What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stop interacting with the page, close it, and do not provide more information or payment. Clicking a fake tax-refund link by itself does not prove that your identity was stolen or that malware installed. Your next steps depend on what happened after the click: whether you entered a password, SSN or ITIN, bank or card details, sent money, or downloaded a file.
What do I do if I clicked a fake IRS refund link?
Use this order:
- Close the page. Do not reply to the sender, click the link again, open attachments, or continue through forms, chat windows, or payment prompts.
- Write down what you did. Record whether you only clicked, entered a password, entered tax-identification information, supplied bank or card details, sent money, or downloaded and opened a file.
- Secure the account or money involved. The remedy differs for a reused password, an exposed SSN/ITIN, and a bank transfer or card number.
- Report the message through the correct channel. Preserve the original email, text, or social-media details before deleting it.
- Check your refund or notice independently. Type IRS.gov yourself or use your IRS online account; never use the suspicious message’s link.
IRS warnings say that phishing messages seek personal and financial information and that opening links or attachments may harm a computer. That is a warning about risk, not proof that a click alone installed malware or exposed your identity.
As an Amazon Associate I earn from qualifying purchases.
First, identify what was exposed
The fastest way to choose the right response is to separate the click from everything that followed it.
| What happened | What it means | Priority actions |
|---|---|---|
| Clicked only and closed the page | Compromise is not established from the click alone. | Do not return to the page; report the message, verify tax information independently, and watch accounts for unusual activity. |
| Entered an IRS, email, or other account password | The password may be exposed, especially if it was reused elsewhere. | Change it from the service’s official site or app, change reused copies, and enable multifactor authentication where available. |
| Entered an SSN, ITIN, date of birth, or other tax identity details | Your tax identity may be at risk even if no money was taken immediately. | Report through IdentityTheft.gov and to the IRS, consider your state tax agency, and obtain an IRS Identity Protection PIN. |
| Entered a card or bank account number, credentials, or one-time code | Someone may be able to attempt transactions or account takeover. | Contact the financial institution promptly through the number on your card or its official app or website and follow its incident instructions. |
| Sent money | You have a financial-loss incident, not just a suspicious click. | Contact the financial institution or payment service immediately through a trusted channel and explain when and how the payment was made. |
| Downloaded or ran a file, or the device now behaves unusually | A download or execution creates a different device-risk question than a page view. | Disconnect from sensitive work if necessary and seek trusted device support; do not diagnose malware solely from the click. |
If you entered a password or account credentials
Change the exposed password at the real service
Open the service’s app or type its known official address yourself. Do not follow a link from the refund message. Change the password immediately, then review recent sign-ins, recovery email addresses, phone numbers, forwarding rules, and active sessions. Sign out other sessions if the service offers that control.
#1 Best Overall
Change reused passwords
If the same password was used for email, banking, a tax account, or another important service, change each copy. Start with your email account because control of email can allow password resets elsewhere. Use a different, long password for every account.
Turn on multifactor authentication
Enable multifactor authentication wherever the service supports it. The IRS specifically recommends an IRS online account with multifactor authentication. Save recovery codes in a secure place and do not give a one-time code to anyone who contacts you.
If you entered your SSN, ITIN, or tax identity information
Report the exposure
Use IdentityTheft.gov to report the identity-theft concern and follow its recovery instructions. Report the incident to the IRS as well. Consider contacting your state tax agency, because state filing procedures and protective measures vary.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallGet an IRS Identity Protection PIN
An IRS Identity Protection PIN (IP PIN) is a six-digit number that helps prevent another person from filing a federal return using your SSN or ITIN. Request one through your IRS online account and protect it like other tax credentials. An IP PIN does not undo information already disclosed, so complete the reporting steps even after obtaining it.
If a fraudulent return was already filed
If you learn that someone filed a tax return using your information, obtain a copy of the fraudulent return and submit Form 14039, Identity Theft Affidavit, as directed by the IRS. Keep copies of the form, correspondence, and any case numbers.
The IRS’s identity-protection guidance states: “Not all data breaches or computer hacks result in identity theft.” That does not make an exposed SSN harmless; it means you should take the protective steps without assuming that identity theft has already occurred.
If you entered bank or card details or sent money
Contact the relevant bank, card issuer, or payment service promptly. Use the telephone number printed on the card, the institution’s official app, or an address you enter yourself—not contact information in the suspicious message. Tell the representative what information was entered, whether a one-time code was provided, and whether money was sent.
