Report Fraud and Identity Theft

You can report an individual or a business you suspect of tax fraud online.

You can report identity theft online.

We also recommend visiting IdentityTheft.gov. IdentityTheft.gov is the federal government’s one-stop resource for identity theft victims. The site provides streamlined checklists and sample letters to guide you through the recovery process.

Refer to the Resources and Contact Information section below for more information.

Did you receive a phone call, email, or letter about your Iowa taxes? How do you know the communication received is actually from the Iowa Department of Revenue?

• The Department does not initiate contact with taxpayers by email to request personal or financial information. This includes any type of electronic communication, such as text messages and social media.
• The Iowa Department of Revenue will always identify itself.
• You will never be asked to provide your full Social Security Number by email.

Phishing Warning Signs

• Incorrect spelling and poor grammar may indicate the source of the contact isn’t a professional organization, such as the Iowa Department of Revenue.
• Threats or requests for immediate action are often used in phishing to create a sense of urgency.
• Links or attachments in unsolicited communications may be attached to an email you receive. They are designed to hack into your computer, steal money, or steal your identity.
• Requests for personal or financial information such as your full Social Security Number, bank account, or credit card information.

If you are unsure the communication you received is from the Iowa Department of Revenue,

1. Do not provide any personal or confidential information.
2. Contact us directly and we will confirm whether the communication you received was from the Iowa Department of Revenue:
   
   Send an email to: idr@iowa.gov or call 515-281-3114

To further protect your personal information, the Department requires you to copy the three questions below into any email requesting confidential tax information and answer them. We will respond to a request for confidential information only after your authorization is received.

• Do you authorize the Iowa Department of Revenue to email the confidential information you may request?
• To what email address do you want us to send confidential information?
• Do you acknowledge that email transmissions are not always secure?

The Department does not initiate contact with taxpayers by email to request personal or financial information. This includes any type of electronic communication, such as text messages and social media.

Four Ways to Keep Yourself Cyber Safe:

1. Turn on multi-factor authentication - Any two of the following:

• Something you know: a pin or password
• Something you have: authentication application or confirmation via text message
• Something you are: fingerprint or FaceID

2. Update your software, and turn on automatic software updates if available
3. Think before you click
4. Use strong passwords

• Long - 15+ characters
• Unique - never used anywhere else
• Randomly generated - usually by a computer or password manager

Make sure you're not recycling the same password across all of your apps and websites.

Emails and Text Messages - Best Practices

Understand the signs of a phishing email attempt:

• Does it contain an offer that’s too good to be true?
• Does it include language that’s urgent, alarming, or threatening?
• Is it poorly crafted writing, riddled with misspellings and bad grammar?
• Is the greeting ambiguous or very generic?  
• Does it include requests to send personal information?
• Does it stress an urgency to click on an unfamiliar hyperlink or attachment?
• Is it a strange or abrupt business request?

What do I do if I receive or click on a suspicious email or text message?

• If you know it is a phishing/spam email or text message, report phishing/spam and then delete the message
• If you believe you clicked on a suspicious attachment or link, change your passwords immediately

Phone Calls - Best Practices

If you believe a phone call is fraudulent, you can do the following:

• Don't pick up the phone
• Hang up
• Don't press buttons or respond to prompts
• Verify the caller's identity
• Join the National Do Not Call Registry

• Report Fraud
• Report Identity Theft
• Report Tax Preparer Fraud
• IRS - Identity Theft Central
• Iowa Attorney General Tips & Information
• Federal Trade Commission (FTC) Assistance

If you believe you have been scammed by someone pretending to work for the IRS, send an email to Phishing@IRS.gov. Also visit the IRS Identity Protection page online.