The Threat of Cloned Portals
Cybercriminals are increasingly using cloned websites in their phishing campaigns. These are fraudulent sites designed to look nearly identical to the official Income Tax Department e-filing portal. Scammers send out mass emails, SMS messages, and even
WhatsApp texts containing links to these fake pages. The messages often create a sense of urgency, promising a large tax refund or threatening severe penalties for supposed tax discrepancies. Because many taxpayers are expecting official communication around this time, they are more likely to click without thinking, falling into the trap. The goal is simple: to trick you into entering your sensitive login credentials, PAN, Aadhaar number, and banking details.
How the Scam Unfolds
The process is designed to exploit trust and fear. It usually begins with an unsolicited message that appears to be from the Income Tax Department. It might claim your refund is approved and needs verification, or that a penalty notice has been issued. Some recent scams involve sending attachments, like a 'ITD.zip' file, which contain malware that can steal data from your phone or computer. If you click the link, you are taken to the cloned website. Once you enter your login details on the fake portal, the scammers capture them. They can then access your real e-filing account, potentially change your registered bank details to divert your refund, or use your stolen data for identity theft and other financial frauds.
Key Red Flags of a Fake Website
Vigilance is your best defence. Always check for these warning signs before entering any information. First, inspect the website URL carefully. The official portal is incometax.gov.in. Scammers use slightly altered domains like 'incometax.info' or addresses with misspellings and extra characters. Second, be wary of the sender's email address. Genuine communications from the department will only come from addresses ending in '@incometax.gov.in'. Emails from public domains like Gmail or others are fraudulent. Third, look for poor grammar, spelling mistakes, or unprofessional design on the website. Official government portals are typically well-maintained. Finally, remember that the Income Tax Department never asks for your PINs, passwords, or detailed bank information via email or SMS to process a refund. A request for such information is a definite red flag.
Your Checklist for Staying Safe
To protect yourself, adopt a few simple but effective habits. The most important rule is to never click on links in unsolicited tax-related emails or messages. Instead, always type the official URL, incometax.gov.in, directly into your browser to access your account. Any genuine notice, intimation, or refund status will be available on your personal dashboard on the official portal. You can also use the 'Authenticate Notice/Order Issued by ITD' feature on the portal to verify any communication using the Document Identification Number (DIN). Enable two-factor authentication wherever possible for an added layer of security. Use updated antivirus and anti-malware software on your devices to protect against malicious attachments.
What to Do If You Suspect a Scam
If you think you have received a phishing message or visited a cloned website, do not panic. Do not reply, click any more links, or download attachments. You should immediately report the incident. Forward suspicious emails to webmanager@incometax.gov.in or report them on the National Cyber Crime Reporting Portal at cybercrime.gov.in or by calling the helpline number 1930. If you believe you may have entered your details on a fake site, change your e-filing portal password immediately. You should also contact your bank to alert them of potential fraud and monitor your financial statements closely for any unauthorised activity.
