How the IRAS tax refund scam works and how to spot it

An email with the IRAS logo lands in your inbox with the words "Refund Notice". It claims a S$1,248 refund has been processed and asks you to click a link to get it. That's the IRAS tax refund scam, and IRAS put out an alert about these emails on 10 November. Does IRAS ever email you a refund amount? No. Real refunds go straight into your bank or PayNow account, with no email about the amount. Scams of every kind cost people in Singapore S$410.6 million in the first half of 2026.

How does the fake IRAS refund email work?

The email wants your details, or it wants malware on your device. Here's how it plays out, step by step.

An email arrives looking like it's from IRAS, with its logo and text such as "Important Notification" or "Refund Notice".
It offers you money, from a refund for a past overcharge or a payout, and may name an amount such as S$1,248.
A link offers to send you the money. Click it and you land on a phishing site made to look like the IRAS website.
The fake site asks you to pick a refund method, by debit or credit card. Some versions ask for your Singpass login or NRIC first, then your banking or card details.
Some links download malware, such as viruses, ransomware or spyware, onto your device.
In a version that went round in January, victims found out only when they checked with IRAS.

So, how does a real IRAS refund reach you?

A real refund is paid into your account automatically. IRAS credits it to the bank account you've registered with it, or to your PayNow account linked to your NRIC, FIN or UEN.

Can IRAS pay a refund to your credit card? No. IRAS doesn't process refunds to credit or debit cards, so a page asking for your card to receive one isn't from IRAS.

Updates on any refund show up in myTax Portal. You file your income tax from 1 March to 18 April each year.

If you are planning ahead for the next round, our tax relief calculator adds up the reliefs you can claim.

What are the warning signs of an IRAS tax refund scam?

An email or SMS asking you to click a link and claim a refund is a likely scam. IRAS pays refunds automatically, and it won't ask for your bank or card details by email or SMS for a refund.

Scams by people posing as government officials cost S$90.8 million in the first half of 2026, the second-highest loss of any scam type. These are the other signs to look for in a fake IRAS email.

A sender address that doesn't end in @iras.gov.sg, even when the sender name shows IRAS. Addresses can be spoofed too, so a real-looking one proves nothing.
A link whose real web address, shown when you hover over it, isn't an IRAS one.
A distorted IRAS logo.
A link that opens a Singpass login page, or asks for your NRIC, internet banking details or a one-time password (OTP).
An attachment or a program in the email for you to download.

What should you do if one lands in your inbox?

Don't click the link, open any attachment or share your personal details, bank logins or OTP.

Unsure about an email? Call the ScamShield Helpline at 1799. It runs 24/7 and can check if something is a scam.

What if you've already clicked the link?

Call your bank straight away to report and block any fraudulent transactions. The 1799 helpline can connect you directly, but only to the seven banks listed on its ScamShield page.

Then make a police report online, on the police e-services site, since the 1799 helpline can't file one for you.

Typed in your Singpass login? Contact Singpass to secure your account. Then update your contact details with Singpass and turn on its app notifications, so you're alerted when someone logs in from a new device.

If money has already gone, our guide to the Shared Responsibility Framework for phishing scams covers when your bank or telco has to cover the loss.

Our guides to the fake MAS officer scam and the WhatsApp impersonation scam show two other ways scammers pose as someone you'd trust.

This week, type mytax.iras.gov.sg into your browser yourself instead of following a link. Log in to myTax Portal there and see if IRAS has a refund for you.

Frequently asked questions

Does IRAS send emails about tax refunds?

IRAS doesn't send emails telling you how much refund you're getting. Any refund is paid into your registered bank account or PayNow account, and updates show up in myTax Portal.

Can IRAS pay my tax refund to a credit or debit card?

No. IRAS doesn't process tax refunds to credit or debit cards. Refunds go to the bank account you've registered with IRAS, or to your PayNow account linked to your NRIC, FIN or UEN.

What should I do if I clicked a link in a fake IRAS email?

If you entered card or banking details, call your bank straight away to block any fraudulent transactions, then make a police report online. If you gave away your Singpass login, contact Singpass to secure your account.

How can I check if an email from IRAS is real?

An address that doesn't end in @iras.gov.sg is a red flag. Addresses can be spoofed, though, so a real-looking one proves nothing. IRAS doesn't email you your refund amount, and it won't ask you to enter bank or card details through an email link to receive a refund. Still unsure? Call the 24/7 ScamShield Helpline at 1799.

Sources

Keep exploring

This is general financial information for Singapore, not personal financial advice. Figures change, so verify current rates against the official sources above before acting. See our full disclaimer.

Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).