---
title: "Fake IRS Letter in 2026: How to Spot the Scam (With Photos of Every Red Flag)"
description: "A fake IRS letter can look terrifyingly real — a Treasury seal, a 'Final Notice of Intent to Levy,' a threatening dollar figure, and a phone number that connects you to a criminal call center. Here is exactly how to tell a fake IRS letter from a real one in under 60 seconds, the 8 red flags that give every counterfeit away, the real IRS phone numbers, and what to do if you already called or paid."
url: "https://www.saferetirewatch.com/blog/fake-irs-letter"
date_published: "2026-07-19"
date_modified: "2026-07-19"
language: "en-US"
author: "Safe Retire Watch"
keywords: "fake irs letter, fake irs letter 2026, is there a fake irs letter going around, how to spot a fake irs letter, how to identify a fake irs letter, how to tell if an irs letter is fake, irs letter scam, irs scam letter, fake irs notice, fake irs final notice, is my irs letter real, what does a fake irs letter look like, irs impersonation scam, treasury letter scam"
publisher: "Safe Retire Watch"
license: "Free to quote with attribution and a link to the source URL."
---

# Fake IRS Letter in 2026: How to Spot the Scam (With Photos of Every Red Flag)

A fake IRS letter can look terrifyingly real — a Treasury seal, a 'Final Notice of Intent to Levy,' a threatening dollar figure, and a phone number that connects you to a criminal call center. Here is exactly how to tell a fake IRS letter from a real one in under 60 seconds, the 8 red flags that give every counterfeit away, the real IRS phone numbers, and what to do if you already called or paid.

The envelope looks official. There's an IRS-style eagle in the corner, a 'Department of the Treasury' return address, a bar-coded tracking number, and the words FINAL NOTICE — INTENT TO LEVY across the top in red. Inside, the letter tells you that you owe $4,872.63 in back taxes, that a lien has already been filed against your Social Security, and that unless you call the number listed within 48 hours to arrange 'settlement,' agents will be dispatched to your home. Your heart pounds. You reach for the phone. That single decision is what every fake IRS letter is engineered to produce — because on the other end of that line is not the IRS. It's a criminal call center that will empty your bank account, one panicked minute at a time.

The Treasury Inspector General for Tax Administration (TIGTA) reports that IRS-impersonation scams have already cost Americans more than $110 million in confirmed losses — and unlike email phishing, the physical-mail version disproportionately targets retirees, because a printed letter with a Treasury seal feels legitimate in a way a Gmail scam never could. Fake IRS letters spike every year between January and August. In 2026, TIGTA is warning that a new wave of counterfeit mailings — some with QR codes, some referencing real (but expired) tax cases — is now landing in mailboxes across all 50 states.

This guide is the last one you'll ever need. In the next ten minutes you'll learn the exact anatomy of a fake IRS letter, the 8 red flags that give every counterfeit away, the real IRS phone numbers and addresses, and — if you already called or paid — the first-24-hour recovery plan that has helped Safe Retire Watch members recover the majority of their losses.

> **60-second rule**
>
> The real IRS contacts you by U.S. mail with a valid notice code (e.g. CP14, CP2000, LT11) in the top-right corner. It never demands gift cards, cryptocurrency, wire transfers, or same-day payment by phone. If any of those three things are in the letter, it is a scam — no exceptions.

## How the fake IRS letter scam actually works

The scam is a three-stage funnel. Once you see all three stages, the red flags in stage one become obvious the next time a letter lands in your mailbox.

1. Stage 1 — the mailed letter. A convincing 'Final Notice,' 'Intent to Levy,' or 'CP2000 Underreporter' arrives with a Treasury-style seal, a fake case number, and a specific balance due. The letter demands you call a phone number (not IRS.gov) within 24 to 72 hours. This is the only step that costs the scammer anything — a stamp — so the letter is designed to convert on that single phone call.
2. Stage 2 — the phone call. A polite 'Revenue Officer' with an American-sounding name (often 'Officer Michael Johnson, Badge #4471') answers. He reads back your name, address, and last four of your Social — data he already bought on the dark web from an old breach — to establish authority. He then offers to help you 'resolve the debt today' with an immediate payment or a same-day settlement discount.
3. Stage 3 — the drain. He instructs you to buy gift cards, wire funds to a 'Treasury holding account,' send cryptocurrency to a QR code, or install remote-access software so he can 'process the settlement' from your online banking. Each of these is one-way money. Once it's gone, it's gone. The whole call, start to finish, typically lasts 30 to 90 minutes.

