Tax Filing and Payment Scam

Beware of phishing emails, letters and SMSes spoofing IRAS’ identity and demanding you to file or pay taxes. Don’t fall for it! 

For tax filing and payment scams, you will receive threatening correspondences purportedly from “IRAS”, informing you of supposed tax discrepancies in your taxes. You will be instructed to pay outstanding taxes to a designated bank account or file tax returns to avoid penalties. If you click on the phishing link, you will then be directed to phishing websites where they would be required to select their preferred refund method, i.e. debit or credit card, and provide their card details and One-Time Passwords (OTPs).

Other variants of this scam type solicit victims’ personal particulars (bank account details, One-Time Password or credit card information) as a requirement to comply with a tax audit or review by IRAS or before they can view their Tax Clearance certificate.

What’s legit from IRAS?

• Any correspondences from IRAS on confidential tax matters are done via myTax Portal. All IRAS notices and letters to taxpayers are deposited in myTax Portal (mytax.iras.gov.sg). You will never receive any confidential tax information and tax documents such as tax returns, notices of assessment, tax refund letters via emails or SMEes. myTax Portal is a secured and personalised portal for taxpayers to manage tax transactions with IRAS. Taxpayers have to log in to the portal using their Singpass authentication. 
  
  For taxpayers who have updated their mobile number/email address, they will be informed via SMS/email to log in to myTax Portal to view their notices or letters. 

• GIRO is the preferred payment mode for tax payments. Taxpayers can enjoy hassle-free and interest-free monthly installments (for Individual Income Tax, Corporate Income Tax and Property Tax) with GIRO payment.  We do not send correspondences with links to make payment. Learn more about tax payments.

•  IRAS websites will have the lock icon beside the URL which signals that data traffic within the site is encrypted.

Screenshots of spoofed IRAS website/documents: