IRS Warning of Impersonation Attacks Targeting Universities

March 31, 2021

Mar. 31st - The Internal Revenue Service issued a warning of an ongoing IRS-impersonation scam that appears to primarily target educational institutions, including students and staff who have ".edu" email addresses. The phishing emails appear to target university and college students from both public and private, profit and non-profit institutions.

The fraudulent email displays the IRS logo and uses various subject lines such as "Tax Refund Payment" or "Recalculation of your tax refund payment." It asks people to click a link and submit a form to claim their refund. 

The phishing website requests taxpayers provide their:

  • Social Security number
  • First Name
  • Last Name
  • Date of Birth
  • Prior Year Annual Gross Income (AGI)
  • Driver's License Number
  • Current Address
  • City
  • State/U.S. Territory
  • ZIP Code/Postal Code
  • Electronic Filing PIN

NOTE: Taxpayers who believe they have a pending refund can easily check on its status at Where's My Refund?(link is external) on

If you think you've received this scam email:

Do not click on the link in the email, but report it as phishing. Using the bMail web interface:

  1. Open the message
  2. To the right of 'Reply' arrow, select 'More' (typically denoted with three vertical dots)
  3. Then 'Report phishing'

If you are unable to log into bMail forward the message to

If you provided any information through this scam, please let the Information Security Office know by emailing

See more information at the IRS's site: