Skip to main content

Phishing: कॉर्पोरेट टैक्स नियमों का पालन न करने के संबंध में 2026 का नोटिस | Fake Income Tax Department Court Notice

· 30 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

Court Notice. Case Number: 54973713. Investigating Authority: Income Tax Department, Government of India. Monday, 7 September 2026, 10:30 AM. The Brazilian judicial-notice template we took apart in August, now translated into Hindi with its Portuguese removed and sent from a randomly generated domain instead of a free Outlook mailbox.

Complete Email​

from: आयकर विभाग 66rqtjwa@notice-tax-cod0g1rs.rxsi9tm65.com
date: 09/02/2026 5:09 PM
subject: कॉर्पोरेट टैक्स नियमों का पालन न करने के संबंध में 2026 का नोटिस

Email Body​

════════════════════════════════════

न्यायालय सूचना

════════════════════════════════════

मामला संख्या: 54973713

मामला विषय: कर / वित्तीय विवाद

जांच प्राधिकरण: आयकर विभाग, भारत सरकार

सोमवार, 7 सितंबर, 2026

समय: 10:30 AM

स्थान: नई दिल्ली न्यायालय परिसर, भारत संबंधित दस्तावेज़:

https://8y2tw.laikehuyu.com/index-2026-tax.html

कृपया इस जानकारी को वित्त विभाग के साथ आंतरिक रूप से साझा करें उनके संदर्भ के लिए।

The External Email line at the foot of the screenshot is the mail gateway's tag, not part of the message. The recipient address has been blurred.

English Translation​

The subject line and the entire body are in Hindi. Translated in full, the message reads:

Subject: 2026 notice regarding non-compliance with corporate tax rules

Court Notice

Case Number: 54973713

Case Subject: Tax / Financial Dispute

Investigating Authority: Income Tax Department, Government of India

Monday, 7 September, 2026

Time: 10:30 AM

Location: New Delhi Court Complex, India Related Documents:

https://8y2tw.laikehuyu.com/index-2026-tax.html

Please share this information internally with the Finance Department for their reference.

Attacking email screenshot

Red Flags​

This is government-impersonation phishing, and the template is one this archive has already taken apart. On 10 August 2026 a Judicial Notice reached the same organisation: nine lines of procedural furniture in English — a process number, a case matter, an investigating authority, a hearing date, a time, a venue, a document link, and a request to share it with finance — with three Portuguese words still stuck in it, because the template had been written for Brazil and localised by find-and-replace.

This message is that notice again, three weeks later, in its third language. Put the two side by side and the correspondence is line for line:

10 August 2026 (English)2 September 2026 (Hindi)
Judicial Noticeन्यायालय सूचना
Process Number: 52291157मामला संख्या: 54973713
Case Matter: Tax Dispute / Financeiraमामला विषय: कर / वित्तीय विवाद
Investigating Authority: Renda Tax Department, Government of Indiaजांच प्राधिकरण: आयकर विभाग, भारत सरकार
Hearing date: August 25, 2026सोमवार, 7 सितंबर, 2026
Time: 10:30 AMसमय: 10:30 AM
Location: Nova Délhi Judicial Complex, Indiaस्थान: नई दिल्ली न्यायालय परिसर, भारत
Related Document: taxation01jf.com/download/tax-documents1संबंधित दस्तावेज़: 8y2tw.laikehuyu.com/index-2026-tax.html
Please share this information internally with the finance department for reference purposes.कृपया इस जानकारी को वित्त विभाग के साथ आंतरिक रूप से साझा करें उनके संदर्भ के लिए।

Same box rules, same eight-digit number, same "Tax / Financial Dispute", same 10:30 AM, same venue, same closing instruction. What changed is everything cosmetic — and, more interestingly, the infrastructure underneath. The free Outlook mailbox is gone, replaced by a domain the attacker owns. The link has moved to a Chinese-named host of the same kind the August penalty notice used. This is the second time in a week that we have watched this operator publish a revised draft — the penalty-notice template got the same treatment on 7 September — and the pattern is identical: the flaws that looked wrong were fixed, and the flaws that are wrong were not, because they cannot be.

