The 2026 Tax Fraud Surge Is Here; Insider Plugs & The Race to Cash Out
The Chatter: What’s Being Promised on the Dark Web
Adversaries are operating with high confidence this season, driven by claims of compromised internal channels.
● The “Insider” Claim: Threat actors are claiming to have “insider plugs” within the IRS who provide real-time updates on 2026 filing protocols.
● High-Value Targets: Fraudsters are moving past small-time scams, openly marketing methods to secure refunds between $40,000 and $100,000. Some aggressive actors are even promoting schemes worth up to $400,000.
● Recruitment Drive: Organized crime ringleaders (often self-identified as “carding crew leaders”) are currently on a hiring spree, looking for mules, interceptors1 and “office spammers”2 to help them manage the volume.
A Telegram post advertising “insider” updates regarding 2026 IRS filing procedures
A forum recruitment post by a threat actor offering up to $400,000 in fraudulent filings and amendments for those with verified ID.me access.
A post claiming methods to secure fraudulent refunds between $40k and $100k, specifically targeting Go2Bank accounts.
“Premium Tax Fullz”: Advanced Identity Spoofing
Simple identity theft is no longer sufficient. To bypass modern authentication filters, fraudsters are curating “Premium Tax Fullz” that mimic a real taxpayer’s digital footprint.
An underground vendor listing for pre-filled personal and business tax forms, including Schedule C and Form 8995.
● The Data Package: A viable profile now requires a Verified ID.me login, Driver’s License images (front/back), AGI (Adjusted Gross Income) data, and prior tax forms (2022–2024).
● Business Fraud: There is a notable uptick in complex business filings, with vendors selling completed Schedule C, Form 8995, and Form 4562 documents.
● Digital Disguise:
○ Email Mirroring: Fraudsters are creating Gmail accounts that match the victim’s name to lower fraud scores.
○ Proxy Masking: Specific residential proxies (9PROXY, PIA S5, 922 PROXY) are being used to spoof local logins.
Where the Money Lands – and How It Moves
Threat actors are deliberate in selecting where fraudulent tax refunds are deposited, prioritizing institutions and services that enable rapid fund availability and low friction movement.
● Neo-Banks are a clear favorite:
○ Go2Bank and GreenDot continue to be preferred institutions due to their “get paid early” features (up to 5 days faster).
○ Small credit unions and local banks are also listed as “accepted” targets.
● Laundering The Proceeds:
○ Once funds hit the drop account, they are immediately moved via PayPal.
○ Funds are converted to Crypto (via platforms like chicks)3 .
○ Money is extracted via remittance services: Ria, WorldRemit, MoneyGram, and Sendwave.
A manual outlining the preference for neo-banks to secure expedited payouts and the workflow for off-ramping funds via crypto and remittance services.
Recommendations for Mitigation Strategies
● Flag Early Filers: Criminals are advising that “the earlier, the safer,” so expect a surge in suspicious Treasury deposits immediately as the IRS acceptance window opens.
● Scrutinize New Accounts and Mobile Banking: Require additional review for recently opened accounts that receive IRS deposits soon after funding. Additionally, pay special attention to new accounts linked to Go2Bank routing numbers.
● Detect the “Passthrough”: Implement rules for accounts receiving federal deposits that immediately initiate transfers to crypto exchanges, PayPal or remittance platforms.
● The IP PIN Barrier: Be aware that the IRS “IP PIN” remains a significant hurdle for fraudsters; expect attempts to socially engineer these PINs from customers. We recommend advising customers to register for these PINs to reduce the risk of falling victim to tax fraud.
1 Their primary role is to monitor “drop” addresses to capture physical IRS correspondence, such as identity verification letters, IP PIN mailers, or hard-copy refund checks.
2 Cybercriminals who specialize in Business Email Compromise (BEC) and mass-phishing targeting corporate environments rather than individuals.
3 www.chicksx.com, low-fee exchange for crypto and fiat.
4 A 6-digit number issued to eligible taxpayers to prevent fraudulent use of their Social Security number on tax returns. Known only to the taxpayer and the IRS, it is required for any electronic filing to be accepted, effectively blocking stolen identity refund fraud (SIRF) even when criminals have the full SSN.