## 8 red flags in every fake IRS letter

1. Payment demand in gift cards, cryptocurrency, wire, or prepaid debit. The IRS accepts payment by check, direct debit, credit card (through IRS.gov/payments), or an installment agreement. It has never — not once in its entire history — asked anyone to pay in Target, Apple, Google Play, or Best Buy gift cards. This single tell identifies 95% of scam letters instantly.
2. A phone number the IRS doesn't publish. The real IRS numbers are 1-800-829-1040 (individuals), 1-800-829-4933 (businesses), and 1-800-829-3676 (forms). If the letter lists any other number and asks you to call it — especially with a 24- or 48-hour deadline — it is a scam.
3. No valid notice code in the top-right corner. Every real IRS letter is labeled with a code: CP14 (balance due), CP2000 (underreporter), CP504 (final notice — balance due), LT11 (intent to levy), Letter 5071C (identity verification). Fake letters either invent a code that doesn't exist ('FTL-2026-A') or use one that doesn't match the letter's content. Search the code at IRS.gov/notices — if it doesn't return that exact form, the letter is fake.
4. Threats of arrest, deportation, license revocation, or immediate levy without appeal. Real IRS collections follow a documented sequence: CP14, then CP501, then CP503, then CP504, then LT11 with 30-day appeal rights. It does not skip to 'call today or a warrant will be issued.' The IRS itself publishes this: 'The IRS will not threaten to immediately bring in local police or arrest you.'
5. A QR code for payment. The IRS does not accept payment through QR codes on mailed letters, ever. A QR code on 'IRS' mail always leads to a scam payment portal, a fake IRS.gov look-alike, or a crypto address.
6. Wrong return address. Real IRS letters come from a small list of service centers: Austin, TX; Fresno, CA; Kansas City, MO; Ogden, UT; Memphis, TN; Philadelphia, PA; Andover, MA; Atlanta, GA; Cincinnati, OH; Holtsville, NY. Fake letters use P.O. boxes in Dover DE, Wilmington DE, Reno NV, or private mail forwarders. Google the return address — if it's not a real IRS service center, it's fake.
7. Odd formatting: misspellings, awkward grammar, mixed fonts, blurry seal, or a signature block for a 'Senior Revenue Officer' whose name doesn't exist in the IRS employee directory (yes — you can look up real IRS employees by name at IRS.gov/help). Real IRS letters are boring, formulaic, and grammatically clean.
8. A precise, non-round balance designed to feel calculated. Amounts like $4,872.63, $9,281.47, or $12,543.29 are meant to look like a real audit result. In reality, the number is randomized to look believable — the scammer has no idea what you actually owe (usually nothing).

> **The single fastest check**
>
> Look at the top-right corner of the letter. If there is no CP or LT notice code — or if the code doesn't return that exact letter when you search IRS.gov/notices — the letter is fake. This 30-second check stops the scam every time.

## The 5 fake IRS letter templates circulating in 2026

Every counterfeit IRS letter in the wild right now is a variation on one of these five templates. Photograph the letter and text it to a family member before doing anything.

### 1. The 'Final Notice — Intent to Levy'

The most common variant. Mimics the real LT11 but skips the 30-day appeal notice. Says a levy will be placed on your Social Security, bank account, or wages in 48 hours unless you call a listed number. The real LT11 gives you 30 days and a Form 12153 appeal option — never 48 hours.

### 2. The fake CP2000 'Underreporter' notice

Claims a 1099 from Coinbase, PayPal, eBay, or Venmo shows income you didn't report and you owe $3,000–$8,000 plus penalties. Real CP2000s give you 30 days to respond and include a detailed side-by-side comparison of your return vs. reported income. Fake ones skip the comparison and demand payment.

