"Revenue tax refund" phishing

"You are due a tax refund" — by SMS or email. The link goes to a fake Revenue login page. Anything you type into it is captured and used to access (or impersonate) your real Revenue account, or to charge a card you authorise on the fake page. Garda-documented for years; spikes hard in January and February when real tax-balancing happens.

What the scam looks like

A text or email that claims to be from Revenue, the Office of the Revenue Commissioners, or "Revenue Ireland" telling you that:

• You are due a tax refund of a specific amount (often €280-€640 — the numbers are chosen to be believable rather than suspiciously round).
• The refund will be issued once you "verify your details" or "confirm your bank account" via a link.
• The refund will be cancelled if you don't act within a specified time (24-72 hours).

The link goes to a page that looks very like the Revenue login or MyAccount entry page, but on a domain that isn't revenue.ie. The fake page asks you for your PPS number, your MyAccount or MyGovID credentials, your bank account or card details, or all of the above.

How to recognise it

• Revenue does not initiate refunds by SMS. They use myAccount messaging or post.
• Revenue does not send tax-rebate notices by email or text unless you have already completed an online application yourself.
• Revenue will never ask you for your logon credentials or card details in an email. They have them already.
• Check the sender's email address carefully. The domain is almost never revenue.ie; it's a lookalike (revenue-ireland.com, revenuetax.ie, etc.).
• Hover over the link before clicking. Real Revenue URLs are on revenue.ie or ros.ie.

What to do if you received it but haven't responded

1. Don't click the link. Don't reply.
2. Forward the SMS to 7726.
3. Forward the email to reportphishing@garda.ie.
4. Delete the message.

What to do if you clicked or entered details

1. Change your Revenue myAccount and MyGovID passwords immediately

   If you used the same password elsewhere, change it everywhere too. See our password reset guide.

2. If you entered card or bank details, contact your bank's fraud line

   Use the phone number on the back of the card, not any number from the suspicious email/text. Freeze or cancel the card.

3. Report it to An Garda Síochána

   Visit your local station to get a PULSE incident number. This is the reference your bank and any insurer will ask for.

4. Check your Revenue myAccount for unauthorised changes

   Have any contact details, bank account details, or filing instructions been changed? If yes, report to Revenue directly via the contact details on revenue.ie.

5. Work the full first-24-hours checklist

   See First 24 hours for the wider lockdown sequence.

Primary sources

• An Garda Síochána — Revenue tax-refund phishing (primary guidance).
• Revenue.ie — official channel.
• FraudSMART — Banking & Payments Federation Ireland.