Email Scam Impersonating IRS Targeting Universities

The Internal Revenue Service (IRS) issued a warning this week notifying those affiliated with higher education institutions of an ongoing email scam that appears to be primarily targeting those who have “.edu” email addresses, namely employees and students from both public and private, for-profit, and nonprofit institutions.

What does the email look like?

The phishing email displays the IRS logo and uses various subject lines such as "Tax Refund Payment" or "Recalculation of your tax refund payment." It then asks the recipient to click a link to access the fraudulent website and submit a form to claim their refund.

What type of information does the fraudulent website request? 

  • Social Security number
  • First Name
  • Last Name
  • Date of Birth
  • Prior Year Annual Gross Income (AGI)
  • Driver's License Number
  • Current Address
  • City
  • State/U.S. Territory
  • ZIP Code/Postal Code
  • Electronic Filing PIN

What should I do if I receive such an email?

If you receive this scam email, do not click on the link within the email and please report the email to the NEOMED Help Desk. For security reasons, save the email using "Save As" and then send that attachment to or forward the email as an attachment to

The IRS recommends that taxpayers who believe they may have provided identity thieves with this information should consider immediately obtaining an Identity Protection PIN. This is a voluntary opt-in program. An IP PIN is a six-digit number that helps prevent identity thieves from filing fraudulent tax returns in the victim's name. Additionally, you can refer to the IRS Identity Theft Central to learn about the signs of identity theft and actions to take. Finally, if you believe you have a pending refund, you should check the status only on the agency’s website,

-Submitted by Jonathan Wagner

Share this post