Phishing, smishing, and spear phishing are all ways that scammers try to trick tax professionals into turning over confidential information, the IRS said Thursday in its annual Dirty Dozen list of scams.
“Scammers are relentless, and they use the guise of tax season to try tricking taxpayers into falling into a variety of traps. These red flags can lead to everything from identity theft to being misled into claiming tax credits for which they’re not entitled,” Terry Lemons, IRS communications senior adviser, said in a news release.
Started in 2002, the annual Dirty Dozen campaign is designed to raise awareness and protect taxpayers and tax pros from common frauds. The 2025 list includes some older scams — phishing has appeared since at least 2010, while smishing first appeared on the 2023 list.
As part of these continuing efforts to protect taxpayers against evolving scams, the 2025 IRS Dirty Dozen list highlights these threats:
New client scams and spear phishing
Cybercriminals impersonate new, potential clients to trick tax professionals and other businesses into responding to their emails. Once the tax pro responds, the scammer sends a malicious attachment or URL that can compromise the preparer’s computer systems and allow access to sensitive client information.
Spear phishing is a phishing attempt tailored to a specific organization or business and is potentially more dangerous than phishing because it can steal client data and the tax professional’s identity, allowing the thief to file fraudulent returns using the stolen information.
Warning signs include poorly constructed sentences and unusual word choices.
Email phishing scams
The IRS warns that taxpayers and tax professionals should be alert to fake communications from entities posing as legitimate organizations in the tax and financial community, such as the IRS, state tax agencies, and tax software companies. The two main types are:
- Phishing: An email claiming to come from the IRS that tries to lure recipients with ruses such as a phony tax refund or threat of legal or criminal charges for tax fraud.
- Smishing: A text message where scammers often use alarming language such as “your account has now been put on hold” or “unusual activity report,” with a bogus “solutions” link to restore the recipient’s account.
The other Dirty Dozen scams are:
- Ghost tax return preparers;
- Bad social media advice;
- IRS individual online account help from scammers;
- Fake charities;
- False fuel tax credit claims;
- Credits for sick or family leave;
- Bogus self-employment tax credit;
- Improper household employment taxes;
- Overstated withholding claims; and
- Misleading offers in compromise.
Report abusive tax schemes and tax return preparers
To report an abusive tax scheme or a tax return preparer, people can use the online Form 14242, Report Suspected Abusive Tax Promotions or Preparers.
— To comment on this article or to suggest an idea for another article, contact Martha Waggoner at Martha.Waggoner@aicpa-cima.com.
