Tax Refund Theft at State Level

Tax season is stressful enough without having to worry about someone stealing your refund before it reaches your hands. But that is exactly what is happening across the country, and it is not just the IRS you need to watch out for. State-level tax refund theft is a fast-growing online scam that targets middle-class Americans, many of whom are in that 45-to-64 age bracket where retirement planning and financial stability matter most. Unreputable has tracked a disturbing trend: fraudsters are filing fake state tax returns using stolen personal information, and they are getting away with it because state revenue departments are often less secure and less staffed than the federal system.

The mechanics of this scam are straightforward and chilling. A criminal obtains your Social Security number, date of birth, and other personal details through a data breach, phishing email, or even a text smishing message that looks like it comes from your state’s tax agency. Using this stolen identity, they file a fraudulent state tax return early in the season, claiming a hefty refund. Since many states process returns quickly and automatically for low-income and middle-class filers, the scammer’s refund gets approved and sent to a prepaid debit card or a temporary bank account they control. By the time you file your legitimate return, the state flags it as a duplicate—and you are left waiting months for an investigation while your cash is already gone.

The problem is particularly severe because states have different security protocols. Some states still rely on outdated verification systems that do not cross-check identity documents as aggressively as the IRS does with its Identity Protection PIN program. This means that a scammer with just a few pieces of your personal data can slip through the cracks. In 2023 alone, states like California, New York, and Texas reported tens of thousands of cases of stolen refunds, with losses running into the hundreds of millions. And because these are state rather than federal funds, victims often face a slower, more confusing resolution process.

How do these criminals get your information in the first place? The answer is often the same old online scams dressed up in new clothes. You might get an email that appears to be from your state’s department of revenue, asking you to “verify your identity” to speed up your refund. Clicking the link takes you to a convincing fake portal where you type in your Social Security number, bank account details, and other sensitive data. This is phishing, plain and simple. Another common tactic is a text message claiming your state refund has been delayed due to a “processing error” and you need to click a link to fix it. That link, of course, leads to malware or a data-stealing page. Scammers also use synthetic identity fraud, combining real Social Security numbers with fake names and addresses to create a brand-new identity that can pass basic state checks.

If you are in the 45-to-64 age group, you are a prime target for two reasons. First, you are likely to have a stable income and a consistent filing history, which makes your refund larger and more predictable. Second, you may not be as vigilant about checking your state tax account balance as often as you should. The scam works best when you do not realize anything is wrong until you try to file your own return and discover it has already been submitted. By then, the money is long gone and the trail is cold.

So what can you do to protect yourself? First, file your state tax return as early as possible. The earlier you file, the less chance a scammer has to beat you to it. Second, never click on links in unsolicited emails or text messages that claim to be from your state tax agency. Instead, go directly to your state’s official website by typing the URL into your browser. Third, set up an online account with your state’s revenue department if they offer that service. Many states now allow you to monitor your filing status and see if any returns have been submitted in your name. Check this account regularly during tax season, even before you file. Fourth, consider placing a credit freeze with the major credit bureaus. While this does not directly stop state tax fraud, it makes it harder for scammers to open new accounts in your name, which is a common step in building a synthetic identity.

If you discover that a fraudulent state return has been filed in your name, act immediately. Contact your state’s department of revenue and request a fraud affidavit. You will need to fill out that form and provide proof of your identity, such as a copy of your driver’s license and last year’s tax return. Also file an Identity Theft Affidavit with the Federal Trade Commission at IdentityTheft.gov and file a police report with your local law enforcement. Do not assume your bank or credit card company will handle this for you—they cannot undo a state tax refund issued to a scammer.

State-level tax refund theft is not going away. As states push for faster electronic filing and same-day refund options, the window for fraud only widens. Scammers know that state systems are underfunded and understaffed, and they exploit those weaknesses with phishing campaigns that look increasingly legitimate. The key is to stay one step ahead: file early, verify everything, and assume nothing. Your refund is your money, and nobody—least of all a scammer hiding behind a fake email address—should get to it before you do.