Fake IRS Letter in 2026: How to Spot the Scam (With Photos of Every Red Flag)

The envelope looks official. There's an IRS-style eagle in the corner, a 'Department of the Treasury' return address, a bar-coded tracking number, and the words FINAL NOTICE — INTENT TO LEVY across the top in red. Inside, the letter tells you that you owe $4,872.63 in back taxes, that a lien has already been filed against your Social Security, and that unless you call the number listed within 48 hours to arrange 'settlement,' agents will be dispatched to your home. Your heart pounds. You reach for the phone. That single decision is what every fake IRS letter is engineered to produce — because on the other end of that line is not the IRS. It's a criminal call center that will empty your bank account, one panicked minute at a time.

The Treasury Inspector General for Tax Administration (TIGTA) reports that IRS-impersonation scams have already cost Americans more than $110 million in confirmed losses — and unlike email phishing, the physical-mail version disproportionately targets retirees, because a printed letter with a Treasury seal feels legitimate in a way a Gmail scam never could. Fake IRS letters spike every year between January and August. In 2026, TIGTA is warning that a new wave of counterfeit mailings — some with QR codes, some referencing real (but expired) tax cases — is now landing in mailboxes across all 50 states.

This guide is the last one you'll ever need. In the next ten minutes you'll learn the exact anatomy of a fake IRS letter, the 8 red flags that give every counterfeit away, the real IRS phone numbers and addresses, and — if you already called or paid — the first-24-hour recovery plan that has helped Safe Retire Watch members recover the majority of their losses.

How the fake IRS letter scam actually works

The scam is a three-stage funnel. Once you see all three stages, the red flags in stage one become obvious the next time a letter lands in your mailbox.

1. Stage 1 — the mailed letter. A convincing 'Final Notice,' 'Intent to Levy,' or 'CP2000 Underreporter' arrives with a Treasury-style seal, a fake case number, and a specific balance due. The letter demands you call a phone number (not IRS.gov) within 24 to 72 hours. This is the only step that costs the scammer anything — a stamp — so the letter is designed to convert on that single phone call.
2. Stage 2 — the phone call. A polite 'Revenue Officer' with an American-sounding name (often 'Officer Michael Johnson, Badge #4471') answers. He reads back your name, address, and last four of your Social — data he already bought on the dark web from an old breach — to establish authority. He then offers to help you 'resolve the debt today' with an immediate payment or a same-day settlement discount.
3. Stage 3 — the drain. He instructs you to buy gift cards, wire funds to a 'Treasury holding account,' send cryptocurrency to a QR code, or install remote-access software so he can 'process the settlement' from your online banking. Each of these is one-way money. Once it's gone, it's gone. The whole call, start to finish, typically lasts 30 to 90 minutes.

8 red flags in every fake IRS letter

1. Payment demand in gift cards, cryptocurrency, wire, or prepaid debit. The IRS accepts payment by check, direct debit, credit card (through IRS.gov/payments), or an installment agreement. It has never — not once in its entire history — asked anyone to pay in Target, Apple, Google Play, or Best Buy gift cards. This single tell identifies 95% of scam letters instantly.
2. A phone number the IRS doesn't publish. The real IRS numbers are 1-800-829-1040 (individuals), 1-800-829-4933 (businesses), and 1-800-829-3676 (forms). If the letter lists any other number and asks you to call it — especially with a 24- or 48-hour deadline — it is a scam.
3. No valid notice code in the top-right corner. Every real IRS letter is labeled with a code: CP14 (balance due), CP2000 (underreporter), CP504 (final notice — balance due), LT11 (intent to levy), Letter 5071C (identity verification). Fake letters either invent a code that doesn't exist ('FTL-2026-A') or use one that doesn't match the letter's content. Search the code at IRS.gov/notices — if it doesn't return that exact form, the letter is fake.
4. Threats of arrest, deportation, license revocation, or immediate levy without appeal. Real IRS collections follow a documented sequence: CP14, then CP501, then CP503, then CP504, then LT11 with 30-day appeal rights. It does not skip to 'call today or a warrant will be issued.' The IRS itself publishes this: 'The IRS will not threaten to immediately bring in local police or arrest you.'
5. A QR code for payment. The IRS does not accept payment through QR codes on mailed letters, ever. A QR code on 'IRS' mail always leads to a scam payment portal, a fake IRS.gov look-alike, or a crypto address.
6. Wrong return address. Real IRS letters come from a small list of service centers: Austin, TX; Fresno, CA; Kansas City, MO; Ogden, UT; Memphis, TN; Philadelphia, PA; Andover, MA; Atlanta, GA; Cincinnati, OH; Holtsville, NY. Fake letters use P.O. boxes in Dover DE, Wilmington DE, Reno NV, or private mail forwarders. Google the return address — if it's not a real IRS service center, it's fake.
7. Odd formatting: misspellings, awkward grammar, mixed fonts, blurry seal, or a signature block for a 'Senior Revenue Officer' whose name doesn't exist in the IRS employee directory (yes — you can look up real IRS employees by name at IRS.gov/help). Real IRS letters are boring, formulaic, and grammatically clean.
8. A precise, non-round balance designed to feel calculated. Amounts like $4,872.63, $9,281.47, or $12,543.29 are meant to look like a real audit result. In reality, the number is randomized to look believable — the scammer has no idea what you actually owe (usually nothing).

