How Your Startup Can Avoid the 2026 IRS Dirty Dozen Scams

This article is for informational purposes only and does not constitute financial, tax, or legal advice. Consult a qualified professional for guidance specific to your situation.

Reviewed for financial accuracy by the Startup Finance Guide editorial team. Our editors cross-reference all claims against platform documentation, pricing pages, and primary regulatory sources. Last reviewed: October 12, 2026.

A startup avoids the 2026 IRS Dirty Dozen scams by doing four things: setting up its own IRS Business Tax Account, checking every "IRS" contact against that account before anyone pays or replies, keeping payroll tax deposits on the free official payment rails, and refusing any tax credit or debt-relief pitch it did not go looking for. The 2026 list (IR-2026-30) came out on March 5, 2026. Seven of its twelve entries can plausibly reach a company: email and text impersonation (No. 1), AI-assisted phone impersonation (No. 2), online account takeover (No. 5), the bogus "Self-Employment Tax Credit" (No. 7), ghost preparers (No. 8), spear-phishing (No. 11) and Offer in Compromise mills (No. 12).

One correction first: Employee Retention Credit schemes are not on the 2026 list. The IRS still warns about them elsewhere, and we cover that below, but the twelve entries for this year do not include ERC.

The money involved is not small. The IRS says it reported more than 600 social media impersonators in fiscal year 2025. The FTC counted about $920 million in reported losses to government impersonators in 2025, up from $789 million a year earlier, inside $3.5 billion lost to imposter scams of every kind. TIGTA, the Treasury watchdog that investigates IRS impersonation, has logged 16,281 victims and more than $114 million in losses between March 2013 and March 2025.

The tools that help are mostly free and run by the government: the IRS Business Tax Account, EFTPS and Direct Pay. Three paid categories close specific gaps. A payroll provider such as Gusto handles deposits and filings, a password manager such as 1Password ($24.95 a month for a ten-person team) protects the logins, and a CPA-backed filing service such as Inkle (federal returns from $650 a year) gives you a named preparer. None of the paid products detects IRS scams.

Key takeaways

• The 2026 Dirty Dozen was published on March 5, 2026 as IR-2026-30. Its one new entry is abusive Form 2439 capital gains claims at No. 6, which replaced fuel tax credit claims.
• ERC schemes are off the 2026 list but not gone. The IRS ERC page still carries a scam warning and showed about 13,000 claims unresolved as of the week ending October 3, 2026.
• The IRS says it normally makes first contact by U.S. mail, emails and texts only people who opted in, and never sends social media direct messages.
• Your Business Tax Account is the tie-breaker. If a balance, notice or payment is real, it shows up there.
• Outsourcing payroll does not outsource liability. The IRS holds the employer responsible for deposits even when a provider defaults.
• Report email, text and social media fakes to phishing@irs.gov, and phone impersonators to TIGTA at 800-366-4484.

The 2026 Dirty Dozen, sorted by how much a startup should care

The IRS writes the list for everyone: individual filers, donors, tax professionals and businesses. The exposure ratings below are our own reading of each entry, not an IRS classification. The scam descriptions come straight from the release.

No.	Scam on the 2026 list	Startup exposure	First defense
1	IRS impersonation by email, DM and text, often with QR codes	High	Verify in your own IRS account, never through the link
2	AI-enabled phone impersonation (robocalls, voice mimicry, spoofed caller ID)	High	Hang up, check the account, report to TIGTA
3	Fake charities	Low for the company	Check tax-exempt status before donating
4	Misleading tax advice on social media	Medium (founders' personal returns)	Confirm on IRS.gov or with a credentialed preparer
5	Identity theft involving IRS Online Account access	High	Create the account yourself on IRS.gov
6	Abusive Form 2439 undistributed capital gains claims (new for 2026)	Low	Do not claim a credit you cannot document
7	Bogus "Self-Employment Tax Credit" promotions	Medium (solo founders, contractors)	Treat as a red flag; the IRS is reviewing these claims closely
8	Ghost preparers	High	Require a signature and a PTIN
9	Non-cash charitable contribution schemes	Low	Avoid inflated appraisals
10	Overstated withholding schemes	Low for the company	File only wage and withholding figures that match your records
11	Spear-phishing and malware aimed at tax professionals and businesses	High	Confirm "document request" emails by phone
12	Offer in Compromise mills	Medium (if you owe back taxes)	Use the free IRS pre-qualifier first

Five entries are rated high because they need nothing from you except a moment of inattention. The mediums depend on circumstances, such as being a solo founder or owing back payroll taxes.

