{"success":true,"data":{"id":"irs-direct-file-2026-amendment-lure","label":"Fake IRS Direct File 1040-X amendment / refund-recalculation lure — \"Your IRS Direct File 1040-X amended return refund has been recalculated; verify banking and routing details within 7 days\" targeting taxpayers who used the IRS Direct File pilot (expanded to 25 states for TY2025). Real IRS refund deposits never request banking re-verification via emailed link; refunds either go to the bank account on file or are mailed as a paper check. Spoofs `directfile.irs.gov` lookalike. Source: GC1 R7 multiagent council top-5 (S1 fin specialist).","description":"Fake IRS Direct File 1040-X amendment / refund-recalculation lure targeting US taxpayers who used the IRS Direct File pilot (expanded to 25 states for TY2025, with broader rollout planned for TY2026). The phish narrative arrives as: \"Your IRS Direct File 1040-X amended return refund has been recalculated — verify banking and routing details within 7 days to receive your refund,\" or \"Form 1040-X amended return processed — confirm banking account or refund will be returned to Treasury.\" Direct File adoption climbed sharply through TY2024-TY2025 (over a million returns filed in the pilot states), creating a large + recently-engaged target population. The April-May 2026 amendment / extension window is when real 1040-X activity peaks, giving attackers a high-volume pretext window. Real IRS refund deposits never request banking re-verification via emailed link; refunds either go to the bank account on file from the original return, or are mailed as a paper check to the address of record. The Treasury-Direct/EFTPS phishing kits often spoof `directfile-irs-amend.io`, `treasury-directfile.co`, and similar lookalike subdomains. Compromised tax filers face SSN exposure plus directly-stolen refund deposits redirected to attacker bank accounts (real-world losses $3K-$15K per victim, depending on filing complexity). Fires when body references IRS Direct File / Form 1040-X / amended return / refund recalculation AND contains an IRS / Treasury / EFTPS authority reference AND contains verify-banking / verify-routing / verify-account or generic action-required urgency. Excludes irs.gov, treasury.gov, eftps.gov, directfile.irs.gov, and the broader .gov umbrella. Auto-classified as danger via the `-lure` suffix. Source: GC1 R7 multi-agent council top-5 (S1 fin specialist).","tier":"danger","category":"other","isThin":false}}