The month of August has arrived, and individuals who have filed their Income Tax Returns (ITR) are eagerly awaiting their refunds. However, cyber fraudsters are aggressively capitalizing on this anticipation.
Millions of taxpayers across the country are currently receiving deceptive SMS or WhatsApp messages stating: "Dear Taxpayer, your ITR refund of Rs. 15,400 has been approved. Please update your bank account details by clicking on this link."
In this blog by The Legal Way India, we will decode the modus operandi of the ITR Refund Scam, how to distinguish between genuine and fake communications, and the immediate legal remedies available to you if you become a victim of this cyber fraud.
1. Modus Operandi: How Do Scammers Execute the ITR Refund Fraud?
The execution of this scam is straightforward yet highly dangerous:
Phishing SMS: You receive a message claiming the approval of a substantial refund amount (e.g., ₹15,000 to ₹25,000).
Deceptive Links: The message contains a hyperlink. Clicking on it redirects you to a fraudulent website meticulously designed to mimic the official Income Tax Department portal.
Data Theft: On this fake portal, you are prompted to enter sensitive financial information such as your bank account details, PAN card number, Aadhaar number, and eventually, an OTP.
Malicious Apps (.apk files): Alternatively, clicking the link may automatically download a rogue application (.apk file) onto your device. This malware grants hackers remote access to your SMS and OTPs, allowing them to drain your bank account within seconds!
2. How to Differentiate Between Genuine and Fake Income Tax Messages?
As a vigilant citizen, you must always remember the following points:
The Department Never Asks for OTPs: The official Income Tax Department will never ask for your PIN, passwords, or OTPs via SMS, WhatsApp, or email.
Verify Sender ID and Email: Authentic SMS notifications come from official Sender IDs like 'JD-INCOMETAX' or 'AD-ITDEPT'. Scammers generally use standard 10-digit mobile numbers. Furthermore, legitimate emails from the department will always end with the @incometax.gov.in domain. Fraudsters often use deceptive domains like @incometax-refund.com or standard Gmail accounts.
Inspect the URL: Official government websites always end with the .gov.in extension (e.g., incometax.gov.in). Any link containing .apk, .xyz, .bitly, or other suspicious extensions is 100% fraudulent.
Automated Crediting: Legitimate tax refunds are automatically credited to the bank account you pre-validated while filing your ITR. No additional forms or verifications are required via external links.
3. Immediate Legal Steps to Take if You Accidentally Click the Link
If you have inadvertently clicked the link or shared your details out of panic, do not waste time. Take these 4 steps immediately:
Disconnect the Internet: Immediately turn off your mobile data and Wi-Fi to sever the hacker's remote access to your device.
Preserve Evidence (Take Screenshots): Before disconnecting or deleting any messages, take screenshots of the fraudulent SMS, email, or WhatsApp number. This serves as crucial electronic evidence when filing a complaint with the Cyber Cell (1930) and the bank.
Notify Your Bank: Contact your bank's customer care immediately to freeze or block your account and halt any further unauthorized transactions.
Report to 1930: Dial the Government of India's National Cyber Crime Helpline number '1930' immediately to register your complaint. You can also file an e-FIR online via the official portal at cybercrime.gov.in.
4. RBI’s 'Zero Liability Policy': Your Strongest Legal Right
A common misconception is that money lost to cyber fraud cannot be recovered. However, you must be aware of the Reserve Bank of India's (RBI) guidelines protecting consumers.
As per the RBI Circular (Zero Liability of a Customer):
If an unauthorized transaction occurs in your account, and you notify the bank within 3 days (72 hours) of the fraud, the entire liability rests with the bank, not the customer! In such scenarios, the defrauded amount can be fully refunded to your account.
Crucial Legal Requirement: Merely calling customer care is legally insufficient. To successfully invoke the 'Zero Liability Policy', you must submit a written complaint. You are required to visit your home branch and fill out a 'Dispute Form' or send an official email to the bank's Nodal Officer documenting the fraud. Therefore, do not panic if fraud occurs—take immediate legal action.
Stay Vigilant, Stay Safe!
If you found this legal information helpful, please share this blog with your family and friends to protect them from financial cyber frauds.
For more simplified legal awareness and accurate updates on Indian laws and cybercrimes, subscribe to our YouTube Channel:
Disclaimer: This blog is intended solely for legal awareness and educational purposes. It does not constitute legal advice or a solicitation of work. Always consult a qualified Advocate personally for advice pertaining to your specific legal issues.
No comments:
Post a Comment