Tax refund available? Beware of fake tax office emails

Summary

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this type of fraud. The assessed risk is elevated.

How the scam works

• You receive an email that allegedly comes from the tax office or FinanzOnline.
• Variant 1: The email claims that your 2025 income tax return still requires an identity confirmation – otherwise the refund will be delayed.
• Variant 2: The email states that your tax return has been reviewed and approved for payout. You only need to confirm your details.
• You click the link in the email and end up on a fake page that looks like FinanzOnline.
• You enter personal data such as your name, address, and bank details there – these go directly to criminals.
• Sometimes a further page follows that requests a 'payment confirmation'. What looks like a confirmation can actually trigger a real payment.
• Your stolen data is used for further fraud attempts – for example, phishing, account fraud, or fraud in your name.

How to recognise it

• Sender appears unusual, for example 'Ihre Agentur' instead of an official tax office designation
• Email claims that an additional identity confirmation is required for the 2025 income tax return
• Email announces a tax refund and requests confirmation of details before money is paid out
• Threat of a refund delay to build pressure
• Link does not lead to the real site finanzonline.bmf.gv.at, but to a similar-looking fake domain
• Request to enter personal data such as name, address, or bank details via a link
• Demand for cash/valuables by phone
• Massive emotional pressure and secrecy

How to protect yourself

• Do not click on links in unexpected emails, even if they sound plausible.
• Always open FinanzOnline yourself by entering the official address finanzonline.bmf.gv.at in the address bar and check whether a message is actually waiting there.
• Press and hold the link on your phone or hover over it with your mouse to see the real web address – discrepancies are a warning sign.
• If in doubt, contact the tax office directly to ask whether the message is genuine.
• If you have already entered data: Inform your bank immediately so that cards or access can be blocked.
• File a report with the police and remain especially vigilant for further suspicious messages or calls.

What you should never do

• Do not click on links in emails that arrive unexpectedly or describe a situation you are not aware of.
• Do not enter any personal data, bank details, or login credentials on pages you have reached via an email link.
• Do not pay anything just because an email claims you should – the tax office does not send payment requests via email with links.
• Do not ignore the incident if you have already entered data – act quickly and inform your bank and the police.
• Do not delete suspicious emails immediately without checking them – save them as evidence (screenshot, sender, link).

Frequently asked questions

Affected data

Comments

Related warnings

• Gefälschte Inkasso- und Zollforderungen
• Schockanrufe & falsche Behörden
• Vereinsregisterauszug.at: Teure Hilfe für kostenlose Behördenabfrage

Original source

Update history

• 09/09/2026Description updated
• 08/09/2026Warning added from an official source