Government fraud

How to spot a fake tax authority message: check the portal, not the link

A text or email about an overdue tax debt, a deadline, and a link to pay it. In the Netherlands the national fraud desk receives recurring waves of these messages: they claim a payment is outstanding, threaten a seizure if you do not pay, and offer a link that prevents it. The advice is unambiguous: the messages are fake, the Dutch tax administration never sends this kind of message by text or email, and you should not pay but delete and report them (Fraudehelpdesk, fake tax office text).

The check that works is not reading the sender or the logo, but opening your own portal. That is what this guide is built on: a genuine tax message sits in your official inbox, and a payment request never arrives through a link in a text or email.

Direct answer: five checks on a message that claims to be from the tax office

1. Verify inside the official portal, not through the message. The Dutch tax administration tells people to log in to one of its portals and check there whether a message really comes from it (Belastingdienst, reporting phishing). If nothing is waiting in your message box, the message is not from the tax office. Open the address yourself or from your own bookmark; never through the link.
2. Know what the agency never does. It never sends a text asking you to pay an overdue tax debt, never asks for that through a link, and always informs you of outstanding amounts in writing (Belastingdienst, examples of fake messages). It also never sends QR codes for payments by email and never emails payment requests or large "pay now" buttons, and it never asks you in a messaging app to pay through a link or to hand over personal data (Belastingdienst). On the US side, the Internal Revenue Service asks people to report all unsolicited email claiming to come from it — including full email headers — to [email protected] (IRS, report phishing).
3. Check any account number on the official site. If a message does contain a bank account, the Dutch tax administration advises checking on its own website whether that account number really belongs to it (Belastingdienst). Never trust the number printed in the message itself, even when the name and logo look right; both take a minute to copy.
4. Recognise the pressure pattern. An outstanding debt, a short deadline, a threat of seizure or a bailiff, and a payment link belong together in one pattern (Fraudehelpdesk). The same pressure appears in variants: a text telling you to declare your crypto wallet before a deadline to avoid a fine, or a letter using the names of the tax administration and the fine-collection agency together (Belastingdienst). Anyone who pressures you to pay before you can verify the claim is selling urgency, not a payment arrangement.
5. Do not pay, keep the message, and report it. Do not delete it before reporting: forward it to the tax administration through [email protected] and report it to the national fraud desk (Belastingdienst; Fraudehelpdesk). That is how the phone number, the bank account or the website gets taken down.

Why the sender proves nothing

In email and text messaging the sender is a label you can copy: a logo, a display name, and even a domain that resembles the real one. Tax administrations do use email and text, but never to ask you to pay through a link or to hand over personal data (Belastingdienst). That is exactly why the portal is the anchor: what is not there was not sent. It is the same logic as in the guide on fake bank calls — the channel you open yourself is trustworthy, the channel the sender opens for you is not.

What a detector does and does not see

You can run the text of the message through the text detector and a screenshot through the image detector. That is triage: it helps you decide which message to verify first. It says nothing about the sender or about whether you owe anything. Phishing messages come from templates and are often short; they carry too little writing style for a reliable signal, so a low score never proves that a message is genuine.

What a tax message cannot tell you

• whether there really is an outstanding debt or assessment — that is what your own portal is for;
• whether the sender is the tax administration, even when the logo, display name or domain match;
• whether an account number belongs to the authority — check it on the official site;
• whether it is fraud; only an investigating authority can establish that.

If you already paid or entered your details

• Contact your bank immediately on the number you found yourself; speed decides the chance of a block or a recall.
• Report it to the national fraud desk and, if you lost money, file a police report (Fraudehelpdesk, reporting fraud).
• Left personal data or a copy of your ID behind? Report it to the national identity-fraud desk and check whether your details are being used elsewhere.
• Opened an attachment or installed an app? Remove it, check the device and change the passwords you used there.
• Keep everything: the message, the sender number or address, the link, the account number and the timestamp.

More checks are in the guides on spotting a fake debt collection letter, checking a suspect invoice and a fake bank call. To check a message or a file on its own, use the free checker. If the message claims you owe a traffic fine, use the five checks on a fake fine.

Frequently asked questions

I got a text about an overdue tax debt with a payment link. Is it real?

No. The tax administration never sends a text asking you to pay an overdue tax debt, never asks for that through a link, and always writes to you about outstanding amounts. Check your official message box and do not pay through the link.

Does an official-looking email address or logo prove the message is real?

No. Display names, logos and domains can be copied. The administration never asks you to pay through a link or to share personal data, and what is not in your portal was not sent.

Does a high detector score prove the message is fake?

No. The score describes patterns in a text or an image and says nothing about the sender. A low score does not prove a message is genuine either. Treat the result as a reason to verify the message inside your own portal, never as proof.