### 3. The 'Settlement Offer' letter

Claims you qualify for a 'one-time settlement discount' — pay 40% today and the rest is forgiven. Impersonates the real Offer in Compromise program. The real OIC requires a formal Form 656 application, financial disclosure, and takes 6–12 months. It is never offered by phone or mail deadline.

### 4. The 'Tax Refund Verification' letter (Letter 5071C look-alike)

Says the IRS held your refund pending identity verification and asks you to call a number or scan a QR code to 'confirm your Social Security number and bank routing.' The real Letter 5071C directs you to idverify.irs.gov and a specific IRS phone number — never a QR code and never asks for bank routing.

### 5. The 'Certified Mail — Federal Case' letter

Arrives with a fake USPS Certified Mail sticker and language like 'DOCKET #2026-CV-4471' or 'FEDERAL CASE FILED.' Uses legal jargon to imply court action. The IRS does not file federal court cases against individual taxpayers over routine balances — it uses administrative collection (liens, levies) with documented appeal rights.

## What happens if you call the number on the letter

The mailed letter is only the bait. The trap is the call. Here is the exact playbook the criminal call center runs so you can recognize it — even if the scammer sounds calm, professional, and knows details about you.

- Step 1: 'Officer Michael Johnson, Badge #4471, Department of the Treasury.' He reads back your name, address, and last four of your SSN from an old data breach to establish authority.
- Step 2: He 'pulls your file' and confirms the balance, adding penalty language and interest to make the number climb minute by minute — creating urgency.
- Step 3: He offers a same-day settlement discount. To process it, he needs immediate payment by 'Treasury-approved' methods: iTunes / Target / Google Play / Best Buy gift cards, a wire to a 'Treasury holding account,' cryptocurrency to a QR code, or remote access to your computer to 'complete the settlement portal.'
- Step 4: If you push back, he escalates: sheriff en route, license suspended, Social Security frozen. If you comply, he stays on the line until the money leaves — 'don't hang up, stay on with me until confirmation, or the settlement is void.'
- Step 5: The call ends. Money is gone. The number stops working within 24 hours.

> **If you hear 'gift cards' or 'stay on the line' — hang up**
>
> No IRS employee, no federal agent, no court, no police officer will ever ask you to buy gift cards, wire money, send cryptocurrency, or 'stay on the line' while you go to the store. That combination is the scam. Hang up. Call the real IRS at 1-800-829-1040 to verify anything you're unsure about.

## The only real IRS phone numbers and websites

Bookmark these somewhere reachable in a panic. Never trust a number printed on an unsolicited letter — always type IRS.gov yourself into a fresh browser tab.

- IRS individuals: 1-800-829-1040 (Monday–Friday, 7am–7pm local time).
- IRS businesses: 1-800-829-4933.
- IRS identity theft: 1-800-908-4490.
- TIGTA (report an IRS-impersonation scam): 1-800-366-4484 or tigta.gov/reportcrime.
- Phishing IRS letters and emails: forward or mail to phishing@irs.gov.
- IRS notice lookup: IRS.gov/notices — search the exact CP or LT code from your letter.
- IRS Taxpayer Advocate (free help if you have a real dispute): 1-877-777-4778.

## How to verify any IRS letter in under 5 minutes

1. Look at the top-right corner. Find the notice code (e.g. CP14, CP2000, LT11, Letter 5071C). If there isn't one, the letter is fake.
2. Open IRS.gov/notices in a fresh browser tab. Search the exact code. Confirm the sample letter shown matches yours in tone, format, and content.
3. Log in at IRS.gov/account (the real IRS Online Account) to see your actual balance, unpaid notices, and payment history. If nothing matches the letter, it's fake.
4. If in doubt, call 1-800-829-1040 yourself. Do not use the phone number on the letter. Wait times can be long — that's a good sign; scammers never make you wait.
5. Photograph the letter and text it to a trusted family member. A second pair of eyes catches the seal blur, misspellings, or wrong return address you might miss under stress.

## First 24 hours if you already called or paid

The next 24 to 72 hours matter more than everything after. Move calmly, in order — every step is free, and each dramatically improves your odds of recovery.

