What Exactly Are Cloned Websites?
A cloned website is more than just a suspicious link; it's a complete, fraudulent copy of a legitimate site. Scammers meticulously replicate the look, feel, and functionality of the official Indian Income Tax Department portal. Every logo, form field,
and button is designed to look authentic. The goal is to create a near-perfect illusion, so you feel safe entering your most sensitive information, such as your PAN, Aadhaar number, password, and bank account details. These fake sites are the final destination in a phishing attack that usually starts with an urgent-sounding SMS, WhatsApp message, or email.
The Refund and Penalty Trap
Scammers exploit two powerful human emotions: the hope of receiving money and the fear of penalties. After the tax filing season, many people are eagerly awaiting refunds. Criminals capitalize on this by sending messages claiming a refund has been approved and requires you to 'verify' your details to receive the payment. Conversely, they also send fake notices threatening legal action or hefty fines for supposed tax discrepancies, urging you to log in and resolve the issue immediately. Both tactics are designed to create a sense of urgency, pressuring you to click the malicious link without thinking. The link then directs you to the cloned portal where your data is stolen the moment you enter it.
It's More Than Just Money
While immediate financial loss is a significant risk, the theft of your personal information from these cloned sites can have long-lasting consequences. With your PAN, Aadhaar, date of birth, and login credentials, criminals can commit identity theft. They might file fraudulent tax returns in your name to divert future refunds, apply for loans or credit cards, or use your identity for other illegal activities. In some cases, the attachments or links associated with these scams can also install malware on your phone or computer, giving hackers remote access to your device and all the data within it.
Your 5-Point Safety Checklist
Protecting yourself requires vigilance and a healthy dose of scepticism. Here are five crucial steps to add to your digital safety checklist: 1. Always Type, Never Click: The Income Tax Department states it does not send refund links via SMS or WhatsApp. Instead of clicking on links in unsolicited messages, always manually type the official URL, incometax.gov.in, into your browser's address bar to access the portal. 2. Inspect the URL and Padlock: Before entering any information, look at the website's address. Cloned sites often use URLs that are slightly misspelled, like 'incometax-gov.in' or have an unusual ending like '.xyz' or '.ink'. The official site will always start with 'https' and display a padlock icon, signifying a secure connection. 3. Question All Unsolicited Contact: The tax department will not ask for your password, OTPs, or credit card details via email or SMS. Any message that creates panic or promises an unexpected windfall should be treated as a red flag. All official communication regarding your tax filings will be available within your account on the official portal. 4. Use Unique, Strong Passwords: Avoid using the same password for your tax portal and other online accounts. A strong password, combined with multi-factor authentication where available, provides a critical layer of security. 5. Verify Through Official Channels: If you receive a suspicious message about a refund or a notice, don't engage with it. Log in directly to the official Income Tax portal to check your refund status or see if there are any outstanding notices or demands. This is the only reliable way to verify the information.
