Loading page
About this tool
Shows how fake refund notices imitate official domains and skip the DIN, with a scanner that weighs the same markers in any message you paste.
This explainer dissects the fake income tax refund notice — an approved amount, a bank-account mismatch, and a link that wants your net banking login — and names the tell in each line. It sets the message against two rules that settle it: refunds are credited only to a bank account already pre-validated on the e-filing portal and linked to your PAN, and every departmental communication issued since 1 October 2019 carries a Document Identification Number. A scanner scores anything you paste against 13 weighted markers and reads the registrable domain behind each link.
Open Income Tax Refund Phishing Anatomy on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
The DIN requirement and the pre-validated-account rule give you two checks that do not depend on how convincing the message looks.
The inspector resolves the registrable domain, handles gov.in and co.in suffixes, and flags punycode, userinfo tricks, shorteners and bare IP hosts.
Every rule runs in your browser, so a notice you are unsure about never leaves the tab.
No. A refund is credited directly to the bank account you pre-validated on the e-filing portal and linked to your PAN, so there is nothing to claim and no link to click. Refund status is visible only inside your own e-filing account at incometax.gov.in.
Look for the Document Identification Number. Every communication issued by the department since 1 October 2019 carries a computer-generated DIN, one issued without a valid DIN is treated as never issued, and you can verify it under "Authenticate notice/order issued by ITD" on the e-filing portal.
No. Only the domain after the @ identifies a sender, and words like incometaxindia can appear anywhere inside a domain that someone else registered. Genuine departmental mail comes from the incometax.gov.in family of addresses, and .gov.in cannot be registered by a private party.
Call your bank on the number printed on your card and have the login and card locked, then call 1930 and file at cybercrime.gov.in with the message and the full link. Check your actual refund status by typing incometax.gov.in yourself; this is general guidance, not tax or legal advice.