Cybercriminals are once again exploiting tax season—this time by leveraging the name of Elon Musk in a sophisticated IRS-themed phishing campaign. According to new research from Cofense, attackers are sending convincing spoofed emails designed to trick recipients into handing over sensitive financial information, ultimately enabling account takeovers and identity theft.
The fraudulent email appears legitimate at first glance. Labeled “Update Regarding Your Refund” and addressed to “Dear Taxpayer,” it features official-looking IRS branding and a sender name mimicking the Internal Revenue Service. To boost credibility, the message even includes a real IRS phone number tied to the Practitioner Priority Service.
The scam message falsely claims recipients have received a tax refund “courtesy of Elon Musk,” urging them to click a “View Your Tax Refund” button. Once clicked, victims are redirected through a chain of fake websites designed to harvest login credentials and personal data.
These phishing pages escalate the deception by promoting a fake “Elon Musk Dogecoin Initiative,” promising users up to $5,000 in funding. The sites are filled with IRS imagery and references to current economic issues—such as rising gas prices and global conflicts—to appear more believable. They also include fabricated instructions for setting up banking and cryptocurrency accounts, further deepening the scam.
Researchers warn that this campaign is just one of many IRS-related phishing attacks circulating during peak tax season. By combining trusted institutions with high-profile names, attackers are increasing their success rates and putting unsuspecting taxpayers at greater risk.
How to stay safe: Always verify the sender before clicking links, avoid unsolicited refund claims, and remember—the IRS does not initiate contact via email for sensitive financial matters.