Step 1: Open the Business Tax Account yourself

No. 5 on the list exists because the IRS account is the most valuable thing a tax scammer can take over. The release says criminals "may pose as helpers to collect sensitive information during account setup" and tells taxpayers to create accounts directly through IRS.gov. So do it yourself, before anyone offers.

The Business Tax Account shows your balance by year, payment history, transcripts, and the notices and letters the IRS has actually sent. For a C corporation or S corporation, the person who registers as Designated Official has to meet all three of these conditions: an officer or managing member, a current employee who received a W-2 for the most recent filing year, and authorized to legally bind the company. The W-2 condition catches early founders who have never paid themselves a salary. If nobody qualifies yet, we found no workaround on the IRS page, and you will be verifying notices by mail and phone until someone does.

LLC founders should check their filing type. A multi-member LLC that files Form 1065 can register through a general partner or managing partner. A single-member LLC that reports on Schedule C cannot use the Business Tax Account at all yet, according to the IRS.

Once you are in:

1. Register a second Designated Official if another officer qualifies. The IRS explicitly allows more than one so access survives a departure.
2. Add your bookkeeper or controller as a Designated User through Profile, then Manage Access, then Add User. You choose the forms, tax periods and permissions. They cannot manage access themselves.
3. Put the revalidation dates in a calendar. Designated Officials revalidate once a year in a six-week window that starts June 15 (October 15 for partnerships). Designated Users have to be revalidated every January and June.
4. Remove people when they leave.

Founders should also get an Identity Protection PIN for their personal returns. It is a six-digit number, valid for one calendar year, and it works only on the Form 1040 family. It does nothing for the company's EIN. The IRS states it will never ask for your IP PIN, and that calls, emails or texts requesting it are scams.

Step 2: Make one verification rule and apply it to everyone

Dirty Dozen entries 1 and 2 are the same trick on different channels: someone who sounds official creates a deadline. The defense is a rule simple enough to follow at 5 p.m. on a Friday: nobody pays, replies, clicks or scans until the claim has been checked in the company's own IRS account.

The IRS publishes exactly how it contacts taxpayers, and the list is short enough to memorize.

• Mail comes first. The IRS says it normally contacts you the first time by U.S. Postal Service mail.
• Email and text arrive only if you opted in. Account emails come from an address ending in irs.gov.
• A social media direct message is never from the IRS.
• Phone calls do happen. The IRS or a private collection agency may call about an account matter. What the IRS says it never does is call to demand payment now, threaten arrest, or tell you about a refund.

Employers should know the one legitimate call pattern. If a business falls behind on employment tax deposits, a Revenue Officer may call before mailing a balance due notice, and will mail Letter 5857 with a scheduled call time. Confirm by calling the number printed on the letter, not one a caller gives you.

For paper, search the notice or letter number (the CP or LTR code sits in the right corner) and then look for the same notice in your Business Tax Account. "Mail first" only protects you if someone reads the mail. Our guide to keeping a home address off public filings covers the registered agent and mailbox options.

Caller ID proves nothing. The 2026 release names voice mimicry and spoofed caller ID specifically. It also contains a line that is easy to miss: taxpayers "should not rely on AI-generated responses to complex tax questions" and should verify anything an AI tool calculates. That applies to the chatbot inside your accounting software too.

Step 3: Keep payroll taxes on the official rails

Federal tax deposits must be made by electronic funds transfer. The IRS lists three free ways to do it: your Business Tax Account, Direct Pay for businesses, and EFTPS. A bank-initiated ACH credit, a same-day wire, or a payroll service making the payment for you are also allowed, and may carry a fee.

Anything outside that list is the scam. TIGTA's wording is that the IRS will not request payment by gift card, prepaid debit card, money order or wire transfer. In the rare in-person case, the IRS says a check or money order given to a Revenue Officer is made payable to "United States Treasury", never to an individual.

