Fake and Virus Email - "Payment Confirmation for Tax Refund Request # 75991792"

Cyber-criminals are sending out different versions of the email message below with the subject: "Payment confirmation for tax refund request # 75991792." The email messages have a link within them that goes to a malicious Microsoft Word document that will attempt to download viruses, Trojan horses or other malware onto the victims' computers, if they attempt to open them.

Fake and Virus Email - Payment Confirmation for Tax Refund Request # 75991792

The Fake and Virus Email Message

Subject: Payment confirmation for tax refund request # 75991792
Attachment: confimation_75991792.doc

You are receiving this notification because your tax refund request has been processed.

Please find attached a copy of the approved 1040A form you have submitted, containing your personal information and signature.

On the last page, you can also find the wire transfer confirmation from the bank.

Transaction type : Tax Refund
Payment method : Wire transfer
Amount : $7592
Status : Processed
Form : 1040A

Additional information regarding tax refunds can be found on our website:


Please note that IRS will never ask you to disclose personal or payment information in an email.


Internal Revenue Service
Address: 1111 Constitution Avenue, NW
Washington, DC 20224
Website: http://www.irs.gov
Phone: 1-800-829-1040

The link in the message will dowload the following malicious Microsoft Word document onto the victims' computers if they click on it:

  • confimation_75991792.doc

The malicious attached Microsoft Word document has a set of instructions called a Macro that will attempt to dowload viruses, Trojan horses and other malware.

The cybercriminals behind the malicious email message aim is to trick the curious recipients into opening the malicious attachment, which will infect their computers with a virus or Trojan horse.

Once their computers have become infected with a Trojan horse or some other malware, the cybercriminals behind this email message will be able to access and take control of their computers remotely from anywhere around the world. They may spy on them, use their computesr to commit cyber-crimes, or steal their personal and financial information.

Now, if you have already opened clicked on the link, downloaded and open the malicious file, please do a full scan of your computer with the antivirus software installed on it.

If you don’t have antivirus software installed on your computer, please click here for a list of free antivirus software.

Click here for a list of email attachments you should never open, regardless of where they came from.

For a list of other virus email messages, please click here.

Check the comment section below for additional information, share what you know, or ask a question about this article by leaving a comment below. And, to quickly find answers to your questions, use our search Search engine.

Note: Some of the information in samples on this website may have been impersonated or spoofed.
Was this article helpful?  +
Share this with others:

Comments, Questions, Answers, or Reviews

There are no comments as yet, please leave one below or revisit.

To protect your privacy, please remove sensitive information from your comments, questions, or reviews. We will use your IP address to display your approximate location to other users when you make a post. That location is not enough to find you.

Your post will be set as anonymous because you are not signed in. An anonymous post cannot be edited or deleted, therefore, review it carefully before posting. Sign-in.

Write Your Comment, Question, Answer, or Review

Fake and Virus Email - "Payment Confirmation for Tax Refund Request # 75991792"