Fake Income Tax Notices on WhatsApp Target ITR Filers as Cyber Experts Issue Fresh Warning

Taxpayers rushing to complete their Income Tax Return filing are being urged to remain extra cautious after cybersecurity experts detected a new scam that specifically targets ITR filers through WhatsApp. Fraudsters are circulating fake income tax notices designed to look official, hoping users will panic and download malicious files. Once the file is opened, attackers can gain access to sensitive financial information, including banking passwords, one time passwords, and personal data stored on smartphones.

The scam has surfaced at a time when thousands of taxpayers are busy submitting their returns before the filing deadline. Cybercriminals are taking advantage of this period by sending convincing messages that appear to come from the Income Tax Department. The messages often include government styled logos, legal language, and urgent warnings to pressure recipients into acting immediately without verifying the authenticity of the notice.

According to cybersecurity researchers, one of the most common tricks involves sending a compressed file named ITD.zip through WhatsApp. The accompanying message falsely claims that discrepancies have been detected in the recipient’s tax records under Section 271(1)(c) of the Income Tax Act. It further warns that legal action could be initiated if the recipient does not respond within 72 hours. The intention is to create fear so that users quickly open the attached file.

Experts warn that downloading or opening the ZIP file can install dangerous malware on Android smartphones. Once activated, the malware may secretly monitor incoming text messages, capture one time passwords sent by banks, steal saved passwords, and access confidential financial information. In some cases, cybercriminals may even gain enough access to perform unauthorized banking transactions without the user’s knowledge.

The fraud does not stop with malware installation. Victims may also be redirected to websites that closely resemble the official Income Tax Department portal. These fake websites are carefully designed to appear genuine, making it difficult for many users to identify the difference. Visitors are then asked to enter their Permanent Account Number, Aadhaar details, bank account information, mobile number, or login credentials. Any information entered on these fake portals can be collected by cybercriminals and later used for financial fraud or identity theft.

Cybersecurity professionals have stressed that the Income Tax Department does not issue official notices through WhatsApp or personal messaging platforms. Genuine communication regarding tax matters is delivered through the official e filing portal, registered email addresses, or other authorized channels. Therefore, taxpayers should treat any unexpected WhatsApp notice claiming to be from the department with extreme suspicion.

Another important safety measure is to avoid downloading ZIP, EXE, or other unknown files received through messaging applications. These file formats are commonly used by attackers to distribute malicious software. Even if the message appears convincing or contains official looking documents, users should never install or open such files without proper verification.

Experts also recommend visiting the official income tax e filing portal directly instead of clicking on links received in messages. If someone receives a notice claiming to be issued by the department, they should manually log into the official portal and verify whether such a notice actually exists. Taxpayers can also check the Document Identification Number associated with any genuine communication to confirm its authenticity.

The latest warning highlights how cybercriminals continue to refine their techniques by combining social engineering with advanced malware. Instead of relying on random spam, attackers now use current events such as tax filing deadlines to increase the chances of victims responding. This makes awareness one of the strongest defenses against digital fraud.

Security specialists advise smartphone users to keep their operating systems updated and install trusted security software whenever possible. Enabling two factor authentication for banking applications and regularly monitoring account activity can also help reduce the impact of potential attacks. Users should never share one time passwords, banking PINs, or account credentials with anyone, regardless of how authentic the request appears.

If a taxpayer mistakenly downloads the suspicious file or shares confidential information, immediate action is essential. The affected person should disconnect the device from the internet if possible, change passwords for banking and financial accounts, and inform the respective bank without delay. Reporting the incident to the national cybercrime helpline by calling 1930 can also help authorities respond quickly and reduce financial losses.

Cybersecurity firm CloudSEK has also cautioned users against trusting WhatsApp messages claiming to be official income tax notices. The company emphasized that taxpayers should verify every communication through authorized government channels before taking any action. Experts believe that increased public awareness is the most effective way to prevent such scams from claiming more victims during the busy tax filing season.

As digital fraud becomes increasingly sophisticated, taxpayers are encouraged to stay alert and verify every message before responding. A few extra minutes spent confirming the authenticity of a notice can prevent serious financial losses and protect sensitive personal information from falling into the hands of cybercriminals.