NOTICE: IRS warns of tax-refund phishing targeting universities

Wednesday, March 31, 2021

The Internal Revenue Service (IRS) is warning of an ongoing IRS-impersonation scam that appears to primarily target educational institutions. Scammers are sending phishing emails to students, faculty, staff and others who have email addresses ending in .edu.

About the phishing emails

The phishing emails:

  • Display the IRS logo.
  • Have subject lines such as, "Tax Refund Payment" or "Recalculation of your tax refund payment."
  • Ask people to click a link and submit a form to claim their refund.

Those who click the link are directed to a phishing website impersonating the IRS that asks for a long list of personal information including Social Security number, name, birthdate, driver's license number, address, and PIN.

Do not click the link

If you receive one of these emails, do not click the link, and do not provide any information.

If you receive one of these IRS-impersonation emails, you can report it to the IRS. The IRS asks that, for security reasons, you forward the phishing email as an attachment to phishing@irs.gov. To do that in Gmail:

  1. Go to your GMail at U-M inbox.
  2. Check the checkbox next to the message you want to forward.
  3. Click the More button (three dots) at the top of your inbox, then select Forward as attachment.

How to check on your tax refund

You can check your tax refund status online at Where's My Refund? on IRS.gov.

If you entered your info on the phishing site

The IRS provides these recommendations:

  • Taxpayers who believe they may have provided identity thieves with this information should consider immediately obtaining an Identity Protection PIN. This is a voluntary opt-in program. An IP PIN is a six-digit number that helps prevent identity thieves from filing fraudulent tax returns in the victim's name.
  • Taxpayers who attempt to e-file their tax return and find it rejected because a return with their SSN already has been filed should file a Form 14039, Identity Theft Affidavit (PDF) to report themselves as a possible identity theft victim. See Identity Theft Central to learn about the signs of identity theft and actions to take.