The New Face of Tax Scams
The game has changed for tax fraudsters in India. While classic scams involving fake refund messages still exist, there's a more dangerous trend on the rise: credential theft. Cybercriminals are increasingly focused on stealing the username and password
for your official Income Tax e-filing account. They do this through sophisticated phishing campaigns, sending emails, SMS messages, and even WhatsApp messages that look shockingly real. These messages often create a sense of urgency, threatening penalties or promising refunds to trick you into clicking a malicious link. These links lead to clone websites designed to look exactly like the official incometax.gov.in portal, capturing your login details the moment you enter them.
Why Your Filing Credentials Are Gold
Handing over your e-filing credentials is like giving a thief the keys to your financial life. With access to your account, a scammer can view your past income details, bank account numbers, and personal information like your PAN and Aadhaar. They can take this a step further by filing a revised or fraudulent tax return in your name and diverting any legitimate refund to their own bank account. This not only leads to direct financial loss but can also embroil you in a lengthy process with the tax department to prove identity theft and reclaim your financial identity. The information stolen can also be used for broader identity fraud, leaving you vulnerable to other scams.
Your Essential Security Checklist
Treat your e-filing account with the same security as your online banking portal. Adding these steps to your routine can significantly reduce your risk. 1. Always Go Direct: Never click on links in unsolicited emails, texts, or WhatsApp messages. The Income Tax Department has repeatedly stated it does not send official notices via WhatsApp. Always manually type the official portal address (incometax.gov.in) into your browser to log in. 2. Enable Higher Security: The e-filing portal offers a feature called 'e-Filing Vault' which adds a crucial layer of security. This is a form of multi-factor authentication (MFA). You can require a second verification step for login, such as an OTP sent to your Aadhaar-registered mobile number, using Net Banking, or a Digital Signature Certificate (DSC). Activating this is one of the single most effective steps you can take. 3. Use Strong, Unique Passwords: Your tax portal password should be complex and unique. Do not reuse a password you use for email or social media. A strong password includes a mix of uppercase and lowercase letters, numbers, and special characters. Consider using a password manager to create and store it securely.
Spotting the Red Flags
Scammers rely on panic and a lack of attention. Learn to spot their tricks. Be immediately suspicious of any communication that: Creates extreme urgency: Messages threatening immediate penalties or offering a limited-time refund are classic scam tactics. Comes from a personal email address: The Income Tax Department will never send official communication from a Gmail or other public email service. Contains spelling or grammar errors: Official communications are typically professionally written and proofread. Asks for sensitive data via email or message: The Department never asks for your password, OTP, or other credentials over email, SMS or phone. * Directs to an odd-looking URL: Hover over links before you click. A real link will be to the 'gov.in' domain. A fake one might use slight misspellings or different endings like '.com' or '.net'.
What to Do If You Suspect a Scam
If you receive a suspicious message, do not respond, click any links, or download any attachments. You can report phishing attempts to the tax department. The government encourages forwarding suspicious emails to webmanager@incometax.gov.in and reporting cyber fraud incidents to incident@cert-in.org.in or through the national cybercrime reporting portal. If you believe your account credentials have been compromised, log in immediately (by typing the official URL) to change your password and review your registered email and phone number. Enable the 'e-Filing Vault' higher security options without delay.
