The Internal Revenue Service opened its 2026 Dirty Dozen campaign by warning that phishing and smishing texts—many with QR codes that open fake IRS portals—are again the fastest way criminals harvest Social Security numbers and bank details during fall enrollment and tax-planning season.
Commissioner Danny Werfel’s annual list ranks consumer-facing scams that spike when taxpayers are distracted. For 2026, impersonation by email and text sits at the top, followed by promises of inflated refunds, fake charities, and aggressive “tax debt” shakedowns. The through-line is urgency: scammers want you to tap before you think.
How QR smishing works
In the smishing version, a text claims your refund is held up or your account must be “verified.” Instead of a normal link, the message embeds a QR code. Scanning it loads a site that mimics IRS branding and asks for credentials, images of your driver’s license, or direct-deposit changes. The IRS said investigators logged more than 600 social-media impersonators in fiscal 2025, and text volumes rise every autumn as Medicare and marketplace open enrollment overlap with tax extension follow-ups.
Older scripts still work: callers posing as agents threaten arrest unless you buy gift cards and read off PINs. Treasury Inspector General for Tax Administration data show thousands of victims reporting losses since 2013, with hundreds of millions of dollars stolen through impersonation schemes.
What to do with a suspicious message
If you receive an unexpected IRS-related text, do not reply, tap links, or scan QR codes. The IRS asks you to forward the sender’s number and message body to phishing@irs.gov with the subject line “Text,” then delete the thread. You can also forward the text to 7726 (SPAM) so carriers can block similar bursts.
For phone calls, hang up and report impersonation to TIGTA at 800-366-4484 or through its online complaint form. Gift-card payment demands are always fraudulent; legitimate tax bills arrive by mail first and offer multiple payment options through IRS.gov.
Protecting relatives who are not online daily
Share a simple rule with parents and grandparents: the IRS will not call about a surprise refund or threaten immediate arrest. If someone claims to be from Medicare, the Social Security Administration, or the IRS on the same call, treat it as a composite scam—those agencies do not joint-dial taxpayers.
When you need real help, start at IRS.gov or call the number printed on your last notice. Free tax preparation through Volunteer Income Tax Assistance sites opens again in late January, but fall is when criminals prime the pump. Deleting one convincing text this week is cheaper than unwinding identity theft next spring.