Income tax refund scam SMS: how to spot fake messages and check your real status

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Messages saying your ITR refund is approved, pending or stuck, with a link to 'update bank details', are a classic trap. Check your refund only on incometax.gov.in, never share OTPs or bank details, and report fakes.

01 / Why refund season brings fake messages

Once you file your return, you wait for the refund. Scammers use that wait. In February 2026 the Income Tax Department warned that fraudsters message people expecting refunds, claiming their return is delayed, incomplete or stuck.

The department said these messages use alarming words such as "refund pending", "urgent action required" or "penalty if not verified", with a link. The link leads to a fake site built to collect PAN, bank details and OTPs.

02 / Deadlines in October and November 2026

On 28 September 2026 the Central Board of Direct Taxes (CBDT) moved two due dates for assessment year 2026-27, in Circular No. 07/2026:

• 21 October 2026: the tax audit report (earlier 30 September).
• 21 November 2026: the income tax return (earlier 31 October).

Only the audit category gets these dates. The circular covers taxpayers listed at serial no. 2 of the due-date table in section 139(1) of the Income-tax Act, 1961, broadly those whose accounts must be audited. It is not a general extension. If a message quotes a deadline to you, check it yourself on incometax.gov.in.

Why scammers care: tax deadlines stay in the news until 21 November, so expect refund and "pending demand" messages at least until then. In March 2026 PIB's Fact Check Unit flagged a fake email that claimed a tax demand for AY 2025-26 and linked to an "Assessment Order". A PIB Fact Check alert reported in August 2026 called a message asking for ₹6,000 in income tax a phishing attempt.

Check a demand yourself. A genuine demand appears after you log in, under Pending Actions > Response to Outstanding Demand. There you can say whether you agree or disagree with it, and if it is correct, pay through the portal's own Pay Now button. Never pay a tax demand through a link, QR code or UPI ID sent in a message.

03 / What the fake messages look like

• "Refund approved, update your bank account" SMS or WhatsApp with a link to a lookalike e-filing page.
• Emails asking for "manual verification". In July 2025 PIB's Fact Check Unit flagged a fake email, claiming to be from the department, that asked taxpayers to verify documents or click links to receive a refund.
• APK files. In 2021 CERT-In, the national cyber security agency, warned of Android malware posing as an income tax refund. Victims got an SMS link to a site resembling the department's, then were asked to install an APK. It asked for PAN, Aadhaar, card number, CVV and PIN, and sent them to the attackers. See how APK malware spreads.

04 / What the Income Tax Department officially says

• In a 2016 CBDT press release, the department said it "NEVER asks for your PIN numbers, passwords or similar access information" for cards, banks or other financial accounts through email, and asked taxpayers not to respond to such emails.
• In February 2026 it told taxpayers never to share OTPs or bank details, and to verify communications only on the official portal, incometax.gov.in.
• Its checks for suspicious email: look closely for misspelt domain names; don't open attachments; don't click links; and if you clicked by mistake, don't enter bank or card details.

05 / How to check your real refund status

1. Type incometax.gov.in yourself and log in with your user ID and password.
2. Go to e-File > Income Tax Returns > View Filed Returns.
3. Pick the assessment year and click View Details to see the refund status and your return's life cycle.

The department's manual says processing starts only after you e-verify your return, and a refund usually takes 4–5 weeks. If it fails, common reasons are an inoperative PAN not linked with Aadhaar, a bank account that isn't pre-validated, a name mismatch with PAN, a wrong IFSC or a closed account.

To fix bank details, use My Bank Account after logging in. There you add and pre-validate an account and nominate it for refunds. Queries go to the department's helpdesk: 1800 103 0025 or 1800 419 0025, 8 am to 8 pm, Monday to Friday.

06 / How to report a fake refund message

• Email or fake website: forward it, or the URL, to webmanager@incometax.gov.in and copy incident@cert-in.org.in, as the department advised in February 2026.
• SMS, call or WhatsApp: report it on Chakshu. Unsure? Try our scam check.
• Don't reply, don't forward it to friends, and delete it once reported.

07 / Clicked, paid or shared details?

• Money gone: call 1930 and file under Financial Fraud on cybercrime.gov.in. See our 1930 guide.
• Bank or card details shared: call your bank's official number to block cards and UPI. See bank fraud helplines.
• Installed an APK: uninstall it, then change passwords from another device.
• E-filing account misused: the department asks you to report to the police or cyber cell first, for example on cybercrime.gov.in. Then email your complaint, with the FIR copy, from your registered primary email ID.

08 / Your refund-season checklist

• Check refunds only by logging in at incometax.gov.in.
• Ignore "refund approved" or "refund pending" links.
• Never share an OTP, PIN, password or card details.
• Change bank details only under My Bank Account after login.
• Never install an APK sent in a message.
• Forward fake emails to webmanager@incometax.gov.in and incident@cert-in.org.in.
• Lost money: 1930 and cybercrime.gov.in, then your bank.

09 / Sources and updates

Confirmed (official documents): the new audit-case dates, from CBDT Circular No. 07/2026 of 28 September 2026 on the e-filing portal; the department's 2016 anti-phishing press release; its e-filing help pages on refund status, bank accounts, outstanding demands, helpdesk numbers and account misuse; and PIB's release of 8 October 2025 on the 1930 helpline and CERT-In. Reported (media): the department's February 2026 refund-SMS warning (Business Today); PIB Fact Check's alerts on a fake refund email in July 2025 (Free Press Journal) and on fake tax-demand messages reported in March and August 2026 (Outlook Money); and CERT-In's 2021 warning on refund-themed Android malware (The Tribune). Akashvani and the Times of India also reported the extension.

Update, 2 October 2026: section 02 is new. It gives the extended audit-case due dates from CBDT's circular of 28 September 2026, makes clear that they apply only to the audit category, and adds PIB Fact Check alerts on fake tax demands reported in 2026 and how to check a demand on the portal.