---
title: "Hey Wait! IRS Phishing Scam Emails Aren’t Supposed to Happen Until Tax Season | DuoCircle"
description: "People are getting wise to IRS phishing scams which happen during tax season. So, what do hackers do?"
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/"
---

Quick Answer

Akamai's threat research team identified an out-of-season IRS phishing campaign targeting over 100,000 individuals, using at least 289 different domains and 832 URLs over 47 days, with most domains active for fewer than 20 days. Tax-season phishing typically runs from late Q4 through January in the U.S., but attackers are now running these campaigns year-round by leveraging political stress and tax-rule uncertainty. Defense: real-time link-click protection that evaluates the destination of every URL, regardless of when the message arrived. The technology only cares about message content and link targets, not whether the timing matches a known seasonal pattern.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fhey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Hey%20Wait!%20IRS%20Phishing%20Scam%20Emails%20Aren%E2%80%99t%20Supposed%20to%20Happen%20Until%20Tax%20Season&url=undefined%2Fblog%2Fphishing-protection%2Fhey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fhey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fhey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season%2F&title=Hey%20Wait!%20IRS%20Phishing%20Scam%20Emails%20Aren%E2%80%99t%20Supposed%20to%20Happen%20Until%20Tax%20Season "Share on Reddit") [ ](mailto:?subject=Hey%20Wait!%20IRS%20Phishing%20Scam%20Emails%20Aren%E2%80%99t%20Supposed%20to%20Happen%20Until%20Tax%20Season&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fhey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season%2F "Share via Email") 

![Phishing Scam Emails](https://media.mailhop.org/duocircle/images/2019/11/sender-policy-framework-7934.jpg) 

_People are getting wise to IRS phishing scams which happen during tax season_. So, what do hackers do? Send out the same **phishing emails** out of season to catch unsuspecting victims off guard.

According to an article on [ARS Technica](https://arstechnica.com/information-technology/2019/11/researchers-see-spike-in-out-of-season-irs-impersonating-phishing-attacks/), “Tax return scammers usually strike early in the year, when they can turn the personal information of victims into fraudulent tax refund claims. But members of Akamai’s threat research team found a recent surge in off-season **phishing attacks** masquerading as notices from the Internal Revenue Service, **targeting over 100,000 individuals**.”

[![Research](https://media.mailhop.org/duocircle/images/2019/11/spf-record-tester-1973.jpg)](https://media.mailhop.org/duocircle/images/2019/11/spf-record-tester-1973.jpg)

According to Akamai’s [research](https://blogs.akamai.com/sitr/2019/11/out-of-season-irs-phishing-campaigns.html), “_the campaign used at least 289 different domains and 832 URLs over 47 days._” Furthermore, a majority of those domains were active for less than 20 days.

Continuing from Akamai, “the IRS phishing campaign in the wild shows that, while threat actors are still launching campaigns with the goal of capturing sensitive information, the methods and techniques being used are getting more sophisticated by the day. Normally, tax-based **phishing campaigns** are observed during tax season in the United States, which runs from the end of Q4 until the end of January. However, by leveraging political stress points and uncertainty surrounding changing tax rules, campaigns such as this are now viable year-round.”

> _Hackers are getting more sophisticated and “seasonal” phishing campaigns now happen all year round._

## What to do?

[![Phishing Protection](https://media.mailhop.org/duocircle/images/2019/11/spf-validator-1935.jpg)](https://media.mailhop.org/duocircle/images/2019/11/spf-validator-1935.jpg)

_You need protection that works all year round and doesn’t get caught off guard by out-of-season phishing emails_. You need [Phishing Protection](/email/phishing-protection) from DuoCircle.

**Phishing Protection** from DuoCircle, with **real-time link click protection**, doesn’t fall for out-of-season phishing emails because it doesn’t care when they arrive. _It only cares about what’s in the body of the email and where the links in the email point to_. And if those links point to a malicious website, it prevents users from going there, no matter when the email arrived.

_Phishing Protection from DuoCircle works with all mail providers, sets up in 10 minutes and costs just pennies a month per employee._

You can try and stay vigilant and defend yourself against the constant barrage of **phishing emails**, or you can sleep easy at night knowing you’re protected by [DuoCircle](/). _Try it risk free for 30 days._

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Hey Wait! IRS Phishing Scam Emails Aren’t Supposed to Happen Until Tax Season","description":"People are getting wise to IRS phishing scams which happen during tax season. So, what do hackers do?","url":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/","datePublished":"2019-11-29T19:00:13.000Z","dateModified":"2025-04-16T14:05:15.000Z","dateCreated":"2019-11-29T19:00:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/"},"articleSection":"phishing-protection","keywords":"","wordCount":366,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/11/sender-policy-framework-7934.jpg","caption":"Phishing Scam Emails","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Hey Wait! IRS Phishing Scam Emails Aren’t Supposed to Happen Until Tax Season","item":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Hey Wait! IRS Phishing Scam Emails Aren’t Supposed to Happen Until Tax Season","item":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Hey Wait! IRS Phishing Scam Emails Aren’t Supposed to Happen Until Tax Season","description":"People are getting wise to IRS phishing scams which happen during tax season. So, what do hackers do?","url":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/","datePublished":"2019-11-29T19:00:13.000Z","dateModified":"2025-04-16T14:05:15.000Z","dateCreated":"2019-11-29T19:00:13.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/hey-wait-irs-phishing-scam-emails-arent-supposed-to-happen-until-tax-season/"},"articleSection":"phishing-protection","keywords":"","wordCount":366,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/11/sender-policy-framework-7934.jpg","caption":"Phishing Scam Emails","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```