Follow the institution’s instructions for securing the account, replacing credentials or cards, and documenting the incident. The available IRS guidance says to contact your financial institution when money or identity information was lost; it does not promise that a payment will be reversed, so ask what options and deadlines apply to your specific transaction.
How to report the fake refund message
Send the suspicious IRS, Treasury, or tax-related email to [email protected]. The IRS prefers the original email or its headers because they preserve routing information. If forwarding the message or headers is not possible, provide the underlying URL in your report. Do not click that URL again just to copy it; use the address already visible in the message or your mail client’s details.
Text message
Email [email protected] with the sender’s telephone number, the complete message, your recipient number, and the date, time, and time zone when it arrived. You can also forward the text to 7726 (SPAM), the mobile-industry reporting number. Do not reply to the scammer.
Social-media impersonation
Report the account or post through the platform’s own reporting tools. Send the full account URL to [email protected]. Capture the account name, profile URL, post, and direct-message details before the impersonator deletes them.
Reporting is separate from recovery. If you entered sensitive information, complete the account, financial, or identity steps above even after submitting a report.
How to verify a refund or IRS notice safely
The IRS does not make initial contact through email or social media. An IRS letter or notice is generally the first contact. A message claiming that you must click immediately to release a refund is therefore a warning sign, even if it uses an official-looking logo or tax terminology.
- Open a new browser window and type IRS.gov yourself, or use the IRS mobile or web account you already know.
- Sign in to your IRS online account and review notices, payments, and refund information there.
- If you need to call, find the telephone number on IRS.gov or on a genuine IRS notice—not in the suspicious email, text, or social post.
- Compare the independently verified information with the message, but do not revisit the message’s link or attachments.
A legitimate refund question can wait for verification. Urgency, threats of penalties, requests for gift cards or cryptocurrency, and demands for a fee to release a refund are common scam signals.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What if I only clicked and entered nothing?
Close the page and leave it closed. Do not download anything, enable browser notifications, install a “security” tool offered by the page, or call a telephone number displayed in a pop-up. Report the message using the method for email, text, or social media, then monitor your email, tax account, bank accounts, and credit activity for unusual events.
Recommended Free Tools
The reviewed IRS guidance does not quantify the probability of compromise from a click alone. It also does not establish that every click causes a download or identity theft. Treat unexpected behavior—an unrequested download, repeated pop-ups, new extensions, changed settings, or account alerts—as a reason to obtain trusted technical help, not as proof of a particular infection.
Device symptoms after the click
Keep your operating system, browser, and security tools patched, and use a firewall and current anti-spam or antivirus protection, as IRS guidance recommends. If a file downloaded, ran, or the device is behaving abnormally, stop using that device for sensitive logins until a trusted technician or your organization’s IT support can examine it. Use a different, known-safe device to change passwords and contact financial institutions when possible.
Do not buy software because a pop-up claims your refund or computer is in danger. The IRS pages reviewed do not prescribe a specific forensic-cleanup sequence for a link click, and buying a product is not a required response.
Expect follow-up and recovery scams
After a report or financial loss, scammers may call, email, or message you pretending to be investigators, tax officials, or “recovery” specialists. They may know that you clicked a refund message and promise guaranteed recovery in exchange for an upfront fee, gift card, cryptocurrency, remote access, or your one-time code.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
- Do not pay an upfront recovery fee or share additional credentials.
- End the contact and verify any claimed case directly through IRS.gov, your bank’s official app, or a number you locate independently.
- Keep the original scam records and add later contacts to your report.
A practical incident checklist
- Page closed; no further replies, clicks, attachments, or payments.
- Exact information disclosed recorded, including passwords, SSN/ITIN, account numbers, one-time codes, and payment details.
- Exposed passwords changed at the official service, including every reused copy; multifactor authentication enabled.
- Bank, card, or payment provider contacted through a trusted channel when financial data or money was involved.
- IdentityTheft.gov and the IRS contacted for SSN/ITIN exposure; state tax agency considered.
- IRS IP PIN requested; Form 14039 prepared if a fraudulent return was filed.
- Original email, headers, text details, or social account URL preserved and reported through the correct route.
- Refund or notice checked by typing IRS.gov or using the IRS online account.
- Device support arranged if a file ran or abnormal behavior continues.
- Later “recovery” offers treated as possible scams.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
