Stimulus Check Scams: A 2026 Safety Guide

By Josh C.

A message lands while you're making coffee: “IRS Notice: Your $1,200 stimulus payment is pending verification. Confirm your direct deposit within 24 hours.” The link looks official, the wording sounds familiar, and you remember receiving pandemic relief years ago. That combination is exactly what makes stimulus check scams effective.

The scam isn't really about one payment. It's about getting you to surrender information, approve a transaction, install malware, or stay on the phone long enough for the criminal to escalate. In 2026, the safest assumption is simple: an unsolicited message promising a stimulus check, tax credit, or relief payment is a scam until you verify it through an official website you type yourself.

What Stimulus Check Scams Actually Look Like Today

The retiree in Phoenix doesn't need to be careless for this attack to work. She only needs to recognize the words “stimulus payment,” feel pressure from the deadline, and assume the sender knows something about her tax situation. The fake website then asks for a Social Security number, bank details, a login, or a small “processing” payment.

The IRS warned in April 2020 that criminals were already using “stimulus check” and “stimulus payment” language, even though the official term was economic impact payment. The agency said scammers might use phone calls, email, text messages, social media, or bogus checks by mail to request personal or banking information or charge a fee. Reuters reported nearly $100 million in coronavirus-fraud losses by August 2020, while FTC data cited in that reporting recorded more than 150,000 COVID-related fraud cases nationally through July.

By March 10, 2021, the FTC had logged more than 382,000 complaints involving COVID-19 and stimulus payments, with losses exceeding $366 million. Two-thirds involved fraud or identity theft, and the median reported loss was $325, according to the IRS announcement about its 2021 Dirty Dozen tax scams. The IRS included stimulus check scams because criminals were still exploiting relief programs long after the first wave of payments.

Why the bait still works

Fake payment claims survive because people remember real government relief. IRS notices still arrive by mail, states can issue separate relief payments, and tax credits create legitimate-sounding confusion. Recent warnings also cover fake “tax credits,” “relief payments,” and fabricated offers such as $1,390 or $2,000 claims. The IRS explains how to tell legitimate outreach from a scammer.

Scammers often focus on adults 60 and older, recent retirees, gig workers expecting refunds, and anyone discussing money online. The number that matters isn't just the lost payment. Your data can support identity theft, fraudulent tax filings, diverted benefits, or later account-takeover attempts.

The next section breaks down the three delivery routes criminals use most often, phone, text, and email.

Common Scam Tactics by Phone, Text, and Email

The channel changes, but the pressure pattern stays recognizable. The criminal presents authority, creates a deadline, and asks you to perform a financial or identity action before you can verify the claim.

Text messages create instant urgency

A message may claim to come from “US Treasury” and say your relief payment is waiting. A shortened bit.ly link leads to a page that asks you to confirm your address and direct-deposit information before the payment is “returned.”

The diagnostic red flag is unsolicited payment re-verification. The psychological lever is urgency. A short deadline is designed to stop you from opening a new browser window and checking the claim through IRS.gov.

For more practical guidance on suspicious messages, use this text message security guide.

Email copies the look of official paperwork

An email can use an IRS logo, formal letterhead, and even your real ZIP code, possibly obtained from a data broker or an unrelated leak. The attachment might be a PDF that sends you to a fake portal or installs a credential harvester.

The key warning sign is a sender domain that doesn't match the claimed agency, especially when the message asks you to re-enter information. The manipulation relies on familiarity. Official-looking graphics make recipients trust the document before checking the address or destination.

Phone calls turn trust into permission

A caller may claim to be an IRS representative and ask you to read back a code sent to your phone for “identity confirmation.” That code may authorize a login, password reset, or account transfer.

The single most important red flag is any request for an MFA or verification code. The psychological lever is authority combined with a human voice. A confident caller can make the victim feel that refusing to cooperate will delay payment or trigger a penalty.

The U.S. Treasury's COVID-19 scam guidance is clear that legitimate agencies don't require advance fees, gift cards, or unsolicited messages to process a payment. Treat contact about a stimulus payment as something you verify independently. You initiate the check, using a written notice or an official website you access directly yourself.

What to Do in the First 60 Seconds After Spotting One

Panic makes people click. A rehearsed response prevents that. You don't need to determine the scammer's entire plan before protecting yourself.

