Here Are the IRS 'Dirty Dozen' Tax Scams for 2026

The IRS has released its annual "Dirty Dozen" list of tax scams for 2026, with AI-powered phishing and deepfake impersonation topping the threats for the first time. The list reflects a fundamental shift in scam sophistication: artificial intelligence now enables fraudsters to produce communications indistinguishable from genuine IRS correspondence, create convincing voice clones of revenue agents, and personalize attacks using data harvested from multiple breach databases.

For tax professionals, the 2026 Dirty Dozen serves dual purposes: a client communication tool (share proactively to build trust) and a practice risk checklist (ensure your firm isn't inadvertently facilitating listed schemes through lax due diligence).

The 2026 Dirty Dozen

1. AI-generated phishing (NEW #1 threat). Scammers use large language models to generate IRS-branded emails, letters, and text messages that perfectly replicate official tone, formatting, and terminology. Unlike previous phishing (obvious grammatical errors, generic addressing), AI phishing is personalized with the taxpayer's name, filing status, and partial SSN — data assembled from dark web breach databases.

The escalation: deepfake audio calls from "IRS agents" using cloned voices. Victims receive calls that sound exactly like a government official, reference specific account details, and demand immediate payment or information. Voice authentication (which some financial institutions use) is no longer reliable as a verification method.

2. Employee Retention Credit mills (continuing). Despite the IRS moratorium on new ERC claims, fraudulent promoters continue soliciting businesses with promises of "risk-free" ERC refunds of $50,000-$500,000. The IRS has identified $85 billion in potentially fraudulent ERC claims and is actively auditing — meaning businesses that filed fraudulent claims face repayment plus penalties.

The 2026 twist: some mills now offer to "defend" previous claims they helped file, charging $10,000-$50,000 in "audit defense" fees for claims that were fraudulent from inception.

3. Crypto tax avoidance schemes. Promoters sell strategies to avoid reporting crypto gains: offshore exchange usage, DeFi "wash trading" through multiple wallets, and false claims that certain tokens are "not taxable." With 1099-DA reporting beginning in 2027, taxpayers following these schemes face severe consequences when their unreported transactions surface.

4. Fake charity organizations. AI-generated websites and social media profiles create convincing but fraudulent charitable organizations, particularly following natural disasters. Donors claim deductions for contributions that never reach legitimate charitable purposes.

5. Social media tax "hacks." TikTok, Instagram, and YouTube influencers promote aggressive tax positions as "tips" — including fake business deductions, improper home office claims, and manufactured losses. Young taxpayers following this advice face audits and penalties they can't afford.

6. Identity theft for refund fraud. Stolen SSNs used to file early returns claiming fraudulent refunds. The IRS intercepted $7.2 billion in identity theft refund fraud in 2025 — but an estimated $1.8 billion still reached criminals.

7. Abusive micro-captive insurance arrangements. Small business owners create captive insurance companies to shift income into lower-taxed vehicles. The IRS has listed these as "transactions of interest" and is pursuing participants with accuracy penalties (20-40% of the understatement).

8. Syndicated conservation easements. Inflated land valuations used to generate deductions 4-5x the actual investment. The IRS has disallowed $22 billion in claimed deductions and is assessing penalties on participants and promoters.

9. Offer-in-compromise mills. Companies charge $5,000-$15,000 to negotiate IRS settlements for clients who don't actually qualify. Legitimate OIC acceptance rates: ~30% of applications. These mills file knowing clients won't qualify, collecting fees for doomed efforts.

10. Ghost preparer fraud. Unlicensed preparers who don't sign returns, claim inflated deductions/credits, and disappear when the IRS audits. Taxpayers are liable for returns filed in their name regardless of who prepared them.

11. Payroll tax schemes. Business owners divert withheld employment taxes for personal use, failing to remit to the IRS. The trust fund recovery penalty makes responsible persons personally liable — piercing the corporate veil.

12. Spearphishing of tax professionals. Targeted attacks on accounting firms to steal client data, e-file credentials, and practitioner PINs. Compromised practitioner accounts enable mass fraudulent filing under the practitioner's legitimate credentials.

What's Different in 2026

AI amplification across all categories. Every traditional scam becomes more effective with AI. Phishing is more convincing. Fake charities look more legitimate. Social media "advice" is produced at scale. The volume and quality of scam content has increased 4x since AI tools became widely available in 2023.

Practitioner targeting intensification. The IRS specifically warns that tax professionals face escalating sophisticated attacks. A compromised CPA firm (client data, e-file access, PTIN) enables far more fraud than compromising individual taxpayers.

Crypto-specific enforcement pipeline. The IRS has dedicated 600 agents to cryptocurrency compliance for the 2026 filing season. John Doe summonses to exchanges, blockchain analytics contracts, and 1099-DA preparation requirements signal that crypto non-compliance is moving from "maybe we'll catch them" to systematic enforcement.

Why This Matters

For tax practitioners: Share the Dirty Dozen with every client (email, social media, newsletter) within one week of release. This serves three purposes: client protection (awareness is the primary defense), trust building (you're looking out for them), and liability reduction (if a client falls for a scam, you documented your warning).

For firm IT security: Implement: mandatory 2FA on all tax software and IRS accounts, email authentication (DMARC/DKIM/SPF), endpoint detection on all devices, and annual security awareness training. The #12 threat (practitioner spearphishing) is existential for any firm whose credentials are compromised.

For clients with ERC claims: If your firm helped clients file ERC claims, audit those claims now against the IRS's updated eligibility guidance. Voluntary correction (Form 941-X) before IRS audit carries no penalty — post-audit assessment includes 20% accuracy penalty plus interest.

For crypto clients: The enforcement pipeline is operational. Clients with unreported crypto transactions must file amended returns or report going-forward before 1099-DA implementation makes non-compliance automatically detectable.

For firm marketing: The Dirty Dozen release is the single best annual content opportunity for tax practices. Write a client-facing summary, host a brief webinar, and post on social media — positioning your firm as the trusted source while everyone else ignores it.

The key takeaway: The 2026 Dirty Dozen's AI-first threat landscape means that perfect-looking IRS communications can no longer be trusted at face value — tax professionals must implement verification protocols for every unexpected IRS contact and proactively educate clients that the sophistication of tax scams has permanently escalated beyond human detection without procedural safeguards.