Most startups with employees hand deposits to a payroll provider, which moves the work but not the liability. The IRS position on outsourced payroll is blunt: "In the event of default by a third party, the employer remains responsible for the deposit of the federal tax liabilities and timely filing of returns." So check the payment history in your Business Tax Account each quarter against what the provider says it paid. If the numbers do not match and the provider cannot explain why, Form 14157 is the complaint route.

Two smaller controls belong here:

• The W-2 email. The IRS describes a long-running scam in which a spoofed message from a company executive asks payroll or HR for a list of all employees and their Forms W-2. Never send W-2 files or Social Security numbers in reply to an email. Confirm by phone, on a number you already had.
• Bank detail changes. Any change to where tax money or payroll goes should need a second person. This is our recommendation, not an IRS rule.

Know your deposit schedule too (monthly or semi-weekly, set before each calendar year under Publication 15). Panic over a forgotten deadline is what makes a fake "final notice" work, for entity returns as much as payroll, which is why we covered how the S corporation late filing penalty accrues separately.

Step 4: Vet anyone who offers you a credit, a refund or a settlement

Three of the twelve entries (7, 8 and 12) involve somebody selling tax help. A fourth problem, ERC promotion, has left the list but not the market.

Ghost preparers. The IRS definition is narrow: a preparer who prepares a return but refuses to sign it, refuses to include a Preparer Tax Identification Number, or both. The agency's separate scam recognition page adds three more signs: falsifying information, putting your refund in their bank account, and demanding cash without a receipt. Anyone with a PTIN can legally be a paid preparer, so a PTIN alone tells you little about skill. The IRS points taxpayers to its Directory of Federal Tax Return Preparers to check credentials such as CPA or enrolled agent status. Never sign a blank or incomplete return, because you are legally responsible for what gets filed.

Credit promoters. The release says scammers use misleading claims about a broad "self-employment tax credit" to generate improper refunds, that many taxpayers do not qualify, and that people filing these claims "do so at their own risk." More generally, the IRS warns that dishonest preparers "charge large, upfront fees or a fee based on your refund amount."

Percentage-of-credit pricing is also common among legitimate R&D credit firms, so a contingent fee is a reason to ask harder questions, not proof of fraud. Ask who signs the return, what documentation backs the claim, and what happens to the fee if the IRS disallows the credit. Our piece on why R&D credit claims get rejected goes through the documentation side.

ERC. Not on the 2026 list, still live. The IRS ERC page reported approximately 13,000 claims remaining as of the week ending October 3, 2026, 3,000 of them under audit. The credit covered wages paid between March 13, 2020 and the end of 2021. The page still warns that "anyone who incorrectly claims the credit has to pay it back and may owe penalties and interest." A company formed after 2021 has no ERC to claim.

Offer in Compromise mills. If the company or a founder owes back taxes, firms will promise to settle for a fraction. The IRS runs the program directly, with a free pre-qualifier tool and a $205 application fee. Employers are eligible only if they made required federal tax deposits for the current and last two quarters, which a mill rarely checks before taking a fee.

A fifth pitch that is not on the IRS list. Startups still receive letters demanding a fee to file a beneficial ownership report. FinCEN's current guidance says U.S. companies are exempt from BOI reporting under a final rule issued August 11, 2026 and effective August 14, 2026. It also says there is no fee to file directly with FinCEN, and that correspondence referencing a "Form 4022," a "Form 5102" or a "US Business Regulations Dept." is fraudulent. FinCEN's imposter scam page adds that the bureau does not contact the public to request payment.

Step 5: Report it, then write it down

Report every attempt, even when nothing was lost, and keep an internal log of date, channel and request. The IRS reporting page sets a different route for each channel.

