Cybercriminals are using fake income tax notices sent via WhatsApp and phishing sites to steal banking details and personal information. These scams often include malicious files that can capture OTPs and login credentials. Investors and taxpayers should verify all communications only through the official Income Tax portal to avoid financial loss.
During the current tax filing season, there has been a notable rise in fraudulent activities targeting taxpayers across India. Cybersecurity firm CloudSek has reported that attackers are impersonating the Income Tax Department to steal sensitive financial data, banking passwords, and personal credentials.
Deceptive Tactics and Malware Risks
Fraudsters are sending forged documents, often labeled as office memorandums, through unofficial WhatsApp accounts. These messages frequently cite specific sections of the Income Tax Act, such as Section 271(1)(c), to create a sense of urgency or fear, threatening legal action if a response is not provided within 72 hours. These communications often include a ZIP file attachment. When downloaded on Android devices, this file acts as malware, allowing attackers to intercept SMS messages, including bank-generated one-time passwords (OTPs). This access enables them to bypass security layers and gain control over financial accounts.
Phishing Sites Mimicking Official Portals
Beyond malware, attackers are creating sophisticated phishing websites that closely mirror the official income tax e-filing portal. These websites are designed to trick users into providing highly sensitive information, such as Permanent Account Numbers (PAN), Aadhaar details, and banking login credentials. Once this information is entered, it is sent directly to the attackers, who may then attempt to gain unauthorized access to the victim's bank accounts, investment portfolios, or digital wallets.
Protecting Financial and Personal Data
For investors and taxpayers, maintaining data security is critical to protecting financial assets. The official Income Tax Department does not communicate through WhatsApp, nor does it send attachments that require software installation for document viewing. All genuine notifications are typically delivered through the official e-filing portal, SMS alerts from authorized government headers, or registered email IDs.
To safeguard against these threats, users should ensure they only access the official income tax portal by typing the web address directly into their browser rather than clicking links in messages. Enabling multi-factor authentication on all banking and investment applications is a recommended step to add a layer of security against unauthorized access. If a taxpayer receives a suspicious notice, they should verify its authenticity by logging into the official tax portal independently to check for any genuine pending actions or communications. The primary risk for individuals remains the potential for identity theft and financial fraud, which can have long-lasting effects on an investor's personal financial health.