Scammers love the phrase Get Transcript. Real taxpayers use IRS Online Account or the Get Transcript tool to pull wage-and-income, account, and return transcripts for mortgages, student aid, or amended returns. Phishers clone that workflow: emails and texts that say your transcript is “ready,” “locked,” or “flagged for identity review,” then harvest your sign-in credentials, SSN, and prior-year AGI.
Broader impersonation patterns: Fake IRS and benefit scams. Refund-specific hooks: Fake tax refund emails. Login-theft playbook: Phishing and account takeover.
What a real transcript path looks like
| Step | Legitimate path | Phish path |
|---|---|---|
| How you start | You type irs.gov, open IRS Online Account / Get Transcript | Unsolicited email/SMS with a “View transcript” button |
| Login | Start at an irs.gov page you typed, then complete ID.me identity sign-in when IRS prompts you (IRS uses ID.me; it is not a separate “IRS password” you invent on a random page) | Lookalike domain (irs-transcript.us, gettranscript-irs.com, homoglyphs) or a fake ID.me page opened from an email/SMS button |
| What they ask | Your authenticators; never gift cards or crypto | SSN + AGI + bank routing “to unlock PDF,” remote-access software, gift-card “verification” |
| Delivery | On-screen PDF after authentication | Attachment named Transcript_2025.exe / WageIncome.html |
The IRS does not email or text unsolicited links that release a full transcript. If a lender or school needs a transcript, you pull it yourself and upload through their portal; or use IRS tools that send it with your consent.
Tells on fake transcript messages
- Subject lines like “Wage and Income Transcript Ready; Confirm Identity in 2 Hours”
- Display name “IRS Get Transcript” with a reply address outside
irs.gov - Urgency tied to a mortgage closing, FAFSA deadline, or “refund hold” you did not start
- QR codes on paper “IRS” letters that open a mobile login clone
- Requests for remote desktop “so a specialist can pull Form 4506-T for you”
- Upsells into paid “tax transcript concierge” sites that resell your credentials
Related fraud map: Credit and debt scams. If SSN data may have leaked: Protect your SSN.
Worked example
Jordan is buying a condo. A message arrives: “IRS: Lender requested Get Transcript. Approve release.” The button opens a page that looks like ID.me and asks for SSN, date of birth, and the Adjusted Gross Income from last year’s return.
Jordan closes the tab. Jordan opens a new browser, types irs.gov, chooses Individual Online Account / Get Transcript, and follows the real ID.me sign-in only from that IRS-started flow. Jordan sees no pending lender transcript request. Jordan tells the mortgage team to wait for a transcript Jordan pulls and uploads. No credentials shared on a link from email; closing is not delayed by a fake “approval.”
If you already entered data
- Change the password on any account that reused those credentials.
- On the real irs.gov Online Account, review recent activity and enable the strongest multifactor option available.
- Consider an IRS IP PIN (Identity Protection PIN) if you may need extra filing protection.
- Place a credit freeze / fraud alert and monitor for new accounts; see Phishing and account takeover.
- Report the message to phishing@irs.gov and ReportFraud.ftc.gov.
- If a tax return was filed in your name, follow IRS identity-theft recovery steps and keep copies for Filing taxes for beginners season.
Checklist
- Never open transcript links from email, text, or QR codes; type irs.gov yourself, then use the ID.me prompt IRS starts.
- Confirm the domain is real IRS (not a lookalike) before entering SSN or AGI.
- Pull transcripts yourself when a lender or school asks; do not “approve” unsolicited releases.
- Reject gift-card, crypto, wire, or remote-access “verification.”
- If you typed secrets, rotate passwords, check IRS Online Account, and report phishing.
- Prefer an IP PIN and credit freezes when your tax identity may be exposed.
Educational only. Not legal, tax, or security advice. Scam tactics and IRS authentication tools change; rely on official IRS channels you type yourself.