The 5 fake IRS letter templates circulating in 2026

Every counterfeit IRS letter in the wild right now is a variation on one of these five templates. Photograph the letter and text it to a family member before doing anything.

1. The 'Final Notice — Intent to Levy'

The most common variant. Mimics the real LT11 but skips the 30-day appeal notice. Says a levy will be placed on your Social Security, bank account, or wages in 48 hours unless you call a listed number. The real LT11 gives you 30 days and a Form 12153 appeal option — never 48 hours.

2. The fake CP2000 'Underreporter' notice

Claims a 1099 from Coinbase, PayPal, eBay, or Venmo shows income you didn't report and you owe $3,000–$8,000 plus penalties. Real CP2000s give you 30 days to respond and include a detailed side-by-side comparison of your return vs. reported income. Fake ones skip the comparison and demand payment.

3. The 'Settlement Offer' letter

Claims you qualify for a 'one-time settlement discount' — pay 40% today and the rest is forgiven. Impersonates the real Offer in Compromise program. The real OIC requires a formal Form 656 application, financial disclosure, and takes 6–12 months. It is never offered by phone or mail deadline.

4. The 'Tax Refund Verification' letter (Letter 5071C look-alike)

Says the IRS held your refund pending identity verification and asks you to call a number or scan a QR code to 'confirm your Social Security number and bank routing.' The real Letter 5071C directs you to idverify.irs.gov and a specific IRS phone number — never a QR code and never asks for bank routing.

5. The 'Certified Mail — Federal Case' letter

Arrives with a fake USPS Certified Mail sticker and language like 'DOCKET #2026-CV-4471' or 'FEDERAL CASE FILED.' Uses legal jargon to imply court action. The IRS does not file federal court cases against individual taxpayers over routine balances — it uses administrative collection (liens, levies) with documented appeal rights.

What happens if you call the number on the letter

The mailed letter is only the bait. The trap is the call. Here is the exact playbook the criminal call center runs so you can recognize it — even if the scammer sounds calm, professional, and knows details about you.

• Step 1: 'Officer Michael Johnson, Badge #4471, Department of the Treasury.' He reads back your name, address, and last four of your SSN from an old data breach to establish authority.
• Step 2: He 'pulls your file' and confirms the balance, adding penalty language and interest to make the number climb minute by minute — creating urgency.
• Step 3: He offers a same-day settlement discount. To process it, he needs immediate payment by 'Treasury-approved' methods: iTunes / Target / Google Play / Best Buy gift cards, a wire to a 'Treasury holding account,' cryptocurrency to a QR code, or remote access to your computer to 'complete the settlement portal.'
• Step 4: If you push back, he escalates: sheriff en route, license suspended, Social Security frozen. If you comply, he stays on the line until the money leaves — 'don't hang up, stay on with me until confirmation, or the settlement is void.'
• Step 5: The call ends. Money is gone. The number stops working within 24 hours.

The only real IRS phone numbers and websites

Bookmark these somewhere reachable in a panic. Never trust a number printed on an unsolicited letter — always type IRS.gov yourself into a fresh browser tab.

