The Fake IRS Notice That Disproved Itself

A message titled "Your Tax Document(s) Is Now Available" landed at a commercial construction contractor and looked, at a glance, like the most checkable kind of mail a company can receive. It had a navy header bar. It had a rule line reading "INTERNAL REVENUE SERVICE | U.S. DEPARTMENT OF THE TREASURY". It had an agency logo, a formal three-row detail table with a document type and a reference number and a response deadline, and a real public IRS phone line printed in the footer. Every one of those elements exists for the same reason: to invite verification and survive it.

It did not survive it. The notice contradicted itself in two strings, one paragraph apart, and the contradiction was readable from the body bytes with no tax expertise, no header analysis and no visit to the link.

Two Tax Periods in One Message

The prose opened with a claim: "A tax document has been issued to your account for the 2026 filing year."

The formal detail table, immediately below, described the document differently. Its first row read, verbatim, "CP2000 Notice - Tax Year 2026". The second row gave a reference number, "IRS-2026-88142". The third, rendered in red, demanded a response "Within 5 Business Days".

Those first two descriptions are not the same tax period. A filing year is the year a return is filed, and it reports the year before it. So the prose describes a notice about one tax year while the table underneath it names another. A single authority document cannot be about both, and no template that had ever passed a review would ship with the discrepancy on the page.

A Notice That Cannot Precede Its Own Return

The stronger problem is not the disagreement. It is that the tax year the table names has no filed return behind it.

A CP2000 is the IRS notice of proposed changes. It is produced only after a taxpayer's filed return is matched against third-party information returns, the W-2s and 1099s that employers and institutions submit independently, and it exists to explain the difference between them. That ordering is the whole mechanism. The notice reconciles a filing, so it cannot precede the filing it reconciles.

The return for the tax year printed in that table has not been filed yet and will not be for months. There is no filed document for the agency to match, no third-party data to compare it against, and therefore no proposed change to propose. The lure's own metadata block ruled the lure out.

This is the useful shape of the case. Most pretexts are graded on the infrastructure carrying them. This one was falsifiable from its own contents, and the element that made it falsifiable was the element added to make it convincing. The formal table was the operator's mistake precisely because it was specific, and specificity is checkable.

See Your Risk: Calculate how many threats your SEG is missing

The Brand Lived Only Where Nothing Looks

The agency appeared in exactly two structural places, both of them free-text fields no protocol validates.

The From display name was set to the literal string "IRS.GOV", sitting on an unrelated long-established sending domain. This is phishing by display-name deception, MITRE ATT&CK T1566.002 paired with impersonation, T1684.001. As a flat record fact, the platform's own impersonation field read false on this message.

The visible To header was the second place. It was not the recipient's address at all. It was a fabricated no-reply mailbox whose local-part carried the agency's own domain string, hosted at the sending host's own domain, so the brand got a second appearance in a slot a reader might skim. The actual recipient was carried only in the envelope and the delivery header, which is BCC-style delivery: the one human the message was aimed at never appeared in the addressing a human would read.

Authentication was clean and irrelevant. The message left through a Japanese hosting provider's webmail as an authenticated submission, and SPF passed for the sending domain, which was registered in 2006 and is no lookalike of a government domain. No DKIM signature was applied, and no DMARC result appears anywhere in the header set. The alignment is real, and it says nothing whatsoever about the agency named in the body. The sending domain and its provider are bystanders here.

What Was Left to Grade

Strip the pretext away and the message offered automated scoring almost nothing. No attachment. No QR code. No lookalike domain. No remote images, because the agency logo was an inline base64 data URI rather than a hosted asset, which also means there was no tracking pixel. One link, styled as a navy "Download Your Document" button, pointing at a single attacker-registered .es domain, and that domain sat behind a shared CDN proxy and answered the scanner with a 403 while no redirect chain was observed. What the destination actually served was never seen and should not be assumed.

That left the language, the structure of the body, and what other organisations had already decided about messages shaped like this one. Our Adaptive AI, Themis, convicted at 90% confidence on the malicious link verdict, on language and structure analysis, and on community resolutions of similar incidents across tenants. The single affected mailbox was quarantined roughly seven seconds after receipt.

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of initial access vectors, with 62% of breaches involving the human element and pretexting accounting for 6% of initial access; it also notes that AI-assisted text in malicious emails doubled year over year, which is why fluent, well-formatted authority mail is now the baseline rather than the exception. Volume of that kind is why manufacturing and construction inboxes see so much of it.

Three Checks That Would Have Ended This

First, the policy check. The IRS does not initiate contact by email and does not send notices as download links, so an emailed tax notice is a policy violation before it is a technical question, and interaction with its link is T1204.001. The CISA phishing guidance and the NIST definition of phishing both frame the pretext, not the payload, as the thing to teach.

Second, read the detail table as evidence. Identifiers and dates in a formal block are claims, and claims can be tested against each other and against the calendar. Two of them here disagreed, and the document one of them named could not exist.

Third, do not read an authentication pass on a long-established sending domain as a statement about the brand in the body. Those are two unrelated facts, and this message depended on a reader collapsing them into one.

Indicators of Compromise

MITRE ATT&CK Mapping

Authority formatting is an argument, not an authentication. When a message dresses itself in a government notice, take the dressing at its word and check it. This one told you it was impossible if you read two of its own lines in order.