1. Freeze the interaction. Don't click, reply, or call back. Take a screenshot first. On an iPhone, press the side button and volume-up button together. On Android, press the power and volume-down buttons together. Screenshotting preserves the sender, wording, link, and timestamp.

2. Report the channel. Forward a suspicious text to 7726, which spells SPAM, then delete it. For email, forward it as an attachment to reportphishing@irs.gov and phishing@reportfraud.ftc.gov. Use the subject line Suspected stimulus payment phishing. In the body, write: I received a message impersonating a government agency and requesting stimulus-payment information. Date and time: __. Sender address or number: __. Link or attachment: __.

3. End suspicious calls. Hang up without arguing. On iPhone, open Phone, tap Recents, tap the information icon beside the number, and choose Block this Caller. On Android, open Phone, tap Recents, select the number, and choose Block or Report spam. Report the incident at ReportFraud.ftc.gov.

4. Contain any exposure. If you opened a link or entered credentials, disconnect from Wi-Fi, run a full antivirus scan, and change passwords, starting with email and banking. Change passwords from a clean device if possible. If you shared an MFA code, contact the affected provider immediately and ask it to revoke active sessions and reset security settings.

5. Protect your credit. Place a 30-day fraud alert with one credit bureau. That bureau should notify the other two. Keep your screenshot and report confirmation numbers together.

Practical rule: Speed matters more than a perfect explanation. Report quickly, contact the bank quickly, and preserve evidence before deleting anything.

Reporting Stimulus Scams to the IRS, FTC, and Your Bank

Report in a fixed order so the incident doesn't disappear between agencies.

Start with the IRS

Use irs.gov/identity-theft for an IRS impersonation or tax-identity concern. Explain that someone used a stimulus, economic impact payment, or tax-credit claim to request information. Attach the screenshot, sender details, email headers if available, the fake domain, and any transaction or reference number. Legitimate IRS contact begins through the mail, not with an inbound demand for immediate payment.

Create an FTC record

File at ReportFraud.ftc.gov. If personal information was exposed, use IdentityTheft.gov for a recovery plan. Include the same evidence, plus the exact information disclosed and whether the criminal requested a transfer, gift card, debit-card payment, or account login.

Call the bank before writing a long report

Use the number on the back of your card or inside the bank's official app. Say: I responded to an impersonation scam. Please place a fraud note on my account, review recent activity, secure my online access, and attempt a recall or reversal for any unauthorized transaction. Give the bank transaction IDs, recipient details, timestamps, screenshots, and police-report number if one exists. For a wire, request a recall immediately. Don't wait for an agency response.

Then contact the credit bureaus through their official fraud channels, request a fraud alert or freeze where appropriate, and monitor every account connected to the exposed identity.

Keep one incident summary

Write this once and reuse it:

• Date and time of contact
• Channel used
• Sender number, address, and claimed agency
• Exact promise made
• Link, attachment, or callback number
• Information disclosed
• Transactions, amounts, and transaction IDs
• Bank contacted and case number
• IRS and FTC report numbers
• Credit-bureau action
• Police-report number
• Passwords and accounts secured

For a broader reporting checklist, use this guide to reporting a scammer. Agencies may not resolve the matter immediately, but a complete record gives each investigator something actionable instead of a vague account of what happened.

How a Real Stimulus Scam Unfolds After You Respond

Consider Linda, a 68-year-old retiree who receives a text saying her $1,400 stimulus payment needs verification. She taps the link and enters information into a page that looks like an IRS portal. The first theft is not always money. It may be the credential set that lets the criminal enter email, banking, or tax accounts.

The criminal then uses the information to drain $500 from a debit card. Soon afterward, another caller claims to be from Linda's bank's fraud department. The caller says the debit-card activity proves an account takeover and instructs Linda to move $4,200 by wire to a “safe” account.

That second caller isn't repairing the first attack. The caller is using the first attack as proof of credibility.

The escalation has a sequence

• Credential capture: Linda enters information into a simulated IRS portal. The criminal gains data for later access.
• Debit-card drain: The criminal takes $500, then waits for Linda to become anxious.
• Bank impersonation: A follow-up caller uses the recent transaction to sound legitimate.
• Wire instruction: Linda sends $4,200 to the supposed secure account.
• Synthetic identity attempt: The criminal uses her information to seek a loan in her name seven days later.

