High riskEmail Scams

Tax Document Email Scam

This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.

Quick verdict

Risk level
High risk
Scam type
Document-lure phishing
Main red flag
An email pushing you to download a tax document or payslip via a link or attachment.
What to do first
Do not open it. Access documents only through your official payroll or tax account.

What this scam usually looks like

This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.

Example message pattern

Example pattern — not a real report
Example pattern: 'Your year-end tax document is ready. Download and review it here before the filing deadline: [suspicious link]' or an attached 'TaxForm.html'.

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • An unexpected tax or payslip document to download
  • A link to a login page that is not the official site
  • An attachment styled as a form or statement
  • Pressure tied to a filing or pay deadline
  • A sender address that does not match your employer or tax service

What to do

  • Access tax documents only through your official payroll or tax account
  • Avoid opening attachments or links in unexpected emails
  • Verify with your employer or tax service through official channels
  • Report the email as phishing and delete it

If you already clicked or replied

  • If you entered a login, change that password immediately
  • If you opened an attachment, run a security scan
  • Enable two-factor authentication on affected accounts
  • Watch for misuse of any personal or tax details

What not to do

  • Do not download tax documents from email links
  • Do not open unexpected form attachments
  • Do not enter logins on pages reached from the email

Similar scams

High risk Email

HR Portal Email Scam

This scam emails employees pretending to be the HR or staff portal, asking them to log in to review a policy, payslip, or benefits update, leading to a fake page that captures work credentials for further fraud.
High risk Email

Malware Attachment Scam

In a malware attachment scam, an email arrives with a file posing as an invoice, receipt, CV, statement or delivery note. Opening the attachment, or clicking a prompt to 'enable content' or 'enable macros', can quietly install malware that steals passwords, banking logins or files. The message is often crafted to feel urgent or routine so you act before thinking. Treating every unexpected attachment with caution, and verifying it through a separate channel, is one of the most effective defences.
Medium risk Email

Fake Invoice Email Scam

This scam emails an invoice or receipt for something you did not buy, hoping you call a fake 'support' number or click a link to dispute it.

Frequently asked questions

How are tax documents normally shared?
Through your official payroll or tax account, which you log in to directly. An email pushing you to download via a link or attachment is a phishing sign.
Why is this scam effective at tax time?
Deadlines and the routine nature of tax forms make people act quickly, which scammers exploit to deliver phishing pages or malware.
I opened the attachment. What now?
Run a security scan, and if you entered details on a page that opened, change those passwords from a trusted device.
How do I get my real documents?
Log in to your official payroll or tax account directly, or contact your employer or tax service through official channels.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.