Quick Take
- Scammers are sending fake income tax notices on WhatsApp with a bad file called ITD.zip, warns CloudSEK.
- The fake notice looks official, gives you just 72 hours, and secretly installs data-stealing malware.
- ITR filing for 2026 ends on September 15, so check every notice only on the official tax website.
In This Article
Fake income tax notices are being sent to people in India over WhatsApp. The message comes with a harmful file named ITD.zip. Cybersecurity firm CloudSEK shared this warning in a report on July 30, 2026.
The message pretends to be from the Income Tax Department. It shows a fake penalty notice and asks you to act within 72 hours. This is happening right when people are busy filing returns. The last date to file for this year is September 15, 2026, as set by the Central Board of Direct Taxes (CBDT). CloudSEK looked at real scam samples that victims shared on X, and studied the fake setup itself. You can read the full report on the CloudSEK blog.
StartupFeed Insight
The smart part of this scam is the timing, not the malware. Scammers send fake income tax notices in the exact weeks when everyone is thinking about refunds and last dates. So fear makes people click before they stop to think. The real targets are often finance and HR staff, because they open tax and bill emails every day. StartupFeed expects a second wave of these messages around the September 15, 2026 deadline, with new fake websites replacing the ones already caught. The rule is simple: treat any tax file on WhatsApp as dangerous. By Harshvardhan Jain.
Fake Income Tax Notices: How the Scam Works
The fake income tax notices scam happens fully inside chat apps. There is no real link to the tax department. CloudSEK found that unknown WhatsApp numbers send a fake official letter along with a file called ITD.zip. The message starts with an official-looking line about Aayakar Bhawan, New Delhi.
| Detail | What CloudSEK Found | Notes |
|---|---|---|
| Fake letter | Hindi and English notice | Uses the Government of India logo |
| Legal scare | Mentions Section 271(1)(c), 276C | Real parts of the tax law |
| Time pressure | Only 72 hours to act | Made to create panic |
| Bad file | ITD.zip attachment | Seen in 2 MB, 34 MB, 35 MB sizes |
| Fake officer | “Raj Kumar Sharma, ACIT” | A made-up name |
| Sender names | “Sunil sharma”, “jankiforex” | Shown as Not a contact |
The file sizes are the biggest clue. CloudSEK says the same ITD.zip file was sent in 2 MB, 34 MB, and 35 MB versions. Changing the size often helps the file slip past antivirus checks.
About CloudSEK
CloudSEK is an India-origin cybersecurity company based in Bengaluru. It was started in 2015 by Rahul Sasi. The company makes safety tools like XVigil and BeVigil that watch for online scams, dark-web activity, and fake brand use. CloudSEK raised a $19 Mn (Rs 181 Cr) Series B1 round and now serves more than 300 business clients across banking, government, and technology.
What does the ITD.zip file do?
The ITD.zip file is not a real document. It is a trap that behaves differently on each device. On Android phones, it installs a harmful app (APK). On Windows computers, including WhatsApp Web users, it drops a file called ITD_Tax_Notice.exe.
“Tax season gives attackers the perfect opportunity to exploit trust and urgency. The Income Tax Department does not send statutory notices, penalty orders or summons over WhatsApp,” said Shobhit Mishra, Threat Intelligence Researcher, CloudSEK.
Once it is on your phone, the malware can read your SMS messages, including the one-time passwords (OTPs) your bank sends. It can also copy your contacts, record what you type, and show fake login screens on top of banking apps to steal your details. The Windows version hides as a normal system file and quietly downloads more malware, giving attackers remote control of your computer.
What other tax scams are going around?
The WhatsApp notice is just one of several tax scams running right now. CloudSEK found more scams that work in a similar way. One common trick is a refund message that says your tax refund is stuck. It then sends you to a fake copy of the tax website that asks for your PAN, password, OTP, and bank details.
| Scam Type | How It Reaches You | What They Want |
|---|---|---|
| Fake penalty notice | WhatsApp file (ITD.zip) | Install malware |
| Fake refund message | SMS or email link | Steal PAN and OTP |
| Fake tax website | Look-alike page | Grab login details |
| Fake e-PAN email | Email attachment | Spread malware or phishing |
India’s PIB Fact Check team has already marked fake e-PAN emails as false, CloudSEK says. Here is the simple difference: a real tax notice has a special Document Identification Number (DIN) that you can check on the official website. And a real notice never comes as a chat file.
What’s Next
These scams will likely grow as the September 15, 2026 last date comes closer. CloudSEK says the fake websites are made to be used and thrown away, so the web addresses keep changing fast. But the pattern stays the same: odd web names and one button that says download. Will you stop and think before tapping the next tax file in your chats?
How to stay safe this tax season
Staying safe from fake income tax notices comes down to one rule: never trust a tax notice sent on WhatsApp or SMS. Open the official tax website yourself by typing the address, and check there if any real notice exists. Never share your OTP, password, or full bank details in reply to any message. If you have already opened an ITD.zip file, turn off the internet on that device, change your passwords from a clean device, and run a full virus scan. Report bad messages on the cybercrime helpline 1930 or the official Income Tax e-Filing website.
Frequently Asked Questions
Have a tip? Write to us at editorial@startupfeed.in.
