Loading story…
Consumer-facing warnings described a surge of taxpayer-targeting impersonation scams using fake entities such as the “National Tax Executive Office” and “Tax Resolution Oversight Department,” alongside broader IRS-themed phishing via calls, emails, and SMS. Reported lures include urgent claims of tax debts or refunds, links to spoofed “official” sites, and AI-enabled impersonation (voice mimicry and deepfake-style video calls) to pressure victims into immediate payment. Common indicators include threats of arrest or license revocation and demands for nonstandard payment methods such as gift cards, wire transfers, prepaid debit cards, cryptocurrency, or P2P apps; guidance emphasized that the IRS generally initiates contact via postal mail and that suspected scams should be reported through official IRS/TIGTA channels.
Separately, the IRS leadership told Congress it is conducting a thorough cybersecurity review as lawmakers scrutinize the agency’s taxpayer data protections and a contested data-sharing agreement with Immigration and Customs Enforcement (ICE). Congressional questioning cited multiple privacy controversies, including litigation over the ICE agreement, allegations of inappropriate access to personally identifiable information, and historical disclosures (including a prior contractor leak affecting high-profile taxpayers). A federal judge’s opinion was also referenced alleging the IRS violated federal law tens of thousands of times by improperly sharing taxpayer addresses with the Department of Homeland Security via a flawed matching process; IRS leadership acknowledged responsibility for improving controls while declining detailed comment due to ongoing litigation.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Public scam guidance described a surge in taxpayer-targeting fraud using fake agencies such as the 'National Tax Executive Office' and 'Tax Resolution Oversight Department.' The notice also referenced the IRS 2026 'Dirty Dozen' scam themes and advised victims to verify contacts through official IRS channels and report phishing or impersonation attempts.
The IRS warned about widespread tax-related scams delivered by text, email, and phone calls, including AI-enabled voice mimicry and deepfake-style impersonation. The agency reiterated that it does not initiate contact through email, text, or social media, and does not demand payment via gift cards, wire transfers, cryptocurrency, or payment apps.
IRS CEO Frank Bisignano told the House Ways & Means Committee that the agency is conducting a thorough cybersecurity review and broader evaluations of taxpayer-data protections. The review comes amid scrutiny over IRS data-sharing with ICE, reported access to personally identifiable information, and other privacy controversies.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
foxbusiness.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Criminals are running **IRS impersonation scams** during tax filing season, using phone calls, emails, and texts to pressure victims into paying alleged tax debts or “fines,” or to trick them into disclosing sensitive personal and financial information. Common tactics include spoofed caller ID/sender details, use of official-looking IRS branding, and urgent threats (e.g., arrest or penalties) designed to short-circuit normal verification steps. Guidance highlighted for defenders and end users includes treating unsolicited IRS outreach as suspicious (the IRS typically initiates contact via mailed letters), refusing demands for immediate payment, and recognizing that requests for payment via **gift cards** or **cryptocurrency** are strong indicators of fraud. One reported lure centers on the phone number **`833-727-9955`** being used in “IRS scam calls,” consistent with broader IRS-themed social engineering that may be further amplified by **AI-enabled** voice/text techniques to increase credibility and scale.
Jun 29, 2026
Fraudsters are running a broad IRS impersonation campaign through robocalls, voicemails, texts, and emails that use fake names such as **Tax Mediation and Abatement Office**, **Tax Resolution Service Office**, **Taxpayer Abatement Assistance Office**, **American Tax Advocates**, and **American Tax Benefits**. The messages claim the target has unresolved tax issues, a file in "final review," frozen accounts, missed filings, or access to penalty relief or refunds, then pressure them to call back numbers including `888-355-0728`, `888-753-0127`, `888-663-0866`, `888-681-0352`, `888-788-3067`, `202-649-2801`, `202-649-2790`, `202-649-2783`, `771-222-3150`, `771-333-2237`, `771-333-2065`, `833-604-4139`, `877-706-0402`, `888-825-0405`, `888-551-2231`, `888-834-1048`, `888-792-0335`, `888-471-0706`, `833-684-4075`, `888-461-3098`, and `888-796-1408`. Some calls reportedly use spoofed caller ID, aliases such as **Laura Christie** and **Tara C. Hutchinson**, and AI-enhanced personalization to appear legitimate. The operation relies on classic social engineering: threats of arrest, fines, deportation, license revocation, liens, asset seizure, or collection escalation, alongside false promises to settle tax debts "for pennies on the dollar" or secure refunds. Victims are pushed to disclose personal data, IRS account credentials, and banking details, or to send money through gift cards, wire transfers, prepaid debit cards, or cryptocurrency; some lures also direct targets to phishing sites or malware-bearing links. The warnings align with the IRS **Dirty Dozen** advisory for the filing season, which highlighted impersonation, phishing, account theft, and malware risks targeting taxpayers and tax professionals. Officials and consumer alerts stress that the IRS generally initiates contact by postal mail, not unsolicited calls, texts, or social media, and urge victims to hang up, avoid calling back, verify any issue only through official IRS channels, and report incidents to **TIGTA**, the **FTC**, or `phishing@irs.gov`.
Jul 2, 2026
Scammers are impersonating tax-relief firms under names including **Universal Tax Advocates**, **Universal Tax Associates**, and **Tax Relief Advocates** to pressure victims into paying bogus upfront fees or surrendering sensitive personal and financial information. The campaign reportedly uses robocalls, text messages, phishing emails, and caller ID spoofing to claim targets owe back taxes, then promises to eliminate or sharply reduce that debt through supposed special programs such as **"Fresh Start."** Targets are being urged to verify any tax issue only through official IRS channels and to avoid responding to unsolicited messages or calls demanding payment or personal data. Suspected phishing emails and scam calls should be reported to the IRS, TIGTA, and the FTC via **ReportFraud.ftc.gov**, while anyone who disclosed SSNs or banking details should begin identity-theft mitigation steps and closely monitor financial accounts for fraud.
Aug 6, 2026