If you receive emails offering you tax refunds, beware. Do not click on the fraudulent links!
For tax refund scams, you will receive unsolicited emails from scammers purportedly from “IRAS”, informing that you are eligible for refunds due to prior overcharge. If you click on the weblink in the email, you will be directed to a phishing website masquerading as the IRAS website. You will then be instructed to select your preferred refund method, via debit or credit card. Sometimes, the links also download malware such as viruses, ransomware, spyware or adware on your device.
Never disclose your personal; or internet banking details and OTP to anyone. Update your contact details registered with Singpass and enable notifications via Singpass app so that you are promptly alerted of suspicious log-ins, e.g. when a log-in on a new device or Internet browser is detected, and contact Singpass to secure your account.
What's legit from IRAS?
- Any tax refunds are automatically credited into taxpayers’ bank account registered with IRAS or PayNow (NRIC/FIN/UEN) accounts. We do not process tax refunds to credit/debit cards. Taxpayers can check for updates on any refund in IRAS’ myTax Portal. Learn more about refunds.
- IRAS will not send you emails on your tax refund amount. Confidential tax information is retrieved from myTax Portal (mytax.iras.gov.sg).
- Always check before you click on any links in the email that give you instructions to follow some steps to receive the tax refunds. Do not give away your online banking details (username, password or One-Time-Password) or credit card/debit card details.
- Always check the email address even though the sender ID shows ‘IRAS’. Sender ID can be spoofed to make the email looks legitimate. A legitimate email address from IRAS ends with “@iras.gov.sg”.
Check that your email service provider is compliant with Domain-based Message Authentication, Reporting & Conformance (DMARC). The DMARC would be able to identify and filter incoming emails.
Screenshots of tax refund scams:
 |  |