As millions of Indians rush to file their income tax returns and track pending refunds, cybercriminals are capitalising on the chaos with a coordinated wave of phishing and malware campaigns. Cybersecurity firm CloudSEK has flagged two parallel attack tracks, both designed to impersonate the Income Tax Department and exploit the anxiety that builds up during filing season.
Fake Government Notices Carrying Hidden Malware
The first attack vector is spreading through WhatsApp, using forged "office memorandums" complete with the Government of India emblem, bilingual English-Hindi text, fake tracking numbers, and a forged tax officer's signature. To manufacture urgency, these fake notices accuse the recipient of non-compliance under Section 271(1)(c) of the Income Tax Act and threaten criminal prosecution under Section 276C unless they respond within 72 hours.
Instead of pointing victims to any official portal, the message asks them to open a compressed file, usually named ITD.zip. Once opened on an Android phone, this file quietly installs spyware in the background. That spyware can intercept incoming SMS messages, including banking OTPs, harvest contact lists, and log keystrokes to capture account passwords. Some of the more advanced versions go a step further, overlaying fake screens on top of real banking and payment apps to trick users into typing in their authentication codes directly for the attackers.
Cloned E-Filing Portals
Running alongside this is a second campaign using fake websites built to closely mimic the official income-tax e-filing portal. Victims land on these cloned sites through malicious links sent via SMS, fraudulent search ads, or unsolicited emails. Once there, they're prompted to enter their PAN, identity details, passwords, security answers, and banking credentials, handing attackers everything they need for full access to the victim's financial accounts.
What Taxpayers Should Actually Watch For
Tax authorities and cybersecurity experts are urging extra caution during this period, pointing out a few basic but important facts: the Income Tax Department never sends zip files, app installers, or legal notices over WhatsApp or any non-government messaging app. Genuine statutory notices, refund updates, and compliance queries only arrive through registered email, official SMS sender IDs, or the authenticated dashboard on the official e-filing portal, nowhere else.
Given how convincing these fake notices and cloned portals have become, taxpayers are better off avoiding unsolicited links altogether and instead filing, checking refund status, or resolving compliance queries only through verified channels or with the help of professionals offering genuine, verified ITR filing support, rather than clicking through links sent over chat apps or email. Anyone who receives a suspicious message is advised to verify it directly on the official portal and report it to the national cybercrime helpline.
FAQs
Q1. How does the fake WhatsApp notice scam work?
Attackers send a forged government notice via WhatsApp threatening prosecution, then trick the recipient into opening a ITD.zip file that secretly installs spyware capable of stealing OTPs, passwords, and contacts.
Q2. How does the cloned e-filing portal scam work?
Victims are directed via SMS, fake ads, or email to a fake website that looks like the real income-tax e-filing portal, where entering PAN and banking details hands attackers full access to their accounts.
Q3. How can taxpayers tell a real tax notice from a fake one?
The Income Tax Department never sends zip files, app installers, or legal notices via WhatsApp; genuine communication only comes through registered email, official SMS IDs, or the authenticated e-filing portal dashboard.