Eight of them survive, and every one is checkable.

1. It Is the August "Judicial Notice", Translated — and the Portuguese Is Gone​

The three fingerprints that gave the August version away were Renda (Portuguese for income, left in the department's name), Financeira (Portuguese for financial, in the case matter), and Nova Délhi (the Portuguese spelling of New Delhi, accent included). All three are resolved here. Renda Tax Department has become आयकर विभाग, the correct Hindi name of the Income Tax Department. Financeira has become वित्तीय. Nova Délhi is now नई दिल्ली. The words a reader could look up and find to be foreign have been replaced by words that are not.

Nothing else moved. The eight-digit number went from 52291157 to 54973713 — same length, same leading digit, same absence of any prefix, year, court code, or check digit. Indian courts do not number cases that way. Every case filed in the country is assigned a sixteen-character CNR (Case Number Record) through the e-Courts system, encoding the state, district, court establishment, serial number, and year, and anyone holding one can look it up at ecourts.gov.in. A bare integer belongs to no Indian register. Neither does "Tax / Financial Dispute" as the description of a case: a real cause has a title — the party bringing it versus the party answering it — and this notice still cannot name either.

What the translation demonstrates is worth stating plainly, because it is the theme of the whole message. The attacker fixed the notice's vocabulary and could not fix its anatomy. A Portuguese word is a cosmetic fault, and a translator removes it. An eight-digit case number, a nameless court, and a summons from a body that cannot issue one are structural faults, and they survive every draft — which is why the checks that matter are the ones that test structure.

2. The Sender Is a Random String, at a Random Subdomain, of a Random Domain​

  • from: आयकर विभाग 66rqtjwa@notice-tax-cod0g1rs.rxsi9tm65.com

Read the address in three parts, from the right.

rxsi9tm65.com is the registered domain: nine characters of letters and digits that spell nothing in any language. notice-tax-cod0g1rs is a subdomain beneath it: two English words followed by eight more random characters. 66rqtjwa is the mailbox: eight random characters again. Of the whole address, the only part a human being chose is notice-tax — placed where a glance at the sender line will catch the words notice and tax beside a display name reading Income Tax Department, and stop reading. Everything on either side of those two words is filler produced by software, which is what a bulk-mailing tool generates when it needs a fresh, never-before-seen sender identity for each wave. The display name, आयकर विभाग, is free text typed by whoever set the campaign up, and verified by no one.

The August version came from damonapah@outlook.com. This is a deliberate upgrade. A free consumer mailbox authenticates as outlook.com and can be closed by Microsoft's abuse desk within hours. A domain the attacker owns passes SPF and DKIM for itself — the attacker writes those records — and no provider can suspend it. The price of that is a public history, and this domain's is instructive:

  • Registered on 17 October 2025 through Gname, a Singapore registrar, and then left idle for ten months. Domains bought in bulk and aged before use are a known technique: mail gateways treat a domain registered last week as suspect and one registered last year as ordinary.
  • Updated on 23 August 2026 — ten days before this message was sent — when it was pointed at a private nameserver, ns1.lj-lj.com, itself registered through the same registrar and updated the day before. That is the infrastructure being switched on for the campaign.
  • Set to expire on 17 October 2026. One year's registration, of which the domain will have been used for a few weeks.
  • Already dismantled. Eleven days after the send, the domain's zone still exists but the notice-tax-cod0g1rs subdomain has no records at all. The address this message came from cannot receive a reply, because it no longer resolves to anything.

Compare that with where the Income Tax Department actually writes from: incometax.gov.in, under the gov.in registry that only verified Indian government bodies can use. Delhi's courts live on gov.in and nic.in too — the district courts through the e-Courts system at ecourts.gov.in, the High Court at delhihighcourt.nic.in. No court and no department in India has ever sent anything from a nine-character .com bought in Singapore.

3. A Court Notice From a Tax Department — Two Institutions That Do Not Share a Letterhead​

  • Sender: आयकर विभाग — Income Tax Department
  • Heading: न्यायालय सूचना — Court Notice
  • जांच प्राधिकरण: आयकर विभाग, भारत सरकार — Investigating Authority: Income Tax Department, Government of India

Ask who is writing to you. The sender says the Income Tax Department. The heading says a court. The "investigating authority" line says the Income Tax Department again. In the space of five lines the department is the sender of a notice, the court that convenes a hearing, and the investigator who brought the matter before that court — three roles, and Indian law gives it exactly one of them.

