Scammers love the phrase Get Transcript. Real taxpayers use IRS Online Account or the Get Transcript tool to pull wage-and-income, account, and return transcripts for mortgages, student aid, or amended returns. Phishers clone that workflow: emails and texts that say your transcript is “ready,” “locked,” or “flagged for identity review,” then harvest your IRS username, password, SSN, and prior-year AGI.
Broader impersonation patterns: Fake IRS and benefit scams. Refund-specific hooks: Fake tax refund emails. Login-theft playbook: Phishing and account takeover.
What a real transcript path looks like
| Step | Legitimate path | Phish path |
|---|---|---|
| How you start | You type irs.gov, open IRS Online Account / Get Transcript | Unsolicited email/SMS with a “View transcript” button |
| Login | ID.me or IRS credentials on an irs.gov domain you typed | Lookalike domain (irs-transcript.us, gettranscript-irs.com, homoglyphs) |
| What they ask | Your authenticators; never gift cards or crypto | SSN + AGI + bank routing “to unlock PDF,” remote-access software, gift-card “verification” |
| Delivery | On-screen PDF after authentication | Attachment named Transcript_2025.exe / WageIncome.html |
The IRS does not email or text unsolicited links that release a full transcript. If a lender or school needs a transcript, you pull it yourself and upload through their portal—or use IRS tools that send it with your consent.
Tells on fake transcript messages
- Subject lines like “Wage and Income Transcript Ready—Confirm Identity in 2 Hours”
- Display name “IRS Get Transcript” with a reply address outside
irs.gov - Urgency tied to a mortgage closing, FAFSA deadline, or “refund hold” you did not start
- QR codes on paper “IRS” letters that open a mobile login clone
- Requests for remote desktop “so a specialist can pull Form 4506-T for you”
- Upsells into paid “tax transcript concierge” sites that resell your credentials
Landscape of related fraud: Credit and debt scams. If SSN data may have leaked: Protect your SSN.
Worked example
Jordan is buying a condo. A message arrives: “IRS — Lender requested Get Transcript. Approve release.” The button opens a page that looks like ID.me and asks for SSN, date of birth, and the Adjusted Gross Income from last year’s return.
Jordan closes the tab. Jordan opens a new browser, types irs.gov, signs into the real IRS Online Account, and sees no pending lender transcript request. Jordan tells the mortgage team to wait for a transcript Jordan pulls and uploads. No credentials shared; closing is not delayed by a fake “approval.”
If you already entered data
- Change the password on any account that reused those credentials.
- On the real irs.gov Online Account, review recent activity and enable the strongest multifactor option available.
- Consider an IRS IP PIN (Identity Protection PIN) if you may need extra filing protection.
- Place a credit freeze / fraud alert and monitor for new accounts—see Phishing and account takeover.
- Report the message to phishing@irs.gov and ReportFraud.ftc.gov.
- If a tax return was filed in your name, follow IRS identity-theft recovery steps and keep copies for Filing taxes for beginners season.
Checklist
- Never open transcript links from email, text, or QR codes—type irs.gov yourself.
- Confirm the domain is real IRS (not a lookalike) before entering SSN or AGI.
- Pull transcripts yourself when a lender or school asks; do not “approve” unsolicited releases.
- Reject gift-card, crypto, wire, or remote-access “verification.”
- If you typed secrets, rotate passwords, check IRS Online Account, and report phishing.
- Prefer an IP PIN and credit freezes when your tax identity may be exposed.
Educational only. Not legal, tax, or security advice. Scam tactics and IRS authentication tools change; rely on official IRS channels you type yourself.