How it reached you	Where to report	Detail the IRS asks for
Email	phishing@irs.gov	Subject "IRS" or "Treasury"; send as an attachment so headers survive
Text message	phishing@irs.gov, subject "Text"	Sender number, your number, date, time and time zone; also forward to 7726
Social media account	phishing@irs.gov, subject "Social media"	Full URL of the account; report to the platform too
Phone call	TIGTA hotline or 800-366-4484	Record the number, then hang up
W-2 request email, nothing sent	phishing@irs.gov, subject "W-2 scam"	The email itself
W-2 request email, data sent	dataloss@irs.gov, subject "W-2 data loss", plus phishing@irs.gov	Business name, EIN, contact, how it happened, employees affected. Do not attach employee data
Website charging for an EIN	FTC, and dispute the charge with your card issuer	An EIN is free from the IRS

If money or data has already gone, the IRS recovery steps are to stop talking to the scammer, call your bank, and follow IdentityTheft.gov. For an unresolved IRS notice the line is 800-908-4490, 7 a.m. to 7 p.m. Eastern.

Business identity theft has its own form. The IRS says to file Form 14039-B if an e-filed return is rejected because one is already on file for the period, or if you receive a notice about a return or Forms W-2 you did not file, a balance you do not owe, or a business you never applied for an EIN for. The related business identity theft page lists a quieter warning sign: routine IRS correspondence stops arriving because someone changed the business address.

Tools that support each step

This is not a ranking. Two of these are free government systems every company with an EIN should use. The other three are examples of paid categories, and other vendors would do the job.

Tool	What it is	Published price	Step it supports	What it does not do
IRS Business Tax Account	The IRS's own account for businesses	Free	1, 2, 3	Not yet open to Schedule C single-member LLCs
EFTPS and Direct Pay	Treasury and IRS payment systems	Free	3	No alerts about scams or missed deposits
1Password	Team password manager	$24.95/month for 10 users (Teams Starter Pack) or $8.99 per user/month (Business), billed yearly	1	Cannot stop someone reading a code aloud to a caller
Gusto	Payroll provider	Reported as $49/month plus $6 per person; we could not load the page directly	3	Does not shift legal responsibility for deposits
Inkle	Bookkeeping, tax filing and compliance service	Form 1120 from $650/year; bookkeeping from $49/month	4	No payroll, no fraud detection, no IRS account monitoring

IRS Business Tax Account

Step 2 depends on this account, because it is where a balance, payment or notice can be checked at the source. It is free and role-based. The weaknesses: the Designated Official test excludes founders with no W-2, Schedule C single-member LLCs are locked out, and IRS customer service staff cannot see inside your account, so help with access problems is limited.

EFTPS and Direct Pay

EFTPS is the Treasury's free payment service, and sign-in has required multifactor authentication through Login.gov or ID.me since October 19, 2023. You have to enroll before you can pay, so set it up well before a deposit is due. Direct Pay for businesses needs no sign-in and gives a confirmation number, but it accepts no more than five payments in 24 hours and caps a payment at $10 million. Neither system will tell you a deposit is late. They are payment rails with no reminder function.

1Password

The IRS's own advice to businesses includes unique passwords, a password manager and multifactor authentication wherever it is offered. 1Password is one option. Its business pricing page lists the Teams Starter Pack at $24.95 a month billed annually for ten members, and Business at $8.99 per user per month billed annually, with role-based vault sharing and permissions. It can also store and fill one-time codes for sites that use two-factor authentication.

What to consider:

• Keeping passwords and one-time codes in the same vault is convenient and concentrates risk. Consider keeping codes for IRS and bank logins on a separate device.
• A password manager does nothing against a phone scam.

Gusto

Gusto is a payroll provider for small companies, the category that answers "who makes sure the 941 deposits happen." Its site returned an access error to our requests, so the figures here are provisional: search results for its pricing page show the Simple plan at $49 a month plus $6 per person, with tax filings and payments included. Confirm both on the page.

What to consider:

• The employer stays liable if a provider misses a deposit. That is IRS policy for every payroll service provider, not a Gusto-specific flaw.
• We did not review Gusto's security controls.

Inkle

Inkle is not a security product, and its site does not claim to detect fraud or monitor IRS accounts. It is a bookkeeping, tax filing and compliance service for U.S. companies, including foreign-owned ones. It fits Step 4: the simplest defense against ghost preparers and unsolicited credit pitches is already having a preparer you chose.

Its own pages state that federal and state taxes are "filed by licensed CPAs" and that Inkle Tax includes entity-based deadline alerts, a compliance dashboard, a document vault, on-demand CPA access and an "AI Tax Consultant" chatbot. The company counts 2,000+ customers and 12,000+ filings, and its security page says it is SOC 2 Type 2 compliant. On pricing, Form 1120 starts at $650 a year, Delaware franchise tax filing is $100 a year, Form 5472 is $100 per qualifying foreign shareholder, bookkeeping starts at $49 a month, and a Delaware registered agent is $60 a year.