• IRS individuals: 1-800-829-1040 (Monday–Friday, 7am–7pm local time).
• IRS businesses: 1-800-829-4933.
• IRS identity theft: 1-800-908-4490.
• TIGTA (report an IRS-impersonation scam): 1-800-366-4484 or tigta.gov/reportcrime.
• Phishing IRS letters and emails: forward or mail to phishing@irs.gov.
• IRS notice lookup: IRS.gov/notices — search the exact CP or LT code from your letter.
• IRS Taxpayer Advocate (free help if you have a real dispute): 1-877-777-4778.

How to verify any IRS letter in under 5 minutes

1. Look at the top-right corner. Find the notice code (e.g. CP14, CP2000, LT11, Letter 5071C). If there isn't one, the letter is fake.
2. Open IRS.gov/notices in a fresh browser tab. Search the exact code. Confirm the sample letter shown matches yours in tone, format, and content.
3. Log in at IRS.gov/account (the real IRS Online Account) to see your actual balance, unpaid notices, and payment history. If nothing matches the letter, it's fake.
4. If in doubt, call 1-800-829-1040 yourself. Do not use the phone number on the letter. Wait times can be long — that's a good sign; scammers never make you wait.
5. Photograph the letter and text it to a trusted family member. A second pair of eyes catches the seal blur, misspellings, or wrong return address you might miss under stress.

First 24 hours if you already called or paid

The next 24 to 72 hours matter more than everything after. Move calmly, in order — every step is free, and each dramatically improves your odds of recovery.

1. If you installed remote-access software (AnyDesk, TeamViewer, UltraViewer, LogMeIn): disconnect the computer from the internet, then have a trusted family member uninstall it and run Malwarebytes or Windows Security. Do not use that computer for banking until it's clean.
2. Call your bank's fraud line and every card issuer. Freeze cards, dispute any pending charges under Regulation E (debit) or Regulation Z (credit). Chase 1-800-935-9935. Bank of America 1-800-432-1000. Wells Fargo 1-800-869-3557. Citi 1-800-950-5114. Capital One 1-800-227-4825. Discover 1-800-347-2683. Amex 1-800-528-4800.
3. If you sent gift cards, call the retailer's fraud line and read the card numbers — Target, Apple, Google Play, Amazon, and Best Buy can sometimes freeze unspent balances. Keep the physical cards and receipts.
4. If you wired money, call your bank immediately and ask them to recall the wire. Domestic wires can occasionally be reversed within 24 hours if the receiving account hasn't drained.
5. Change your email, bank, and IRS.gov account passwords from a different device. Turn on two-factor authentication (2FA) on all three.
6. Freeze your credit at all three bureaus (free, 5 minutes each): Equifax 1-800-685-1111, Experian 1-888-397-3742, TransUnion 1-888-909-8872.
7. Request an IRS Identity Protection PIN (IP PIN) at IRS.gov/ippin. This 6-digit number is required on every future return and blocks anyone from filing in your name.
8. File reports: TIGTA at tigta.gov/reportcrime, FBI IC3 at ic3.gov, FTC at reportfraud.ftc.gov, and your state Attorney General. If you're over 60, call the free National Elder Fraud Hotline at 1-833-372-8311 for a DOJ case manager.
9. Forward the letter's photo (and any emails/texts) to phishing@irs.gov and mail the original letter to IRS, ATTN: Phishing, 1973 N. Rulon White Blvd, Ogden UT 84404.

Free tools to catch the next one

Safe Retire Watch has three free AI tools built for exactly this scam pattern. Paste the message or scan the letter and get a plain-English verdict in seconds — no account, no credit card.

• Scam Check — paste any suspicious message and get an instant AI verdict on whether it's a scam.
• Email Explainer — paste a suspicious email and get a line-by-line breakdown in plain English, with every red flag highlighted.
• Phone Check — enter the number on the letter and see if it's already been reported as an IRS-impersonation scam.

The bottom line

Fake IRS letters are engineered by full-time criminal call centers to look exactly like the real thing. You don't have to out-clever them — you just need one habit: never call the phone number printed on an unsolicited IRS letter. Look up the notice code at IRS.gov/notices, log in yourself at IRS.gov/account, and call 1-800-829-1040 to verify. That one habit stops the scam every time — whether the next letter arrives dressed up as an IRS Final Notice, a Social Security Administration warning, a Medicare Part B suspension, or whatever the criminals impersonate next month. Share this guide with the retirees in your life. A ten-minute read tonight can save them fifty thousand dollars tomorrow.