Fake Income Tax Notices on WhatsApp: How to Verify Real Govt Links (2026 Guide)

Difficulty: Beginner
Time: 10 minutes
Prerequisites: None — you just need internet access and, if you want full verification, your PAN number

Why This Matters Right Now

Why this matters: this isn’t a rare or theoretical scam — it’s actively circulating.

Cybersecurity firm CloudSEK has documented an active campaign where fake Income Tax Department notices are sent over WhatsApp and other messaging apps, using forged government documents, cloned e-filing portals, and malware to steal banking credentials and gain remote access to victims’ devices. These fake notices carry the Government of India emblem, bilingual Hindi-English text, fabricated reference numbers, and a fake signatory posing as a tax officer, and they typically cite Income Tax Act sections and give recipients only 72 hours to respond.

The single most important fact to remember: the official Income Tax Department does not communicate through WhatsApp, and it does not send attachments that require installing software to view. Any WhatsApp “notice” fails this test automatically.

Common mistake: Assuming a message is real because it has the government emblem, official-looking language, or cites real legal sections. All of these are trivial for scammers to copy.

Step 1: Check the Channel First — Before Reading the Content

Why this matters: the delivery channel alone tells you 90% of what you need to know.

1. Ask yourself: did this arrive on WhatsApp, SMS from an unknown number, or a personal email — instead of through the official e-filing portal?
2. If yes, treat it as suspicious by default, regardless of how official it looks

Expected result: You’ve filtered out the most common fake-notice delivery method before even reading further.

Warning: CloudSEK observed these scam messages coming from unknown or compromised WhatsApp accounts and even shared inside WhatsApp groups — so a message forwarded by someone you know isn’t proof it’s genuine either.

Step 2: Do Not Open Any Attachment

Why this matters: the attachment is usually the actual attack, not the message text.

1. If a ZIP, PDF, or APK file was shared, do not tap or download it.
2. In documented cases, files named like “ITD.zip” did not contain tax documents at all — they delivered malware instead.
3. If you already opened the file, disconnect from Wi-Fi/mobile data and run a security scan before doing anything else on that device.

Expected result: No malware installed, no credentials stolen.

Step 3: Never Click the Link Inside the Message

Why this matters: fake notices often link to a cloned version of the real portal designed to steal your login and OTP.

1. Do not tap any link in the WhatsApp message, even if it looks like “incometax.gov.in”
2. Instead, open your browser separately and type the address yourself

Expected result: You reach the real portal, not a lookalike.

Tip: Users should only access the official income tax portal by typing the web address directly into their browser, rather than clicking links inside messages.

Step 4: Know the Real Government URLs

Why this matters: scammers rely on lookalike domains that are one character off from the real thing.

The genuine Income Tax Department domains are:

1. https://www.incometax.gov.in — the official e-filing portal
2. https://www.incometaxindia.gov.in — the official CBDT/Income Tax Department informational site

Look for these signs a domain is genuine:

• Ends in .gov.in, not .com, .in alone, .info, or a random domain with “incometax” tacked on
• No extra words, numbers, or hyphens inserted (e.g., incometax-refund-verify.com is fake)
• Loads with a valid HTTPS padlock — but note a padlock alone doesn’t prove legitimacy, since scam sites can have one too; the domain name is what matters most

Expected result: You can visually distinguish a real government URL from a scam lookalike in seconds.

Step 5: Verify the Notice Using Its DIN

Why this matters: every genuine notice has a built-in authenticity check that fakes cannot pass.

1. Most official notices carry a DIN (Document Identification Number), a unique identifier used to verify authenticity
2. Go to the official portal at incometax.gov.in
3. Click “Authenticate Notice / Order issued by ITD” on the e-Filing portal homepage
4. Enter your PAN or DIN, then your mobile number, and verify the OTP sent to you
5. If a matching record exists in the system, the notice is valid; if not, it isn’t genuine

Expected result: A clear valid/invalid confirmation for the specific notice in question.

Common mistake: Assuming no DIN automatically means fake, or a DIN-shaped number automatically means real. Always run it through the actual authentication tool — don’t just eyeball the format.

Step 6: Watch for Pressure Tactics

Why this matters: urgency is the scammer’s main psychological lever, and genuine tax communication doesn’t work this way.

1. Be suspicious of any message demanding action within 24–72 hours
2. Documented fake notices cite sections like 271(1)(c) and 276C and threaten prosecution if the recipient doesn’t respond within 72 hours
3. Be suspicious of any request for OTPs, passwords, or banking details — the Income Tax Department states it never asks for PINs, passwords, or similar access information for credit cards, bank accounts, or other financial accounts through email, and the same applies to WhatsApp

Expected result: You recognize urgency + credential requests as a red flag combination, not a reason to act fast.

Step 7: Report It

Why this matters: reporting helps take down the scam infrastructure and protects others.

1. Do not reply to the message or engage with the sender
2. Report phishing emails or fake tax websites to the Income Tax Department’s official contact channels, and report cybersecurity incidents to CERT-In and the National Cyber Crime Reporting Portal
3. Block the sending number on WhatsApp and delete the message

Expected result: The incident is documented, and you’ve removed the bait from your device.

Troubleshooting

I already clicked the link and entered my PAN or OTP

1. Immediately change your e-filing portal password
2. Contact your bank if any banking OTP or details were entered, and consider freezing/monitoring the account
3. Report the incident to the National Cyber Crime Reporting Portal and your bank’s fraud helpline right away

I’m not sure if a real notice can also arrive by email or SMS

1. Genuine communications can come through the e-filing portal, registered email IDs, or SMS from official government headers — but WhatsApp is not one of them
2. When in doubt for any channel, verify independently through Step 5’s DIN check rather than trusting the message itself

The DIN authentication tool says “no record found” but I think I really owe tax

1. This means the specific document is not genuine — it does not mean you owe nothing
2. Log in to the official e-filing portal directly and check your own dashboard for any real pending notices, demands, or dues, rather than trusting the WhatsApp message

I can’t tell if a shortened or forwarded link is genuine

1. Never trust a shortened link (bit.ly, tinyurl, etc.) claiming to be a government site — genuine government portals don’t need link shorteners
2. Type the known domain from Step 4 directly into your browser instead

What’s Next

• Learn how to check your real pending tax demands directly on the e-filing portal dashboard
• Set up alerts for your registered email and mobile number so you notice unauthorized account activity quickly
• Share this guide with family members who are less familiar with spotting phishing attempts — older relatives are frequently targeted specifically because they’re less likely to double-check