Tax Document Email Scam
This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.
By the Scam or Safe Editorial TeamResearched & reviewed for accuracyQuick verdict
How this scam works
This scam emails that a tax document, payslip, or important form is ready to download or view, linking to a fake login page or a malicious attachment that steals credentials or installs malware.
Email scams, or phishing, remain one of the most common ways criminals steal logins, payment details, and money. A convincing message imitates a brand or contact and steers you toward a fake login page, a malicious attachment, or a fraudulent payment.
In short, the giveaway is usually simple: An email pushing you to download a tax document or payslip via a link or attachment. Do not open it. Access documents only through your official payroll or tax account.
Scammers rotate tactics constantly, the same operation may also run the HR Portal Email Scam and the Malware Attachment Scam. See the full Email Scams guides hub, or test a suspicious message with the scam checker.
How to spot this scam
- An unexpected tax or payslip document to download
- A link to a login page that is not the official site
- An attachment styled as a form or statement
- Pressure tied to a filing or pay deadline
- A sender address that does not match your employer or tax service
What the message looks like
This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.
What gives it away: An email pushing you to download a tax document or payslip via a link or attachment.
The scale of it
How to protect yourself
- Access tax documents only through your official payroll or tax account
- Avoid opening attachments or links in unexpected emails
- Verify with your employer or tax service through official channels
- Report the email as phishing and delete it
Already responded? Do this now
- If you entered a login, change that password immediately
- If you opened an attachment, run a security scan
- Enable two-factor authentication on affected accounts
- Watch for misuse of any personal or tax details
Mistakes to avoid
- Do not download tax documents from email links
- Do not open unexpected form attachments
- Do not enter logins on pages reached from the email
Related scams to know
HR Portal Email Scam
This scam emails employees pretending to be the HR or staff portal, asking them to log in to review a policy, payslip, or benefits update, leading to a fake page that captures work credentials for further fraud.
Created by Scam or Safe Editorial Team
Malware Attachment Scam
In a malware attachment scam, an email arrives with a file posing as an invoice, receipt, CV, statement or delivery note. Opening the attachment, or clicking a prompt to 'enable content' or 'enable macros', can quietly install malware that steals passwords, banking logins or files. The message is often crafted to feel urgent or routine so you act before thinking. Treating every unexpected attachment with caution, and verifying it through a separate channel, is one of the most effective defences.
Created by Scam or Safe Editorial Team
Fake Invoice Email Scam
This scam emails an invoice or receipt for something you did not buy, hoping you call a fake 'support' number or click a link to dispute it.
Created by Scam or Safe Editorial Team
Common questions
How are tax documents normally shared?
Why is this scam effective at tax time?
I opened the attachment. What now?
How do I get my real documents?
Last reviewed June 2026 · Written & reviewed by the Scam or Safe Editorial Team