Courts issue summons; departments issue notices; the two are never the same document. When an income-tax matter reaches a court at all — a prosecution complaint under Chapter XXII of the Act, filed before a Magistrate after sanction, or an appeal to the High Court under Section 260A — the department is a party, standing before the court like anyone else. The summons comes from the court: under the court's seal, signed by its officer, naming the case title, the court, the judge, and the date, and served through the court's own process — a process server, registered post, or the e-Courts system from a gov.in address. It does not come from the department, and it does not come from a department's email.

A tax dispute does not start in a court in any case. Its road runs through an assessment order, then the Commissioner (Appeals), then the Income Tax Appellate Tribunal, and only then the High Court. The department's own power to compel attendance — the summons under Section 131 — brings you before the assessing officer, at the officer's office, not to a "court complex". A first contact that skips every stage and lands you at a courthouse on Monday morning describes a procedure that does not exist.

The August version, with its "Renda Tax Department", failed this test because the issuing body was fictional. This version names a real body and fails it anyway, because the real body cannot do what the notice says it is doing. Getting the name right made the claim more checkable, not more true.

4. "New Delhi Court Complex" Is Still Not a Court, and the Venue Line Has Swallowed the Next One​

  • स्थान: नई दिल्ली न्यायालय परिसर, भारत संबंधित दस्तावेज़: — Location: New Delhi Court Complex, India Related documents:

The accent has gone from Délhi. The venue is no more real for it. Delhi's district courts sit at seven named complexes — Tis Hazari, Patiala House, Karkardooma, Rohini, Saket, Dwarka, and Rouse Avenue — and the High Court sits at Sher Shah Road. The New Delhi district is served by Patiala House. Every one of these has a name, a postal address, court-room numbers, and a cause list published online each day. "New Delhi Court Complex" is none of them. It is the phrase you get when a template's slot for venue is filled by someone who knows the city's name and nothing else about it — the same generic slot that read "Nova Délhi Judicial Complex" in August, now merely spelled correctly. And even a real complex would not be enough: a summons tells you which court room to walk into and which judge you will stand before. This one cannot name the building.

Look at the rest of the line, because it carries a second tell. The location and the next field — संबंधित दस्तावेज़:, Related documents: — have been run together, so that the notice reads New Delhi Court Complex, India related documents: as one phrase. The line also opens with a stray leading space. Both are rendering faults: the template's line break between two fields was lost when the text was pasted into the mailer, and nobody read the result before sending. The 7 September penalty notice had the same defect — its link was jammed onto the word notice: — and it is the signature of a message assembled from parts by a script. A court that was actually summoning you would at least have looked at the summons.

5. A Hearing Three Working Days Away That Asks You to Do Nothing — and Has Now Come and Gone​

  • Received: Wednesday, 2 September 2026, 5:09 PM
  • सोमवार, 7 सितंबर, 2026 / समय: 10:30 AM — Monday, 7 September 2026, 10:30 AM

Sent after five on a Wednesday evening; hearing at half past ten on the Monday morning. Thursday, Friday, and the first half-hour of Monday: three working days to answer a court summons that names no case, no court, and no charge. The August draft allowed fifteen days. This one has been tightened, for the reason that produces every fabricated deadline — the window has to close before anyone telephones a lawyer or a chartered accountant.

Now read what the notice asks you to do about the hearing. Nothing. It does not tell you to appear, does not say what happens if you do not, does not name the judge or the court room, does not attach an order, a complaint, or a page of case papers, and does not tell you how to seek an adjournment or file a reply. A summons exists to compel attendance and warn of the consequence of absence; this one does neither. The hearing is not the point of the message. It is the pressure that carries the link.

The single realistic detail in the block — 10:30 AM — is the one that came from the template unchanged. It falls inside the hours a Delhi court actually sits, and it is the same 10:30 AM the August notice used, for a different date, in a different language. A real listing would have been a different time for a different case; a template has one time, and every notice it produces shares it.

