FOLLOW US

A sophisticated phishing campaign posing as the Internal Revenue Service is flooding inboxes with a shocking promise: a $5,000 tax refund allegedly tied to Elon Musk. Security researchers say the scam is designed to drain victims’ personal data and bank accounts during one of the busiest and most vulnerable times of the year—tax season.

The warning comes as IRS impersonation scams hit peak levels, with attackers increasingly blending financial fraud, cryptocurrency hype, and trusted government branding to lure victims into a carefully constructed trap.

IRS Scam Surge Reaches Peak During Tax Season

Through the Security Summit, the Internal Revenue Service publishes its annual “Dirty Dozen” list of top tax scams targeting taxpayers, and agency impersonation via email, text, and phone ranks at the top this year. Officials report more than 600 social media impersonators in fiscal year 2025 alone, and they are urging the public to avoid clicking links or opening attachments from unexpected messages.

Now, security researchers from Cofense PDC (Phishing Defense Center) and Cofense Intelligence have identified a new wave of fraudulent emails that combine IRS impersonation with cryptocurrency messaging and Elon Musk’s name to increase credibility and emotional impact.

Elon Musk “Dogecoin Initiative” Used as Bait

The scam email is carefully crafted to appear like an official IRS communication. It falsely informs recipients that they have been selected to receive a $5,000 financial boost supposedly linked to Elon Musk.

To strengthen the deception, attackers even include a legitimate IRS phone number in the footer, specifically the IRS Practitioner Priority Service line. Researchers believe this detail was intentionally added to make the message appear more authentic.

The fraudulent website also features an IRS-branded header and images of Elon Musk, reinforcing the illusion of an official government-backed program. The content promotes a fabricated initiative called the “ElonMusk Dogecoin Initiative,” referencing global economic tensions, including conflict in Iran, to justify its existence.

“This program is designed to strengthen the U.S. economy while providing financial relief to offset rising fuel and living costs. It also promotes the growth of Dogecoin as a U.S. based cryptocurrency amid global economic changes,” the text reads. “As part of this initiative, there are plans to collaborate with the IRS to support eligible individuals.”

The scheme escalates further by promising not only a one-time $5,000 payment but also recurring $10,000 deposits. Victims are told they must first purchase $9,500 in Bitcoin, which is allegedly returned later as part of the initiative.

The Trap Behind the Fake Refund Offer

To claim the fabricated refund, victims are instructed to submit extensive personal and financial details. The required information includes full name, postal and email addresses, phone number, photo ID, driver’s license number, employer details, banking institution, and full bank routing and account numbers.

Once submitted, victims are redirected to a “Redeem Voucher” page where they are told to enter the code “ELON” to unlock the $5,000 deposit. The site claims funds can then be withdrawn immediately.

However, the illusion collapses when withdrawal is attempted. Victims are informed that withdrawals require three months of “active participation” on the platform. This delay tactic is designed to prolong engagement, giving scammers time to extract additional payments while maintaining the illusion of legitimate earnings.

Researchers warn that the damage extends far beyond initial losses.

“Using this information, the threat actors would be capable of much more sophisticated identity theft and social engineering attacks beyond the information exfiltrated from the credential phishing form,” the researchers reported. “The threat actors would also be able to steal money directly from the victim’s bank account due to having access to the account and routing numbers.”

IRS Issues Strong Warning as Fraud Activity Spreads

Security experts emphasize that this campaign highlights the growing sophistication of phishing attacks, which now combine government impersonation with celebrity branding and cryptocurrency incentives to bypass user skepticism.

They warn that relying on traditional email filters is no longer enough, and users must actively recognize and report suspicious communications before damage occurs.

While the scam is actively circulating, researchers note that the attackers’ Bitcoin wallet currently shows no transaction activity, suggesting that no funds have yet been transferred in or out.

As tax season continues, officials are urging taxpayers to remain alert, avoid unsolicited refund offers, and treat any unexpected IRS communication as a potential threat.