Authenticate Income Tax Notice: Fake Email vs Real ITD Communication
A phishing-resistant authentication checklist for notices, orders, summons, letters, payment links and portal communications.
Do not decide whether a tax communication is real from its logo, urgent wording or sender display name.
India’s Income-tax Act, 2025 took effect on 1 April 2026. The 1961 Act continues to govern tax years beginning before that date. Therefore, FY 2025–26 and AY 2026–27 remain governed by the 1961 Act, while tax year 2026–27 beginning 1 April 2026 is governed by the 2025 Act. A notice, return, payment or form must be analysed under the law applicable to the relevant tax year and event—not merely the date on which the portal communication is received.
The portal provides a pre-login service to authenticate notices, orders, summons, letters and other communications.
Use the document identification details or PAN, document type, assessment year and date as required by the official service.
The department does not need a taxpayer’s banking PIN, card password, UPI PIN or remote-control access.
What the taxpayer should understand
- India’s Income-tax Act, 2025 took effect on 1 April 2026. The 1961 Act continues to govern tax years beginning before that date. Therefore, FY 2025–26 and AY 2026–27 remain governed by the 1961 Act, while tax year 2026–27 beginning 1 April 2026 is governed by the 2025 Act. A notice, return, payment or form must be analysed under the law applicable to the relevant tax year and event—not merely the date on which the portal communication is received.
- The portal provides a pre-login service to authenticate notices, orders, summons, letters and other communications.
- Use the document identification details or PAN, document type, assessment year and date as required by the official service.
- The department does not need a taxpayer’s banking PIN, card password, UPI PIN or remote-control access.
- A genuine notice may be communicated by email or SMS, but the response and payment route should be verified independently on the official portal.
The five-point review
| Check | What to examine |
|---|---|
| Domain | Actual sender address and link destination. |
| Document | DIN, notice number, date and authority. |
| Taxpayer | PAN and masked identifiers. |
| Portal | Whether the communication appears in pending actions or e-Proceedings. |
| Request | Documents, response, payment and credentials demanded. |
Practical example
A message says a refund is blocked and asks the taxpayer to update bank details through a shortened link. The correct action is to open the e-Filing portal independently, authenticate any notice and check refund or bank-validation status there.
How to apply the framework
Preserve the suspicious message and headers without forwarding it widely. If credentials were entered, secure the account and email immediately.
Even a real-looking PDF should be checked against the portal. A copied DIN or official logo can be inserted into a fraudulent document.
Tax-control workflow
Fix the period, governing Act and portal document
Identify the financial year, assessment year or tax year, the date of the underlying event and the statutory document. A communication received after 1 April 2026 may still concern a year governed by the 1961 Act. Record domain, document and taxpayer before preparing the response or return.
Reconcile the portal with primary evidence
Start from contracts, certificates, bank statements, broker or property records, foreign statements and prior filings. Then reconcile AIS, TIS, Form 26AS, the return, tax payments and notices. Portal information is a powerful control but can contain gross values, duplicates, timing differences or reporting-entity errors.
Submit through the correct route and retain proof
Use the specific service—return filing, AIS feedback, e-Proceedings, rectification, refund reissue, Form 67, appeal or grievance—rather than uploading the same explanation everywhere. Preserve the filed form or response, computation, annexures, transaction ID, acknowledgement and subsequent portal status.
Implementation checkpoint
Before closing the task, verify the live portal outcome rather than relying only on a submission message. Confirm whether the return is verified, the feedback is recorded, the tax credit changed, the refund was reissued, the notice response shows a transaction ID, the demand was adjusted or the appeal was registered. Record the next deadline and unresolved amount.
Action checklist
- Open the official portal independently.
- Use Authenticate Notice or Order.
- Check Pending Actions and e-Proceedings.
- Do not share passwords, PINs or OTPs.
- Report phishing through official channels.
- Preserve authentication result.
Evidence to keep
- Original email and headers
- Portal authentication result
- Notice PDF downloaded from portal
- Login/security alerts
- Phishing complaint acknowledgement
Warning signs
- Shortened payment link
- WhatsApp-only notice
- Refund release fee
- Remote-access software request
- Mismatch between PAN/year and portal record
Finin2min takeaway
Income-tax compliance is evidence management under the correct year and statute. The return, portal data, computation, bank trail and source documents should reconcile before a notice arrives.