Fake tax office email lures recipients with promises of tax refunds
,regionOfInterest=(869,733)&hash=1dbb73383541c4f71b14d85a20e32554a158faea085d97300c666ad4fe53a4db)
A new phishing scam is targeting taxpayers in Germany with a fake ELSTER email promising a confirmed tax refund. Recipients are urged to verify their identity through a link, but the criminals behind the message are actually trying to steal payment-card details.
The fraudulent email reportedly uses the subject line “Ihr Steuerbescheid 2025, Erstattung bestätigt” (“Your 2025 tax assessment, refund confirmed”). It claims that a tax refund is ready to be paid and asks recipients to complete an identity check before receiving the money.
The message creates additional pressure by setting a deadline of August 31 and warning that the refund will supposedly expire afterward. This combination of an unexpected payment and a short deadline is designed to make people act quickly without checking whether the email is genuine.
There are several clear warning signs. The message may use an impersonal greeting and an address that does not belong to the official ELSTER domain. Most importantly, the Finanzamt does not need credit-card numbers or card security codes to transfer a tax refund. The scam link instead leads to a fake website designed to collect the information entered by victims.
The scam can be particularly convincing for people who have recently filed their tax returns and are genuinely expecting money from the Finanzamt. ELSTER is widely used by German taxpayers and businesses, making a fake message appear believable to millions of potential targets.
Smartphone users may be especially vulnerable because important details, such as the full sender address or the destination of a link, can be harder to notice on a small screen. Simply seeing the familiar ELSTER logo does not prove that an email is authentic.
Anyone who has entered card details into the fraudulent website should immediately contact their bank or credit-card provider and have the affected card blocked. Account statements should also be monitored for suspicious transactions. If an ELSTER password may have been exposed, it should be changed through the official elster.de website rather than through any link contained in the suspicious email.