Hacker takes over your Indian income tax account and files a fake refund while you're abroad
Cybercriminals compromise dormant NRI income tax e-filing accounts, change the registered email, phone, and bank details, then file a fraudulent revised ITR to redirect the refund. The victim — often abroad — finds out only months later.
Also known as: NRI income tax account hack, IT e-filing account takeover India, fake revised ITR refund fraud, income tax portal account hijack
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
What to do right now
- 1 Log in to incometax.gov.in immediately and check your registered email, mobile, and bank account under 'Profile Settings' — any change you didn't make is a red flag
- 2 If account details were changed without your knowledge, call the Income Tax helpline at 1800-103-0025 and report account compromise; also file at cybercrime.gov.in
- 3 Enable 2-factor authentication on your income tax portal account and use an email address you actively monitor from abroad
- 4 Check your filed ITR history — if you see a revised ITR you never filed, report it immediately to the Assessing Officer and the cybercrime portal
- 5 Contact your Indian bank and ask them to block any refund credit to an account that is not yours if fraud is confirmed
- 6 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Red flags
- ⚠ You are an NRI and have not logged into incometax.gov.in for several months — inactive accounts are the primary target
- ⚠ A legitimate tax refund you expected never arrives, or a refund shows as 'processed' for an amount you never claimed
- ⚠ You try to log in to your income tax e-filing account and your registered email or password no longer works
- ⚠ You receive no phishing SMS, no link to click — the theft is silent until you notice the account or refund is wrong
- ⚠ Your registered mobile number in India is inactive or a number you no longer monitor
This scam is invisible until long after the damage is done. The fraudster never contacts the victim — there is no phishing SMS to click, no urgent WhatsApp message, no fake government officer on a call. They simply obtain the victim’s income tax portal credentials (through a data breach, credential stuffing, or an old phishing episode the victim forgot about), change all the account details, and file a fraudulent revised ITR that generates a large refund.
NRIs are particularly vulnerable because they often have dormant income tax accounts with old Indian mobile numbers they no longer monitor, and they may not check incometax.gov.in for months or years at a time.
If you are an NRI with an active Indian income tax filing history: log in today, verify your registered email, mobile, and bank account, and enable 2FA. If anything looks wrong, call 1800-103-0025 and file a complaint on cybercrime.gov.in immediately.
Sources
- The Tribune — Panchkula Cyber Crime Police arrest kingpin in ₹2.26 crore NRI income tax e-filing hijack (July 2026)
- The North News — Panchkula Police bust ₹2.26 crore fake income tax refund fraud targeting NRI (July 2026)
- The420.in — ₹2.26 Crore Fake Tax Refund Fraud from NRI Income Tax Account Exposed (July 2026)