Table of Contents
Why is the tax office asking for my bank details for a 2025 return I haven’t filed yet?
The “Early Bird” Refund Scam (Brazil Server Variant)
Cybercriminals have launched their 2026 phishing campaigns with aggressive timing. A prevalent email currently circulating claims your 2025 tax calculation is complete and a refund is pending. The message insists you must respond within 48 hours to secure the funds.
Why this is fraudulent:
- Impossible Timeline: It is logically inconsistent for a 2025 tax refund to be ready in January 2026. Most taxpayers have not yet filed their returns, meaning the tax office possesses no data to calculate a refund.
- Technical Anomalies: Technical analysis of these emails reveals the hosting server is located in Brazil. Legitimate tax authorities (such as the Federal Central Tax Office) do not host their mail servers in South America.
- Data Harvesting: The goal is solely to extract your bank account details under the guise of a deposit.
The “§ 218 AO” Legal Pressure Scam
Consumer advice centers have identified a second, more sophisticated variant appearing in early February 2026. This email uses legal jargon to create a false sense of authority.
Key identifiers of this attack:
- Subject Line: “Review of tax refund according to § 218 AO.”
- The Hook: It poses as an official notification claiming an automated assessment has determined a refund in your favor.
- Artificial Urgency: The scammers enforce a strict deadline (e.g., February 2nd to February 9th, 2026). This tight window is a psychological tactic designed to panic the recipient into acting rashly without verification.
- Red Flags: The email uses a generic salutation (“Dear Sir or Madam”) rather than your name. It demands you fill out a linked form “truthfully” to ensure “fastest possible payment.”
Official Protocols and Safety Measures
To protect your financial security, you must understand how legitimate tax authorities operate.
The Golden Rule:
The tax office never requests sensitive banking information or personal data via email.
Legitimate Communication Channels:
- Secure Portals: All official digital communication regarding tax assessments occurs exclusively through secure portals (such as Elster).
- Authentication: These platforms require a personal certificate or secure login, ensuring the identity of both the sender and the recipient.
- No Direct Links: Authorities do not send emails containing direct links to forms requesting data entry.
Recommended Action
If you receive either of these messages or similar variants:
- Do not click any links or download attachments.
- Do not reply with any personal information.
- Delete the email immediately or move it to your spam folder.
- Verify status only by logging into the official government tax portal directly through your browser.