The FTC and IRS are both warning about a wave of fake "tax refund" messages hitting phones and inboxes right now.

Here's how it works: You get a text or email that looks like it's from the IRS or your state tax office. It says your refund has been "approved" or "processed." All you need to do is click a link to verify your identity and get your money.

But if you click, you're handing over your Social Security number, bank account info, and everything else a scammer needs to steal your refund or your identity.

The real IRS will never text you. They won't email you. They won't reach out through social media. They communicate by mail, and they don't ask you to click links to verify your identity.

The red flags:

Any message claiming to be from the IRS that arrives by text, email, or social media. Urgent language like "verify within 24 hours." Links asking for your Social Security number or bank details. Messages about a refund you weren't expecting.

What to do:

Don't click the link. If you want to check on a real refund, go directly to IRS.gov/refunds. Type that address yourself. Never use a link from a message.

Forward suspicious texts to 7726 (SPAM). Report scam emails to ReportFraud.ftc.gov. Then delete the message.

This is one of the cruelest scams out there. And fraud experts say it's going to be huge in 2026.

Here's how it works: You've already been scammed once. Maybe you lost money to a romance scam, a crypto scheme, or a fake investment platform. You're hurting. You want your money back.

Then someone contacts you. They say they're from a law firm, a government agency, or a consumer protection group. They've heard about your case. They can help you recover your money. They just need a small fee to get started.

It sounds like hope. But it's another scam.

The people reaching out are often the same criminals who scammed you in the first place. Or they bought your information from the people who did. Scammers keep lists of victims. They know how much you lost, what story worked on you, and how desperate you might be to get your money back.

The rule: If someone contacts you out of the blue offering to recover money you lost to fraud, that's a scam. Real recovery help doesn't work that way.

If you've been scammed, report it to the FTC at ReportFraud.ftc.gov. That's free. You don't need to pay anyone a fee.

You've probably seen these ads on Facebook or Instagram. A clothing boutique or home goods shop is closing after 15 years. Everything is 80% off. Final 24 hours. This is your last chance.

The photos look professional. The countdown timer is ticking. The prices are incredible.

But the store doesn't exist.

These are scam websites designed to take your money and disappear. Some ship cheap knockoffs. Most ship nothing at all. And they're popping up faster than platforms can take them down. Security researchers say more than 1,000 new fake shopping sites appear every single day.

How to spot them:

Prices that seem too good to be true. Emotional "farewell" messages about closing forever. Countdown timers creating urgency. A domain name you've never heard of. No phone number or physical address anywhere on the site.

Before you buy from an unfamiliar store:

Search the store name plus "scam" or "reviews." Check when the website was created. If it's only a few months old and claims to have been in business for years, that's a red flag. Pay with a credit card so you can dispute the charge if nothing arrives.

This one has been making the rounds over the past few weeks.

You get an email that looks like it's from Microsoft. The subject line says something like "Important Mail" or "Security Alert." The message warns that your account will be suspended or deleted if you don't take action immediately.

There's a link to "verify your account." But if you click it, you land on a fake login page that steals your email and password.

The giveaways:

The email opens with "Dear User" instead of your name. The deadline is impossibly tight, like 24 hours. The sender address is something like "[email protected]" instead of an actual Microsoft domain. There's an image attachment, which real Microsoft security alerts never include.

The rule: Microsoft won't email you from an AOL address. And they won't threaten to delete your account over email. If you're worried, go directly to account.microsoft.com and log in there. Never use a link from an email.