Then there is the calendar. This post is published on 13 September. Monday, 7 September at 10:30 AM has come and gone. No court convened, no order was passed, and no consequence followed, because there was no case. The date is its own verification: a real hearing leaves a record on the e-Courts cause list, and a fake one leaves nothing but the email. As it happens, the morning of 7 September was busy in another way. At 9:55 AM — thirty-five minutes before this hearing was due to begin — the revised penalty-notice template from the same campaign arrived at the same organisation. Two templates, alternated, each refined between waves: 9 August, 10 August, 2 September, 7 September.

6. The Link Is a Random Subdomain of a Chinese Pinyin Domain — Which No Longer Exists​

  • संबंधित दस्तावेज़: https://8y2tw.laikehuyu.com/index-2026-tax.html

Strip away the nine lines of furniture and this URL is the entire email. Take it apart from the right.

laikehuyu.com is the domain, and it reads as Chinese pinyin. Huyu (互娱, "interactive entertainment") is the suffix in the names of a great many Chinese gaming and entertainment companies. The August penalty notice pointed at chuanqiweb.com — chuanqi, 传奇, "Legend", the name of a Chinese online game — and we noted then that a Chinese gaming host has no conceivable business hosting an Indian tax document. This is the same family of infrastructure: a domain with an unrelated pinyin name, pressed into service for a campaign aimed at India. Neither gov.in nor nic.in appears anywhere in it, and no Indian court file has ever lived on a .com.

8y2tw is a five-character random subdomain. Wildcard DNS lets an operator mint one of these per wave, or per recipient, at no cost. Each is a fresh hostname that no blocklist has seen, and each can double as a tracking token — the visit tells the operator which batch of addresses produced a click.

index-2026-tax.html is a static landing page named after the campaign, not a document. A court's "related documents" would be a PDF of an order or a complaint, served through the e-Courts portal against a CNR. An index page is where a visitor is sorted: it can present a counterfeit e-Filing sign-in that asks for PAN, password, and the OTP that follows; or a "download the case file" button that delivers an installer; or a blank page to a security scanner — decided at request time. The August notice's link went to a /download/ path and was flagged by Google as having been used to steal personal information. This one's is generic enough to do either.

And as of publication, it goes nowhere. Eleven days after the message was sent, laikehuyu.com has no WHOIS record and no delegation in the .com registry — it does not exist. A domain can be deleted within five days of registration for a full refund under the registry's grace period, and a domain used for a single wave and then dropped fits that pattern exactly. Either way the link is dead, the operator has moved on, and the next wave will carry a different random subdomain of a different pinyin domain. The infrastructure is disposable by design; only the template is permanent.

7. Not One Fact That Identifies You, the Case, or the Officer​

Count what a genuine summons or notice must contain, and then count what this one does.

About you: no name, no company name, no address, no PAN, no CIN, no assessment year, no salutation. The subject line says corporate tax rules were not followed, and the body cannot name the corporation. About the case: no title, no section of any Act, no amount, no allegation beyond the two words tax dispute, no date of any inspection or order, and a case number that matches no Indian format. About the sender: no officer, no designation, no ward or circle, no court, no judge, no seal, no signature, no telephone number, no postal address — and no Document Identification Number, which since 1 October 2019 every communication from any income-tax authority must carry, on pain of being treated as never issued at all.

The message asserts the authority of the Government of India and then declines to say who is exercising it, against whom, or for what. That is not an oversight. It contains no identifier because the sender holds none. This arrived at a functional mailbox scraped from a company website, and the phrase your company, implicit throughout, is doing the work that a name does in a real notice.

One structural fact settles the question on its own. A real income-tax notice appears inside your e-Filing account under e-Proceedings, where its DIN can be authenticated; a real court case appears on ecourts.gov.in, where its CNR can be searched. If a notice exists only in an inbox, it is not a notice. Checking takes under a minute, from a browser tab you open yourself, and this message survives neither check.

