Tax-authority phishing / 'irregular tax ID' scam : fonctionnement, signaux et que faire

Identity theft · médio

The victim gets an email, SMS or message saying their tax ID (CPF) is irregular or will be cancelled, that they've been flagged for audit, have a refund due or a debt to pay — with a link or attachment.

The link leads to a page mimicking the Federal Revenue Service or gov.br, asking for tax ID, password, bank details or a selfie, or generating a Pix or boleto to "regularise". The attachment may install malware.

With the gov.br account, criminals can access data and services in the victim's name. In the US, the equivalent is fake IRS demands by phone or email.

Sinais / Signs

Message threatening tax-ID cancellation or an immediate fine.
Link or attachment in an email claiming to be from the tax authority.
Demand to pay by Pix to settle your tax status.
Request for your gov.br password or a selfie.
Sender domain that isn't the official government one.

Prevenção / Prevention

Check your tax-ID and return status only on the official site or app, typing the address.
Remember the tax authority doesn't ask for passwords or send payment links by SMS or WhatsApp.
Enable two-step verification on your gov.br account.
Don't open attachments in unexpected emails.
Federal taxes are paid via official forms (DARF) generated by the tax authority's systems.

O que fazer / What to do

Change your gov.br password, enable two-step verification and review granted authorisations.
Call your bank right away using the official number (back of the card or in the app) and ask to block cards, accounts and access.
If you paid via Pix, ask your bank to open a MED (Special Return Mechanism) claim as soon as possible — time matters because funds move fast.
File a police report (many Brazilian states accept online reports) and keep screenshots, receipts, numbers and links.
If your personal data was exposed, follow ANPD guidance and monitor use of your tax ID.
In the US, report to the FBI IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov); if your identity was misused, follow the plan at identitytheft.gov.

FAQ

I got a message saying my CPF is irregular. Is it a scam?

Very likely. Check your CPF status on the Federal Revenue Service's official site without clicking the link you received.

Does the tax authority send emails or texts?

Official communications sit in the e-CAC mailbox inside the official portal. Distrust messages with links, attachments or payment demands.

CERT.br — Cartilha de Segurança para Internet · ANPD — Autoridade Nacional de Proteção de Dados · FTC — ReportFraud · IdentityTheft.gov (FTC)