Smishing and IRS Scams: The Summer 2025 Wave Hitting American Inboxes

The scam arriving by text message this summer looks nothing like sextortion — and that’s exactly why it matters to our readers. Reports of IRS impersonation text messages are up roughly 40% in 2025, part of a smishing (SMS phishing) wave that harvests exactly the personal data — names, phones, employers, financial details — that later fuels targeted extortion. The two crime families are converging on the same supply chain.

The Scale and the Pattern

The IRS has stated it plainly and repeatedly: it does not initiate contact by text message demanding payment or personal information. Every “your tax refund is pending verification” text is a fraud — every one. The lures rotate with the season: refund claims during filing season, “unpaid toll” notices in summer, parcel-delivery fees around holidays. The mechanics never change: urgency, a link, a credential-harvesting page.

How SMS Spoofing Works — for Detection Purposes

Understanding the trick defuses it. The SMS system allows the sender of a message to declare its own originating identifier, and carriers historically trusted that declaration. The result, conceptually: a scammer can make a text display as coming from a legitimate short code, a real agency label, or even a number that matches your area code. The “from” field on a text is a costume, not an address.

Caller ID on SMS is a self-reported name badge. That’s the entire foundation of every impersonation text you’ve ever received — and the reason “but it said IRS right there” means nothing.

Anatomy of the Lure

• Authority. “IRS,” “DMV,” “Toll Authority,” “USPS” — institutional names that trigger compliance reflexes.
• Urgency. “Final notice,” “48 hours to respond,” “action required immediately” — engineered to bypass deliberation.
• Small stakes. A $6.99 delivery fee or a $47 toll feels too trivial to be a scam — which is the point. The fee isn’t the theft; the card details you enter are.
• Lookalike links. Domains one character off from legitimate ones, or shorteners hiding the destination.

What Gets Stolen — and What It Feeds

Here is the sextortion connection. Smishing pages harvest names, birthdates, addresses, phone numbers, employer details, and card data. That corpus is exactly what organized crews use to build credible targeted extortion: a victim who receives a threat containing their real employer name and city believes the perpetrator “has files” on them. Often, the perpetrator has nothing but a smishing database. When we run footprint analyses for clients — part of the methodology in our service tiers — we routinely trace the “impossibly personal” details in threats back to breached or phished data rather than genuine compromise.

How to Identify and Report

• Never tap links in unexpected texts — regardless of the institution named. If you think the message might be real, contact the institution through its official website or phone number independently.
• Verify the sender independently. The OSINT habit that defeats smishing is the same one that defeats fake Instagram profiles, covered in our July analysis: trust verification, never assertion.
• Report it. IRS impersonation texts can be reported to the IRS phishing channel (see irs.gov for current instructions), and all fraud to reportfraud.ftc.gov and IC3.gov.
• If you already entered card details: call your bank’s fraud line now, freeze the card, and monitor statements. Speed limits the damage.

The Unified Defensive Posture

Smishing, sextortion, and the hybrid schemes we covered in May’s pig-butchering analysis share a single vulnerability: they all depend on the victim reacting instead of verifying. The sequence that defeats all of them is identical — pause, verify through an independent channel, document, report. If a “too personal to be fake” message has you worried, the FAQ addresses how to assess real versus manufactured leverage, and confidential help is available via our intake around the clock.