1. If you installed remote-access software (AnyDesk, TeamViewer, UltraViewer, LogMeIn): disconnect the computer from the internet, then have a trusted family member uninstall it and run Malwarebytes or Windows Security. Do not use that computer for banking until it's clean.
2. Call your bank's fraud line and every card issuer. Freeze cards, dispute any pending charges under Regulation E (debit) or Regulation Z (credit). Chase 1-800-935-9935. Bank of America 1-800-432-1000. Wells Fargo 1-800-869-3557. Citi 1-800-950-5114. Capital One 1-800-227-4825. Discover 1-800-347-2683. Amex 1-800-528-4800.
3. If you sent gift cards, call the retailer's fraud line and read the card numbers — Target, Apple, Google Play, Amazon, and Best Buy can sometimes freeze unspent balances. Keep the physical cards and receipts.
4. If you wired money, call your bank immediately and ask them to recall the wire. Domestic wires can occasionally be reversed within 24 hours if the receiving account hasn't drained.
5. Change your email, bank, and IRS.gov account passwords from a different device. Turn on two-factor authentication (2FA) on all three.
6. Freeze your credit at all three bureaus (free, 5 minutes each): Equifax 1-800-685-1111, Experian 1-888-397-3742, TransUnion 1-888-909-8872.
7. Request an IRS Identity Protection PIN (IP PIN) at IRS.gov/ippin. This 6-digit number is required on every future return and blocks anyone from filing in your name.
8. File reports: TIGTA at tigta.gov/reportcrime, FBI IC3 at ic3.gov, FTC at reportfraud.ftc.gov, and your state Attorney General. If you're over 60, call the free National Elder Fraud Hotline at 1-833-372-8311 for a DOJ case manager.
9. Forward the letter's photo (and any emails/texts) to phishing@irs.gov and mail the original letter to IRS, ATTN: Phishing, 1973 N. Rulon White Blvd, Ogden UT 84404.

## Free tools to catch the next one

Safe Retire Watch has three free AI tools built for exactly this scam pattern. Paste the message or scan the letter and get a plain-English verdict in seconds — free account, no credit card.

- Scam Check — paste any suspicious message and get an instant AI verdict on whether it's a scam.
- Email Explainer — paste a suspicious email and get a line-by-line breakdown in plain English, with every red flag highlighted.
- Phone Check — enter the number on the letter and see if it's already been reported as an IRS-impersonation scam.

## The bottom line

Fake IRS letters are engineered by full-time criminal call centers to look exactly like the real thing. You don't have to out-clever them — you just need one habit: never call the phone number printed on an unsolicited IRS letter. Look up the notice code at IRS.gov/notices, log in yourself at IRS.gov/account, and call 1-800-829-1040 to verify. That one habit stops the scam every time — whether the next letter arrives dressed up as an IRS Final Notice, a Social Security Administration warning, a Medicare Part B suspension, or whatever the criminals impersonate next month. Share this guide with the retirees in your life. A ten-minute read tonight can save them fifty thousand dollars tomorrow.

## Frequently asked questions

### Is there a fake IRS letter going around in 2026?

Yes — the Treasury Inspector General for Tax Administration (TIGTA) and the IRS have both issued fresh public warnings in 2026 about a surge in counterfeit IRS letters mailed directly to seniors. The most common versions are a fake 'CP2000,' a fake 'LT11 / Notice of Intent to Levy,' and a fake 'Final Warning — Balance Due' with a QR code or phone number the IRS never uses. They usually demand payment in 24–72 hours by gift card, wire, cryptocurrency, or a same-day 'settlement' phone call. All three are scams. Real IRS collection notices never demand gift cards or crypto and never ask you to call a number that isn't on IRS.gov.

