How can you recognize ELSTER Phishing — Fake Tax Refund from the Tax Office?

TLDR

Email imitates ELSTER or the Federal Central Tax Office (Bundeszentralamt fuer Steuern) and announces a tax refund of 437 1,290 euros. The link leads to elster rueckerstattung.com (genuine: elster.de). Entry of tax ID, IBAN, online banking...

How it works

Red flags

Urgent pressure to click, pay, or share codes immediately.
A link or sender that does not match the official organization.
Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What to do

1Indicators: 1) ELSTER never sends emails with clickable links; 2) domain is not elster.de; 3) IBAN AND e banking login are requested simultaneously; 4) certificate file for download.
2IN CASE OF FRAUD: Report tax ID misuse to the tax office, warn bank immediately, file complaint with the LKA (State Office of Criminal Investigation).

Source

BSI

Source reviewed by Mythos Forensic Team

https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Spam-Phishing-Co/spam_phishing_node.html

FAQ

Is ELSTER Phishing — Fake Tax Refund from the Tax Office a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.

What should I do first?

Indicators: 1) ELSTER never sends emails with clickable links; 2) domain is not elster.de; 3) IBAN AND e banking login are requested simultaneously; 4) certificate file for download.; IN CASE OF FRAUD: Report tax ID misuse to the tax office, warn bank immediately, file complaint with the LKA (State Office of Criminal Investigation).

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.