8. The Hindi Was Written by a Translator — Including the Sentence That Recruits You as Courier​

The Hindi in this message is grammatical, and that is the point of it: the August version's Portuguese has been replaced by something a Hindi reader will not stumble over. But it still reads as translated English, and the tells are there for anyone who reads the language.

  • कॉर्पोरेट टैक्स in the subject line is corporate tax written in Devanagari. The Government of India's Hindi for it is निगम कर, the term used in every Union Budget and Finance Act. नोटिस is likewise notice transliterated, where the body — translated separately — uses the actual Hindi word, सूचना, for the same thing. Two words for one document, in two registers, because the subject and the body went through the translator as separate strings.
  • 2026 का नोटिस — a notice of 2026 — is not how any Indian office describes a notice. Notices carry a date; they are not "of" a year. It is what "2026 Notice" becomes when it is translated a word at a time.
  • कृपया इस जानकारी को वित्त विभाग के साथ आंतरिक रूप से साझा करें उनके संदर्भ के लिए। Hindi puts the verb at the end of the sentence. This one reaches its verb — साझा करें, share — and then keeps going: उनके संदर्भ के लिए, for their reference, hangs after the verb, exactly where it sits in the English original, Please share this information internally with the finance department for reference purposes. A Hindi writer would have put the purpose before the verb. A translation engine keeps the source order.

That last sentence is worth reading twice, because in every language it is the most carefully placed line in the message. It asks you to forward the notice to finance — the department with payment authority, tax-portal logins, and bank credentials — and to do it internally, which strips the External Email tag the gateway attached to the foot of this one and delivers the link from a colleague's address with a colleague's implicit endorsement. It asks for no action, only "reference", so that forwarding feels like housekeeping rather than escalation. And it answers, at the recipient's expense, the one question the attacker cannot: who in this company handles its taxes. The August post took this sentence apart at length, and the analysis has not changed; only its language has. A government body that wanted your finance department to have a notice would send it to your finance department. A message that needs you to carry it is a message that wants to shed the warnings attached to it.

How This Scam Works​

The notice is not the attack. It is nine lines of procedural set-dressing arranged to make one click feel like an obligation, and the reason this specimen is worth studying is that we can watch the operator iterate: the same template, three languages, three weeks.

  1. The Template: A fake judicial notice of the kind that circulates in Brazil — box rules, process number, case matter, investigating authority, hearing block, document link, forward-to-finance closer — is the fixed asset. It arrived in India in August with its Portuguese still showing.
  2. The Rewrite: Between waves, the tells a reader could look up are removed. Renda becomes आयकर, Financeira becomes वित्तीय, Nova Délhi becomes नई दिल्ली. The corrected text is machine-translated into the target's language and pasted back into the same nine slots — loanwords, English word order, and a lost line break included.
  3. The Infrastructure: A .com domain bought through a bulk registrar and aged for ten months is switched on ten days before the send, pointed at a private nameserver, and given a subdomain and a mailbox made of random characters. It passes SPF and DKIM for itself, has no abuse desk to answer to, and will be discarded when blocklisted.
  4. The List: Functional company addresses — info@, accounts@, support and complaints mailboxes — scraped from websites, WHOIS records, and directories. Nothing is known about the recipient beyond the address, which is why the notice names nothing.
  5. The Blast: Sent on a Wednesday evening to an enormous list. No attachment, no HTML tricks, a plain-text URL — the message is shaped to pass filters tuned for payloads rather than prose.
  6. The Clock: A hearing three working days out, at a plausible hour, at a venue that sounds like a place. Long enough to read as a real listing; short enough to make "I will deal with it next week" feel dangerous.
  7. The Courier: "Please share this internally with the finance department." The recipient carries the message past their own gateway and hands it, implicitly endorsed, to the person who can act on it.
  8. The Page: index-2026-tax.html sorts its visitors. A counterfeit e-Filing login captures PAN, password, and OTP in real time; a "download the case papers" button delivers an information stealer; a scanner sees nothing.
  9. The Use: Credentials open the e-Filing account — returns, bank details, TDS records, the full identity behind the PAN — and the mailbox, which opens invoice fraud. The intelligence makes the next notice specific: a fourth draft quoting your real PAN and a genuine assessment year is a far harder message to dismiss.
  10. The Burn: The link domain is dropped — this one within eleven days — the sending subdomain is deleted, and the template is kept. The next wave goes out under a new random subdomain of a new pinyin domain, with the penalty-notice template sent in between. Between 9 August and 7 September this operator sent four notices to one organisation, two of each kind, each a revision of the last.

