Phishing Email/ Letter Scam
Beware of phishing emails and letters spoofing IRAS’ identity. Don’t fall for it!
For phishing email and letter scams, you will receive threatening emails and letters purportedly from “IRAS”, informing you of supposed tax discrepancies in your taxes. You will be instructed to pay outstanding taxes to a designated bank account or file tax returns to avoid penalties. If you click on the phishing link, you will then be directed to phishing websites where they would be required to select their preferred refund method, i.e. debit or credit card, and provide their card details and One-Time Passwords (OTPs).
Other variants of the phishing email scam solicit victims’ personal particulars (bank account details, One-Time Password or credit card information) as a requirement to comply with a tax audit or review by IRAS or before they can view their Tax Clearance certificate.
What’s legit from IRAS?
- Any communication from IRAS on confidential tax matters are done via myTax Portal. All IRAS notices and letters to taxpayers are deposited in myTax Portal (mytax.iras.gov.sg). You will never receive any confidential tax information and tax documents such as tax returns, notices of assessment, tax refund letters via emails. myTax Portal is a secured and personalised portal for taxpayers to manage tax transactions with IRAS. Taxpayers have to log in to the portal using their Singpass authentication.
For taxpayers who have updated their mobile number/email address, they will be informed via SMS/email to log in to myTax Portal to view their notices or letters. - IRAS websites will have the lock icon beside the URL which signals that data traffic within the site is encrypted.
Screenshots of spoofed IRAS website/documents:
 |  |
 |  |
 |  |
 |  |
 |  |