Scammers are impersonating tax-relief firms under names including Universal Tax Advocates, Universal Tax Associates, and Tax Relief Advocates to pressure victims into paying bogus upfront fees or surrendering sensitive personal and financial information. The campaign reportedly uses robocalls, text messages, phishing emails, and caller ID spoofing to claim targets owe back taxes, then promises to eliminate or sharply reduce that debt through supposed special programs such as "Fresh Start."
Targets are being urged to verify any tax issue only through official IRS channels and to avoid responding to unsolicited messages or calls demanding payment or personal data. Suspected phishing emails and scam calls should be reported to the IRS, TIGTA, and the FTC via ReportFraud.ftc.gov, while anyone who disclosed SSNs or banking details should begin identity-theft mitigation steps and closely monitor financial accounts for fraud.

Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Online Threat Alerts warned that scammers were using the names Expedited Tax Mediation Office, Agency for Mediation and Tax Relief, and Tax Mediation and Resolution Agency in robocalls and voicemails impersonating tax-related entities. The scam used spoofed numbers, false claims about active tax files or back taxes, and demands for sensitive information or upfront payments.
Online Threat Alerts warned that scammers were using the names American Tax Advisors, American Tax Advisers, and Tax Resolution Teams in unsolicited calls, texts, and voicemails to steal money or personal information. The scam used urgent tax-debt claims or unrealistic tax-relief promises, requested sensitive data, and sometimes demanded payment via cryptocurrency, wire transfers, or gift cards.
Online Threat Alerts warned that unsolicited calls, texts, or letters using the name Meridian Tax Associates should be treated as a potential scam. The article said fraudsters impersonate tax firms or invent similar-sounding names to solicit money or sensitive information through themes such as fake tax relief offers, back-tax threats, inflated refund promises, and verification robocalls.
Online Threat Alerts warned that scammers were using the name Premier Tax Council, alongside generic US Tax Consultants branding, in unsolicited tax scam calls and messages targeting U.S. taxpayers. The scam involved threats about IRS action, demands for upfront fees, and requests for payment via wire transfers, gift cards, prepaid debit cards, or cryptocurrency.
Online Threat Alerts described ongoing scams in which fraudsters impersonate tax-relief services using names including Universal Tax Advocates, Universal Tax Associates, Tax Relief Advocates, Tax Consultants of America, US Tax Consultants, and American Tax Consultants. The scams use robocalls, texts, emails, and voicemails to pressure targets into paying fraudulent fees or disclosing sensitive personal and financial information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
9 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceirs.gov
Open sourcereportfraud.ftc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.