Linda reports the wire quickly, and the bank starts a recall within the 72-hour window. That action recovers $2,800. She places a credit freeze, which blocks the attempted synthetic-identity loan, and files a police report. The report helps the bank evaluate reimbursement for the unauthorized activity.

This is a representative pattern, not a promise that every victim will recover funds. Recovery depends on the payment method, speed, evidence, bank procedures, and whether the money remains reachable.

A stimulus scam rarely ends when the first link opens. One response gives the criminal a reason to try a second channel.

The lesson is operational: secure email first, call the bank using a trusted number, preserve evidence, request payment recalls, and freeze credit. Don't assume the first loss is the whole incident.

Scripts Caregivers Can Use With Older Relatives

Caregivers get better information when they remove blame. Start with a text that invites cooperation:

Hi [Name], I'm checking in. Have you seen any messages about a new stimulus check or tax credit? These are often scams. Please send me a screenshot before you reply, click, or call anyone.

On the phone, establish a standing rule:

Hey, I heard about a new stimulus scam. The IRS won't text you asking for payment information. Can we look at suspicious messages together?

Then make the arrangement specific:

If anyone contacts you about money, taxes, benefits, or a payment, you can call me before responding. You won't be in trouble, and we’ll check it together.

When a suspected scammer is on the line

Don't shout or accuse the person holding the phone. Say:

Please put the caller on speaker. I’m helping with this account.

Then address the caller:

We don't provide codes or banking information on an inbound call. Please send any legitimate notice by mail. We’ll contact the agency through its published number.

If the caller insists, ask:

What is your full name, agency identification number, and the mailing date of the notice you sent?

Don't call the number the caller gives you. End the call and verify independently.

After an incident, protect disclosure

Avoid asking, Did you give them anything? Shame makes people hide details. Ask instead:

Let's list everything the caller or website requested, even if you aren't sure you shared it.

Follow with:

Which accounts did you use afterward, and did anyone ask you to move money or read a code?

For a weekly check-in, use:

Have you received any new messages about checks, refunds, tax credits, or account verification?

Did anyone ask you to click, pay, move money, or share a code?

Save these scripts with the senior fraud prevention guidance, and make the family rule routine rather than something introduced only after a loss.

Building a Layered Defense That Stops Scams Before They Reach You

“Just don't click the link” is incomplete advice. It assumes the victim has already identified the threat, but stimulus scams arrive through calls, texts, emails, social media, and fake documents. A stronger defense places several independent checks between the criminal and the account.

Layer one screens the phone network

Turn on your carrier's spam-call protection and your phone's built-in spam filter. On iPhone, review Settings, Apps, Phone, then enable call screening or silencing options available on the device. On Android, open Phone, choose Settings, then enable caller ID and spam protection. Add suspicious numbers to the phone's block list, but don't rely on blocking alone because criminals can rotate numbers.

Layer two analyzes the message and conversation

An AI service such as Gini Help can screen calls, texts, and email, identify suspicious patterns, answer unknown calls before they reach you, and provide live call analysis when you do answer. Download it through Google Play or the App Store. Set it up for the family member most likely to answer an unexpected call, then review its alerts together.

Layer three makes verification automatic

Create one strict rule: a link claiming to deliver a payment never gets opened from the message. Type IRS.gov yourself or use a saved official bookmark. Email filters should flag suspicious senders and attachments, but the human rule remains essential because a convincing message can pass a filter.

Layer four watches the money

Enable transaction alerts for every bank account and card. Choose notifications for purchases, transfers, new payees, password changes, and login activity. Caregivers should help older relatives confirm that alerts reach a device they check.

For small businesses, the same discipline applies to payroll, vendor payments, and tax accounts. Professional Insurance Advisors, LLC offers identity fraud help for small businesses that can help owners think through business-specific exposure.

The setup goal: Spend one weekend creating overlapping barriers, not trying to find one perfect blocker.

Suppose a fake Treasury text bypasses the carrier filter. The message scanner flags the payment language, the recipient follows the typed-website rule instead of the link, and a bank alert exposes any attempted transfer. Each layer catches a different failure. That is why layered screening beats a single instruction or a single app.

Gini Help screens calls, texts, and emails for scam patterns, including the impersonation and payment-verification tactics used in stimulus check scams. Visit Gini Help to set up protection for yourself or a relative, then pair it with official-account alerts and a family rule to verify every unexpected payment claim.