What to consider:

• No payroll. Inkle books payroll entries and tracks payroll registrations, so Step 3 still needs a payroll provider or your own EFTPS discipline.
• Its R&D credit service is priced at 15% of the annual credit refunded. That is the percentage-of-credit structure Step 4 says to question, whoever charges it. Ask Inkle the same three questions.
• The AI Tax Consultant is a chatbot. The IRS warning about verifying AI answers to complex tax questions applies to it.
• "From $650" is a floor. A foreign-owned C corporation with a 5472, FBAR and state returns will pay several add-ons.
• The pages we read say returns are filed by licensed CPAs without naming them. Ask who will sign yours before you engage.

Other services do the same job. Our comparison of AI bookkeeping platforms with CPA oversight covers the alternatives.

How we evaluated

We started from the IRS release itself and built the article around the twelve entries as published, because summaries in circulation disagree on what the 2026 list contains (ERC being the usual error). Every IRS, TIGTA, FTC and FinCEN statement above was read on the agency's own page on October 12, 2026. Vendor facts came from each vendor's product, pricing or security pages the same day, with the Gusto exception noted. A tool was included if it maps to a specific step and its core claim could be checked.

Limitations

• We did not test any product. Feature descriptions are the vendors' own.
• Gusto's site blocked our requests. Its price and tax-filing description come from search-result summaries of its pricing page.
• We could not load 1Password's phishing-protection support page, so that feature is not assessed.
• The FTC and TIGTA figures count reported losses from all victims, mostly individuals. We found no primary figure for losses by startups or small businesses and have not invented one.
• The ERC claim count updates monthly and will have moved by the time you read this.

Frequently asked questions

Is the Employee Retention Credit on the 2026 Dirty Dozen list?

No. The twelve entries in IR-2026-30 do not include ERC. The IRS still runs a scam warning on its ERC page and had roughly 13,000 claims unresolved in early October 2026, so promoters remain a risk for companies that existed in 2020 or 2021.

What changed on the Dirty Dozen list for 2026?

The IRS highlighted one change: abusive undistributed long-term capital gains claims on Form 2439 were added at No. 6, replacing the earlier fuel tax credit entry.

Does the IRS ever call a business?

Yes, which is why "the IRS never calls" is bad advice. It may call about an account matter, and a Revenue Officer may call an employer that has fallen behind on employment tax deposits, with Letter 5857 confirming the call time. The IRS says it does not call to demand immediate payment, threaten arrest or announce a refund.

Can an IP PIN protect my company's EIN?

No. The IP PIN is used only on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS. For the business, the protections are the Business Tax Account, keeping your responsible party details current with Form 8822-B, and filing Form 14039-B if someone uses your EIN.

Do U.S. startups still need to file a beneficial ownership report with FinCEN?

Not according to FinCEN's current guidance, which says U.S. companies are exempt under a final rule effective August 14, 2026. Only certain foreign companies registered to do business in the U.S. report. A letter demanding a filing fee is a scam either way, because FinCEN charges no fee.

What should we do first if someone already paid a fake IRS demand?

Stop contact with the scammer and call the bank straight away, while there may still be a chance to stop the transfer. Then follow IdentityTheft.gov, report the contact through the channel table above, and check your Business Tax Account to see what, if anything, the IRS actually says you owe.

Conclusion

The list changes every March, and the contact rules barely change at all: mail first, opt-in email and text, no direct messages, no gift cards. A startup that owns its Business Tax Account, pays through EFTPS or a provider it audits quarterly, and has a signing preparer on file leaves an impersonator little to work with.

We are less sure how well any of this holds against a cloned voice calling a tired payroll admin. Write the rule down and require a second approver for payment changes.

---

This article reflects publicly available information as of October 2026 and does not endorse any specific platform. IRS scam tactics, reporting channels and the Dirty Dozen list change, so confirm current guidance on IRS.gov before acting on any tax notice or payment request. Consult a licensed professional for guidance specific to your business.