Conclusion and Recommendations​

There is no case 54973713, no hearing on 7 September, no New Delhi Court Complex, and no court notice that the Income Tax Department could issue if it wanted to. There is a Brazilian phishing template on its third translation, a nine-character .com bought in Singapore and switched on ten days before the send, and a link to a Chinese-named domain that has already ceased to exist. Every procedural detail — the number, the date, the time, the venue — exists to make the link feel like something you are obliged to open.

The instructive part is the comparison with August. Every fault a reader could catch by reading has been fixed: the Portuguese is gone, the accent is gone, the department has its right name in the right language. Every fault a reader can catch by checking has survived: the case is not on e-Courts, there is no DIN, the venue does not exist, and no department in India issues a court's summons. The attacker's edits improved the disguise and could not touch the anatomy — which is what we said after the penalty-notice template's second draft a week ago, and what this specimen now confirms from the other half of the same campaign.

That is the durable lesson. A defence built on spotting foreign words, odd grammar, and free webmail addresses expires the moment the attacker buys a translator and a domain — and this one has now done both. A defence built on the case is not on the portal, the domain is not gov.in, and there is no DIN survives every draft, because it tests the things the attacker has no power to change.

Immediate Actions:​

  • Do Not Open the Link: 8y2tw.laikehuyu.com is the whole attack. As of publication the domain no longer exists, but the next copy's will, and a landing page like this one is built to make the first click feel routine and the second — a login, a download — feel like compliance.
  • Do Not Forward It, Least of All to Finance: The message asks you to do this in so many words. An internal forward strips the External Email tag, drops the spam score, and delivers the link from a trusted address to the one department that can act on it. If finance should know, tell them about the phishing attempt in a fresh message. Do not pass on the notice.
  • Do Not Reply: There is nowhere for a reply to go — the sending subdomain has already been deleted — but the reflex matters for the next copy. A reply to any address in a message like this confirms a live, human-read mailbox and promotes you from a scraped string to a qualified target.
  • Check the Portals Instead, and Check Them Yourself: Open a browser, type ecourts.gov.in, and search for the case by your company's name. Open incometax.gov.in, log in, and look under e-Proceedings. If either held anything, it would be there with a CNR or a DIN you could authenticate. Ninety seconds, and it settles the matter permanently. Never navigate from a link in the message.
  • Report and Delete: Use the mail client's phishing report rather than plain deletion, so the sender is scored and, on a corporate system, your security team sees the campaign. Phishing that impersonates the tax authority can be forwarded to webmanager@incometax.gov.in, copying CERT-In at incident@cert-in.org.in; incidents involving loss go to the National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline.
  • If Anyone Has Already Clicked or Entered Credentials: Change the e-Filing and mailbox passwords from a known-good device, revoke active sessions, re-verify MFA, check the mailbox for newly created forwarding or auto-delete rules, review recent returns and refund claims for changes you did not make, and tell your chartered accountant. The first hour is the window that matters.
  • Warn Whoever Else Reads the Shared Mailbox: Functional addresses are read by several people. The colleague who opens the next copy may not be the one who recognised this one, and a clean Hindi notice is easier to take at face value than an English one with Portuguese in it.

