If your firm lives in QuickBooks Desktop, those numbers are not abstract. You work with live bank feeds, payroll data, and full tax histories inside a system that criminals know how to target through phishing emails, fake Intuit login pages, and support scams.<\/p>\n\n\n\n
The IRS explicitly cautions that if you get an email, text, letter, or call that claims to be from the IRS, it might be a scam or bad tax advice.<\/p>\n\n\n\n
For small and mid-sized CPA firms, the damage goes beyond a single stolen refund. A successful scam can lock you out of QuickBooks, compromise dozens of client files at once, or trigger reportable security incidents under IRS and FTC expectations. That is why the IRS publishes an annual Dirty Dozen list<\/strong><\/a> of the most dangerous tax scams, and why this article leans heavily on that guidance while translating it into day-to-day QuickBooks workflows.<\/p>\n\n\n\n This article focuses on how tax season scams actually show up for QuickBooks users, how to tell real IRS contact from fraud, what to do if you have already clicked or paid, and how to structure your QuickBooks environment so a single mistake does not become a firm-wide crisis. <\/p>\n\n\n\n It is written for:<\/p>\n\n\n\n This article is informational only and does not replace legal, tax, or law enforcement advice. Always follow official IRS instructions and your legal counsel when responding to suspected fraud.<\/p>\n\n\n\n A fraud where criminals pretend to be IRS employees, private collection agencies, or authorized partners to pressure you into paying, sharing sensitive information, or clicking links.<\/p>\n\n\n\n Fraudulent emails, texts, or messages that try to trick you into revealing passwords, MFA codes, bank information, or opening infected attachments. In this context, that often includes fake IRS notices or QuickBooks \/ Intuit messages.<\/p>\n\n\n\n When someone uses a stolen SSN (Social Security Number), ITIN (Individual Taxpayer Identification Number), or EIN (Employer Identification Number) to file a tax return or claim a refund before the legitimate taxpayer files, often using data stolen from tax professionals or payroll systems.<\/p>\n\n\n\n If these basics are clear, the rest of the article will show how each scam type intersects with your QuickBooks environment and what controls give your firm the most predictable protection during tax season.<\/p>\n\n\n\n Before you can spot a fake IRS message, your team needs a clear picture of how legitimate IRS contact works.<\/p>\n\n\n\n The IRS is explicit that it usually starts with a letter<\/a> and that unexpected calls, texts, and emails asking for money or sensitive data should be treated with caution.<\/p>\n\n\n\n For busy QuickBooks<\/strong><\/a> firms, that means every suspicious notice, call, or email should be routed through a simple, shared rule set rather than handled ad-hoc by whoever picks it up.<\/p>\n\n\n\n In most situations, the IRS follows a predictable pattern:<\/p>\n\n\n\n The IRS typically sends an official letter or notice by the U.S. Postal Service before calling or emailing.<\/p>\n\n\n\n Revenue officers or agents may call about an existing matter, such as an unpaid balance, audit, or collection case, and will already have sent letters about it.<\/p>\n\n\n\n Personal visits are usually related to audits, collection actions, or criminal investigations and are carried out by identifiable IRS personnel who can provide credentials.<\/p>\n\n\n\n The IRS does not send unexpected texts<\/a> and does not generally initiate contact by email to request personal or financial information. Text messages are used only with the taxpayer\u2019s permission when they have subscribed to alerts.<\/p>\n\n\n\n When there is a legitimate balance due, the IRS directs taxpayers to pay electronically at the official IRS website<\/strong><\/a>, by \u201ccheck payable\u201d<\/em> to the United States Treasury, or through authorized channels listed on irs.gov, never through gift cards, crypto, or peer-to-peer apps.<\/p>\n\n\n\n From a firm workflow standpoint, any team member who receives a \u201cnew\u201d<\/em> IRS contact should be trained to ask two questions before reacting:<\/p>\n\n\n\n If the answer to either question is \u201cNo,\u201d<\/em> treat it as suspicious until proven otherwise.<\/p>\n\n\n\n Scammers<\/strong><\/a> often follow the same playbook. The IRS has been clear that it does not do several things that are common in fraud scenarios.<\/p>\n\n\n\n\n
In One Minute: What You Will Get From This Guide<\/strong><\/span><\/h2>\n\n\n\n
\n
Key Definitions for This Guide<\/strong><\/span><\/h2>\n\n\n\n
1. IRS Impersonation Scam<\/strong><\/span><\/h3>\n\n\n\n
2. Phishing<\/strong><\/span><\/h3>\n\n\n\n
3. Tax Identity Theft<\/strong><\/span><\/h3>\n\n\n\n
How the IRS Actually Contacts You (and What It Will Never Ask)<\/strong><\/strong><\/span><\/h2>\n\n\n\n
![\"How](\"http:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/03\/How-the-IRS-Actually-Contacts-You-and-What-It-Will-Never-Ask-1024x683.jpg\")
<\/figure>\n\n\n\nHow The IRS Initiates Contact<\/strong><\/span><\/h3>\n\n\n\n
1. First contact is by mail<\/strong><\/span><\/h4>\n\n\n\n
2. Phone calls come after written notices<\/strong><\/span><\/h4>\n\n\n\n
3. In-person visits are specific and rare<\/strong><\/span><\/h4>\n\n\n\n
4. Email and text are limited and controlled<\/strong><\/span><\/h4>\n\n\n\n
5. Payment goes through official channels only<\/strong><\/span><\/h4>\n\n\n\n
\n
What The IRS Will Never Ask You To Do<\/strong><\/span><\/h3>\n\n\n\n
![\"Green](\"http:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/03\/Green-Flags-vs.-Red-Flags-Your-Staff-Can-Memorize-1024x683.jpg\")
<\/figure>\n\n\n\n![\"The](\"http:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/03\/The-Most-Common-Tax-Season-Scams-and-How-They-Show-up-for-QuickBooks-Users-1024x580.jpg\")
<\/figure>\n\n\n\n