High riskEmail

Tax Document Email Scam

This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.

Quick verdict

Risk level
High risk
Scam type
Document-lure phishing
Main red flag
An email pushing you to download a tax document or payslip via a link or attachment.
What to do first
Do not open it. Access documents only through your official payroll or tax account.

How this scam works

This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.

Email scams, or phishing, remain one of the most common ways criminals steal logins, payment details, and money. A convincing message imitates a brand or contact and steers you toward a fake login page, a malicious attachment, or a fraudulent payment.

In short, the giveaway is usually simple: An email pushing you to download a tax document or payslip via a link or attachment. Do not open it. Access documents only through your official payroll or tax account.

Scammers rotate tactics constantly, the same operation may also run the HR Portal Email Scam and the Malware Attachment Scam. See the full Email Scams guides hub, or test a suspicious message with the scam checker.

How to spot this scam

  • An unexpected tax or payslip document to download
  • A link to a login page that is not the official site
  • An attachment styled as a form or statement
  • Pressure tied to a filing or pay deadline
  • A sender address that does not match your employer or tax service

What the message looks like

Example pattern, not a real report
Example pattern: 'Your year-end tax document is ready. Download and review it here before the filing deadline: [suspicious link]' or an attached 'TaxForm.html'.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

What gives it away: An email pushing you to download a tax document or payslip via a link or attachment.

The scale of it

Most reported
phishing was the most common type of cybercrime complaint reported to the FBI in 2023
$12.5B
total reported internet-crime losses in the US in 2023

How to protect yourself

  • Access tax documents only through your official payroll or tax account
  • Avoid opening attachments or links in unexpected emails
  • Verify with your employer or tax service through official channels
  • Report the email as phishing and delete it

Already responded? Do this now

  • If you entered a login, change that password immediately
  • If you opened an attachment, run a security scan
  • Enable two-factor authentication on affected accounts
  • Watch for misuse of any personal or tax details

Mistakes to avoid

  • Do not download tax documents from email links
  • Do not open unexpected form attachments
  • Do not enter logins on pages reached from the email

Related scams to know

Common questions

How are tax documents normally shared?
Through your official payroll or tax account, which you log in to directly. An email pushing you to download via a link or attachment is a phishing sign.
Why is this scam effective at tax time?
Deadlines and the routine nature of tax forms make people act quickly, which scammers exploit to deliver phishing pages or malware.
I opened the attachment. What now?
Run a security scan, and if you entered details on a page that opened, change those passwords from a trusted device.
How do I get my real documents?
Log in to your official payroll or tax account directly, or contact your employer or tax service through official channels.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.