Fake tax-refund texts send people to cloned login pages.

Defense move

Open your tax account from a bookmarked URL or the official app — never from a link in a text or email.

This forecast is a nowcast.Every level is backed by verified activity or a documented seasonal pattern — never a guess.

Why it's "Watch" today

We don't predict the future. This level reflects what is verifiably happening right now.

Documented recurring pattern

Refund-themed impersonation is a year-after-year pattern: the IRS lists phishing and smishing among its annual "Dirty Dozen" warnings, and refund lures keep circulating well after the April filing deadline while refunds are still being processed — a recurring, sourced pattern, labeled as a seasonal factor.

IRS "Dirty Dozen"

We never invent a number or a "tomorrow." If we can't source it, we don't raise the level. How we forecast ›

Active right now

The scams behind today's level.

WatchTax-refund smishing

"You're owed a refund" texts link to a cloned government login that harvests your details.

Read the guide

WatchParcel "redelivery" fees

Fake delivery notices ask for a small fee to release a held parcel — a card-skimming trap.

Read the guide

Editorial, not algorithmic. Risk levels are a transparent editorial judgment based on a published rubric — with sources, never pseudo-precise scores.

Get the forecast in your inbox

The weekly Deception Forecast, plus urgent alerts when the level jumps to High or Severe.

Subscribe free