guidance highlighted for defenders and end users includes treating unsolicited IRS outreach as suspicious (the IRS typically initiates contact via mailed letters), refusing demands for immediate payment, and recognizing that requests for payment via gift cards or cryptocurrency are strong indicators of fraud. One reported lure centers on the phone number 833-727-9955 being used in “IRS scam calls,” consistent with broader IRS-themed social engineering that may be further amplified by AI-enabled voice/text techniques to increase credibility and scale.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A warning was issued about unsolicited calls and voicemails offering fake 'tax abatement' or 'verification' help while impersonating the IRS or tax-related agencies. The scam sought to pressure targets into disclosing sensitive information or paying fraudulent upfront fees for bogus tax-debt relief.
A community scam alert reported that phone number 833-727-9955 was being used in IRS impersonation calls. Callers allegedly claimed to represent the Internal Revenue Service and threatened victims over tax filings and collections.
During the 2026 tax-filing season, security researchers warned that scammers were exploiting the period by impersonating the IRS, tax preparers, and tax software companies through email, text messages, and phone calls. The scams included phishing, smishing, vishing, refund-theft schemes, fake refund verification sites, bogus tax-credit offers, and fraudulent tax preparers diverting refunds.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourcewelivesecurity.com
Open sourceirs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fraudsters are running a broad IRS impersonation campaign through robocalls, voicemails, texts, and emails that use fake names such as **Tax Mediation and Abatement Office**, **Tax Resolution Service Office**, **Taxpayer Abatement Assistance Office**, **American Tax Advocates**, and **American Tax Benefits**. The messages claim the target has unresolved tax issues, a file in "final review," frozen accounts, missed filings, or access to penalty relief or refunds, then pressure them to call back numbers including `888-355-0728`, `888-753-0127`, `888-663-0866`, `888-681-0352`, `888-788-3067`, `202-649-2801`, `202-649-2790`, `202-649-2783`, `771-222-3150`, `771-333-2237`, `771-333-2065`, `833-604-4139`, `877-706-0402`, `888-825-0405`, `888-551-2231`, `888-834-1048`, `888-792-0335`, `888-471-0706`, `833-684-4075`, `888-461-3098`, and `888-796-1408`. Some calls reportedly use spoofed caller ID, aliases such as **Laura Christie** and **Tara C. Hutchinson**, and AI-enhanced personalization to appear legitimate. The operation relies on classic social engineering: threats of arrest, fines, deportation, license revocation, liens, asset seizure, or collection escalation, alongside false promises to settle tax debts "for pennies on the dollar" or secure refunds. Victims are pushed to disclose personal data, IRS account credentials, and banking details, or to send money through gift cards, wire transfers, prepaid debit cards, or cryptocurrency; some lures also direct targets to phishing sites or malware-bearing links. The warnings align with the IRS **Dirty Dozen** advisory for the filing season, which highlighted impersonation, phishing, account theft, and malware risks targeting taxpayers and tax professionals. Officials and consumer alerts stress that the IRS generally initiates contact by postal mail, not unsolicited calls, texts, or social media, and urge victims to hang up, avoid calling back, verify any issue only through official IRS channels, and report incidents to **TIGTA**, the **FTC**, or `phishing@irs.gov`.
Jul 2, 2026
Scammers are impersonating tax-relief firms under names including **Universal Tax Advocates**, **Universal Tax Associates**, and **Tax Relief Advocates** to pressure victims into paying bogus upfront fees or surrendering sensitive personal and financial information. The campaign reportedly uses robocalls, text messages, phishing emails, and caller ID spoofing to claim targets owe back taxes, then promises to eliminate or sharply reduce that debt through supposed special programs such as **"Fresh Start."** Targets are being urged to verify any tax issue only through official IRS channels and to avoid responding to unsolicited messages or calls demanding payment or personal data. Suspected phishing emails and scam calls should be reported to the IRS, TIGTA, and the FTC via **ReportFraud.ftc.gov**, while anyone who disclosed SSNs or banking details should begin identity-theft mitigation steps and closely monitor financial accounts for fraud.
Aug 6, 2026
Consumer-facing warnings described a surge of **taxpayer-targeting impersonation scams** using fake entities such as the “**National Tax Executive Office**” and “Tax Resolution Oversight Department,” alongside broader **IRS-themed phishing** via calls, emails, and SMS. Reported lures include urgent claims of tax debts or refunds, links to spoofed “official” sites, and **AI-enabled impersonation** (voice mimicry and deepfake-style video calls) to pressure victims into immediate payment. Common indicators include threats of arrest or license revocation and demands for nonstandard payment methods such as **gift cards, wire transfers, prepaid debit cards, cryptocurrency, or P2P apps**; guidance emphasized that the IRS generally initiates contact via **postal mail** and that suspected scams should be reported through official IRS/TIGTA channels. Separately, the IRS leadership told Congress it is conducting a **thorough cybersecurity review** as lawmakers scrutinize the agency’s **taxpayer data protections** and a contested **data-sharing agreement with Immigration and Customs Enforcement (ICE)**. Congressional questioning cited multiple privacy controversies, including litigation over the ICE agreement, allegations of inappropriate access to personally identifiable information, and historical disclosures (including a prior contractor leak affecting high-profile taxpayers). A federal judge’s opinion was also referenced alleging the IRS violated federal law **tens of thousands of times** by improperly sharing taxpayer addresses with the Department of Homeland Security via a flawed matching process; IRS leadership acknowledged responsibility for improving controls while declining detailed comment due to ongoing litigation.
Jun 29, 2026