Be alert to scammers this 2026 tax season

How to protect yourself from tax-related scams

• Think before you click

  Phishing messages and social media posts are designed to look authentic and can be hard to detect. There are a few ways to tell the fake messages from the real ones. 

  • If it’s an email, check that the part of the email after the @ is ‘ird.govt.nz.’  
  • If it’s a text, check that it is from a 4-digit code. Inland Revenue will not send a message from a mobile phone or overseas number.
  • If it’s a social media post, it will be from the official Inland Revenue Facebook or LinkedIn social media pages.
  • If the message includes a website address, check that the link is to the official website - ird.govt.nz
  • If the message has a link to myIR in it, do not click it. Inland Revenue does not send links directly to your myIR account.
  • IRD will not put refund amounts in emails or texts.

  You can find more information on Inland Revenue’s website about the latest scams and tips on identifying phishing messages. 

  Latest scams(external link)

• Two-factor authentication

  Turning on two-step verification, also called two-factor authentication (2FA), for your important accounts is extremely effective against phishing attacks. This is where you enter a code as well as your password to access an account.

  Some phishing scams may attempt to phish your 2FA code, too. Check that the 2FA message matches what you are trying to do. For example, if you are trying to log in but the 2FA message is about a password reset, it could be a phishing attack.  

• Long strong and unique passwords

  Use long, strong and unique passwords for your myIR account and email. Long passwords or passphrases are harder for scammers to guess. And make sure you use different passwords for each account. That way even if they get one password, an attacker can't use it to get into your other accounts. 

  Create good passwords