Fake IRD Refund Messages 2026: How to Spot a Tax Scam
How to tell a real IRD refund message from a scam in 2026 — the signals, what Inland Revenue will and won't do, and how to verify your real refund.
Published 1 May 2026 · Reviewed by NZ Tax Tools Editorial Desk
Tax Refund Estimator →
See whether IRD owes you a refund (or you owe them) before the 7 July deadline.
The 2025-26 NZ tax year ended on 31 March 2026, and IRD’s automatic assessment (square-up) window runs from May through July. That timing makes the next few months prime season for fake refund messages — scammers know taxpayers are expecting IRD contact and looking for refunds. This guide explains how to tell a genuine IRD message from a fake one, what the current 2026 scam patterns look like, and what to do if you’ve already clicked a link or shared details.
How to tell a genuine IRD message from a scam
Per IRD’s published guidance, the following rules apply to every message from Inland Revenue:
- IRD includes your name when they email you — a greeting of “Dear customer,” “Dear taxpayer,” or no name at all is a red flag. Legitimate IRD emails address you by name.
- IRD does not provide links in their emails — if an email claiming to be from IRD contains a clickable link, it is fake. Genuine IRD emails direct you to log in to myIR yourself at ird.govt.nz.
- IRD will not send you links in text messages — any SMS with an IRD logo or name that contains a link is a scam, no exceptions.
- IRD does not send messages from a “MyIR Team” — that sender label does not exist. Any SMS or email signed off as “MyIR Team” is fraudulent.
- IRD will never make you pay to apply for an IRD number — applying for an IRD number is free through IRD’s official process.
- The genuine IRD domain is ird.govt.nz — any domain variation (myir-nz.com, ir-d.co.nz, ird-refund.co.nz) is fake. Check the URL carefully before you log in anywhere.
Common 2026 scam patterns
SMS and text scams
Scammers are sending texts impersonating IRD using the “MyIR Team” label — a sender name IRD itself does not use. These messages typically use link shorteners to hide the destination URL, create artificial urgency (“your refund expires in 24 hours”), and lead to pages that mimic the myIR login screen to harvest your RealMe credentials. Some variants prompt a “password reset” before displaying a fake refund claim form.
Email and phishing
Phishing emails spoofing IRD are typically identified by the absent or generic greeting, a subject line formatted like a tax assessment notice, and a prominent “Log in to myIR” button embedded in the email body. IRD does not include such buttons. Some emails also contain PDF attachments labelled as tax assessment summaries or refund forms — these PDFs often contain macros or links to credential-harvesting sites.
Fake website and advertising scams
Scammers are advertising fake IRD-number-application websites on Google, X (Twitter), Facebook, and Instagram. These sites charge fees (sometimes $30–$80) for a service that is completely free through the genuine IRD website, and collect your personal information, bank account details, or identity documents in the process. IRD does not advertise its free services through paid social media or search ads.
What Inland Revenue will and won’t do
IRD will:
- Contact you through your myIR inbox for official correspondence
- Address you by name in any legitimate email
- Provide phone numbers published at ird.govt.nz for you to call back and verify
- Issue automatic assessments through myIR, not through unsolicited SMS links
- Never charge a fee for IRD number applications
IRD won’t:
- Include links in emails or text messages
- Demand payment via gift cards, cryptocurrency, or wire transfer to release a refund
- Threaten arrest, deportation, or legal action via unsolicited text or phone call
- Request remote desktop or screen-sharing access to your device
- Label itself “MyIR Team” in any outbound message
For the full list of what IRD does and does not do, see the IRD scams page.
If you’ve already clicked a link or shared details
- Do not reply or click any further links. Engaging further increases your exposure.
- Forward suspicious text messages to short code 7726 (Spam Alert) — it’s free and works with all major NZ carriers.
- Report the scam to Inland Revenue at ird.govt.nz/managing-my-tax/scams/let-us-know-about-a-scam so IRD can take down the site and warn other taxpayers.
- Change your passwords immediately — myIR, RealMe, email, and online banking. Enable two-factor authentication on each if you haven’t already.
- Monitor your myIR account for unauthorised changes — if you shared your IRD number, contact Inland Revenue directly using the numbers published at ird.govt.nz to flag potential misuse.
- Contact your bank immediately if you entered payment or banking details on the fake site.
Verify your real refund before trusting any message
Genuine IRD refunds appear in your myIR account on IRD’s published assessment timeline. For most PAYE earners the square-up runs from late May through July 2026, following employer finalisation of March 2026 PAYE filings. The correct way to check your situation is to log in to myIR directly at ird.govt.nz — not via any link in a message. Our refund estimator can give you a quick read of whether IRD is likely to owe you money before you check myIR, so you know what to expect and aren’t caught off guard by a scammer claiming a large refund you weren’t expecting.
Last verified 2026-05-01. IRD scam-warning guidance for the 2025-26 NZ tax year.