### How do I know if an IRS letter is real or fake?

Five checks in under a minute. (1) Every real IRS letter has a notice or letter number in the top-right corner (e.g. CP2000, CP14, LT11, Letter 5071C). Search that exact code at IRS.gov/notices — if it doesn't exist or the wording doesn't match, the letter is fake. (2) Real IRS letters come from Austin TX, Fresno CA, Kansas City MO, Ogden UT, Memphis TN, Philadelphia PA, or a handful of other IRS service centers — never from a P.O. box in another state or a private mail forwarder. (3) The IRS never demands gift cards, wires, crypto, or same-day payment. (4) The IRS never texts, emails, or leaves threatening voicemails as first contact. (5) Call the IRS yourself at 1-800-829-1040 to verify — never call the number printed on the letter.

### What does a fake IRS letter look like?

Fake IRS letters usually have one or more of these tells: a Treasury or IRS seal that looks slightly off (wrong colors, blurry, or pixelated), a notice code that doesn't exist on IRS.gov, misspellings or awkward phrasing, a QR code (real IRS notices don't use QR codes for payment), a threatening deadline of 24–72 hours, an amount ending in unusual precision like $4,872.63 designed to look calculated, and a return address that isn't a real IRS service center. Many have a 'CASE ID' or 'DOCKET NUMBER' that sounds legal but has no format the real IRS uses.

### The letter says I'll be arrested if I don't pay — what do I do?

Stop. Breathe. The IRS does not arrest people over unpaid taxes by mailing a letter and giving 48 hours to pay in gift cards — full stop. Only a federal court can order an arrest, and it does so after months or years of formal proceedings with a lawyer, not a piece of certified-looking mail. Do not call the number on the letter. Do not pay anything. Photograph the letter, then call the real IRS at 1-800-829-1040 (individuals) and report the fake at phishing@irs.gov and TIGTA at tigta.gov/reportcrime.

### I already paid a scammer who pretended to be the IRS. Can I get my money back?

Sometimes, yes — move fast. If you paid by credit card, dispute the charge under Regulation Z (up to 60 days to file). If you paid by debit card, ACH, or Zelle, call your bank's fraud line today and dispute under Regulation E (60 days). Wires can occasionally be recalled within 24–72 hours if you call your bank immediately. If you paid in gift cards, call the retailer's fraud line (Target, Apple, Google Play, Amazon, Best Buy) and read them the card numbers — sometimes they can freeze unspent balances. Then file with the FBI at ic3.gov, TIGTA at tigta.gov/reportcrime, and the FTC at reportfraud.ftc.gov. If you are over 60, the free National Elder Fraud Hotline (1-833-372-8311) will assign a DOJ case manager to help you.

### Does the IRS ever call, text, or email me?

Almost never as first contact. The IRS's own published policy: they contact you by U.S. mail first — usually multiple letters — before any phone call. They will never text you, will never send unsolicited email, will never DM you on social media, and will never leave threatening voicemails demanding immediate payment or arrest. If a 'first contact' is anything other than a paper letter with a valid CP or LT notice code, it is 100% a scam.

## Related pages

- [Social Security scams](https://www.saferetirewatch.com/scams/social-security-scams)
- [AI voice & deepfake scams](https://www.saferetirewatch.com/scams/ai-voice-scams)
- [Does the IRS call you about unpaid taxes?](https://www.saferetirewatch.com/answers/does-the-irs-call-you)
- [How can seniors identify AI scams?](https://www.saferetirewatch.com/answers/how-can-seniors-identify-ai-scams)
- [Does Medicare ever call you?](https://www.saferetirewatch.com/answers/does-medicare-ever-call-you)
- [PayPal Scam Email in 2026: 9 Real Examples, Every Red Flag, and What to Do If You Clicked](https://www.saferetirewatch.com/blog/paypal-scam-email)
- [20 Phishing Email Examples Every Retiree Should Know (2026)](https://www.saferetirewatch.com/blog/phishing-email-examples)
- [Microsoft Scam Email in 2026: How to Spot the Fake Alert](https://www.saferetirewatch.com/blog/microsoft-scam-email)
- [USPS Text Scam in 2026: How to Spot the Fake Delivery Text (Real Examples)](https://www.saferetirewatch.com/blog/usps-text-scam)

---

Source: https://www.saferetirewatch.com/blog/fake-irs-letter — Safe Retire Watch, real-time scam alerts for retirees.