Income Tax Scam 2026: How Fake WhatsApp Notices Steal Banking Details:

Cybercriminals are targeting taxpayers during the Income Tax Return (ITR) filing season by sending fake Income Tax Department notices through WhatsApp and other messaging platforms. According to a report by Bengaluru-based cybersecurity firm CloudSEK, the scammers are using fake government documents, cloned tax websites and malware to steal banking details and take control of victims' devices.

The scam comes at a time when millions of people are waiting for tax refunds, notices and other official updates. Since taxpayers expect such messages during the filing season, they are more likely to believe fake communications.

An expert said the attackers are using two main methods. One involves sending WhatsApp messages with malware-infected ZIP files, while the other uses fake websites that look almost identical to the official Income Tax e-filing portal.

In the WhatsApp scam, victims receive a fake “Office Memorandum” from an unknown or compromised number pretending to be the Income Tax Department. The document seems to be genuine as it bears the emblem of Government of India, English and Hindi text, fake reference numbers and name of a fake tax official.

The notice states that discrepancies were found under section 271(1)(c) of the Income Tax Act and threatens prosecution under section 276C. It allows 72 hours for recipients to respond, adding a sense of urgency.

The message contains a ZIP file named “ITD zip” instead of a website link, and claims that it contains tax related documents. On Android devices, opening the file can install malware that can access SMS messages, including banking OTPs, contacts and keystrokes. It can also present fake login screens for banking or payment apps to capture usernames, passwords and other sensitive information.

People opening the ZIP file through WhatsApp Web face another risk. The file can install a malicious Windows program disguised as an income tax notice, allowing attackers to gain remote access to the infected computer.

The report also found that the ZIP file has been shared in different sizes, including 2 MB, 34 MB and 35 MB. This helps attackers avoid detection by antivirus software that relies on fixed file signatures.

In another scam, fraudsters direct users to fake websites that closely resemble the official Income Tax e-filing portal. These websites ask users to enter their PAN, Aadhaar number, password, OTP and bank account details, which can then be stolen.

The cybersecurity firm warned that this campaign is linked to earlier tax-related malware attacks that spread remote-access tools and information-stealing software. It advised users to treat any such infection as a serious security threat.

Tax experts said tax filing season gives cybercriminals an opportunity to exploit people's trust and urgency. By using fake government notices, legal references and malware, the attackers try to convince victims that the messages are genuine and bypass normal security checks.