Verification Steps:​

  • Search the Case Where Cases Are Recorded: Every case in an Indian court has a sixteen-character CNR and appears on ecourts.gov.in, searchable by CNR, case number, or party name. 54973713 is not a CNR, matches no court's numbering, and returns nothing, because there is nothing to return.
  • Demand the DIN: No income-tax communication issued since 1 October 2019 is valid without a computer-generated Document Identification Number, and a DIN can be authenticated on the e-Filing portal in seconds. This notice has none. No DIN, no notice.
  • Read the Sender Domain From the Right: rxsi9tm65.com — nine random characters, bought in Singapore, activated ten days before the send. Not gov.in, not nic.in, not anything a court or a department has ever used. The words notice-tax in front of it were chosen by the attacker and mean nothing.
  • Read the Link Domain From the Right: laikehuyu.com — a pinyin name with no relationship to India, under a random subdomain, serving a static page called index. A government document lives on a government domain, inside an authenticated account, and never at an open .com URL.
  • Ask Which Court: A summons names the court, the court room, the judge, and the case title. "New Delhi Court Complex" is none of those, and a summons that cannot say where to appear is not summoning anyone.
  • Ask Who Is Writing, and in What Capacity: A tax department is a party before a court, never the court. If the sender is the Income Tax Department, it cannot be a court notice; if it is a court notice, it cannot be from the Income Tax Department. This message claims both.
  • Ask What the Sender Knows About You: No name, no PAN, no CIN, no assessment year, no allegation. A real notice quotes the identifiers that make the proceeding exist in the department's own records. A message that knows only your email address holds only your email address.
  • Count the Working Days: Wednesday evening to Monday morning is three working days. No court in India summons a company by email on that timetable, and a notice that leaves no time to consult a professional is not designed to be complied with.
  • Verify Through a Route You Already Had: Your chartered accountant, your lawyer, the helpline number on the official portal, the assessing officer whose name is on your last order. Never a link, address, or number supplied by the message you are trying to check.

Additional Protection Tips​

  • Learn the Structural Checks, Not the Cosmetic Ones: This template lost its Portuguese in three weeks and its free webmail address in the same span. Odd words, bad grammar, and consumer mailboxes are the first things an attacker improves. Registry suffix, DIN, e-Courts presence, and the identity of the issuing body are things they cannot improve, and those four are the whole defence.
  • Expect the Next Draft: An operator who has sent four revised notices to one organisation in a month will send a fifth. Record what made each one fake — not what made it look fake — so the person who opens the cleaner version has something durable to check against.
  • Know What a Real Summons Looks Like: It comes from a court, under seal, signed by an officer of that court, with a case title, a CNR, a court room, and a statement of what happens if you do not appear, and it is served through the court's own process. It is never an unsigned email from a department that is itself a party to the case.
  • Make "Share This Internally" a Reportable Event: Attacks that ask to be circulated defeat perimeter controls by using your staff as the transport. Establish that suspicious mail goes to IT or security — never sideways to finance — however reasonable the request sounds.
  • Route All Tax, Legal, and Regulatory Correspondence Through One Named Owner: Notices arriving at a functional mailbox are, by definition, not from the department, which writes to the address registered against your PAN. One named person who verifies every such notice on the portal turns every other channel into an automatic tell.
  • Treat a Never-Seen Domain as Disposable Until Proven Otherwise: A sender domain of random characters, with a random subdomain and a random mailbox, is describing its own lifespan. Mail gateways can be configured to flag or quarantine mail from domains with no sending history to your organisation; for finance mailboxes, that rule is worth its false positives.
  • Enable Multi-Factor Authentication and Understand Its Limit: MFA on the e-Filing account and on every mailbox is essential, and a real-time phishing page will still ask for the OTP and replay it within seconds. MFA raises the cost of an attack; it does not remove the need to look at where you are typing. Never enter a code on a page you reached by clicking.
  • Adopt a Two-Person Rule for Money Leaving the Business: Any payment to a new beneficiary, any change to bank details, and any fee attached to an unexpected legal or tax demand should require a second approval and a voice call to a number from your own records. These schemes depend on one person acting alone, under a deadline.
  • Make It Safe to Say "I Clicked It": The window to contain a stolen credential is measured in minutes, and embarrassment is what closes it. A workplace where someone can report a mistake immediately, without consequence, recovers accounts that a workplace built on blame loses entirely.

Remember: A court's summons comes from the court, names the case, and can be found where cases are recorded; a tax notice carries a DIN and sits in your own e-Filing account. This message could produce neither in August, in English with Portuguese in it, and it cannot produce them now, in Hindi from a domain the attacker owns. When a notice is rewritten between waves and the checks that failed it still fail, you are looking at the part of the attack that cannot be fixed — and that is the only part worth testing.

Share this post