Skip to main content

Phishing: कर अनुपालन की कमी और दंड सूचना / Tax Compliance Deficiency and Penalty Notice | Fake CPC Bengaluru 143(1) Intimation With a ZIP

· 22 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

Intimation under Section 143(1) of the Income Tax Act, 1961, cross-verified with AIS, TIS, and SFT, with a total corporate demand of ₹ 2,73,250 payable in fifteen days. The penalty-notice template's third draft — sharing its reply-to with the 7 September version — now dressed as a CPC Bengaluru intimation, with a fabricated DIN, a demand table that cites a Section 234F fee abolished four years ago, and a ZIP to download.

Complete Email​

from: Raj Kumar Sharma pzdu83934175@outlook.com
reply-to: estefanyfortdelapue@vfemail.net
date: 09/17/2026 8:11 AM
subject: कर अनुपालन की कमी और दंड सूचना / Tax Compliance Deficiency and Penalty Notice

Mailed by: outlook.com — Signed by: outlook.com

Gmail filed the message in Spam, with the note "This message is similar to messages that were identified as spam in the past." The recipient address is a general company mailbox and is not reproduced. The subject line is the full form of the one truncated at the word "and" in the 7 September penalty notice — same campaign, same template, completed.

Email Body​

The message is an HTML letter laid out as a Government of India intimation, bilingual throughout, with a demand table and a single download link. It is reproduced as sent, including its emoji and its punctuation.

आयकर विभाग • INCOME TAX DEPARTMENT
केंद्रीय प्रत्यक्ष कर बोर्ड • Central Board of Direct Taxes (CBDT)
भारत सरकार • Government of India

प्रेषण केंद्र / Processing Center: CPC Bengaluru
संचार माध्यम / Mode: Electronic Intimation

महत्वपूर्ण सूचना / IMPORTANT NOTICE: यह केंद्रीय प्रसंस्करण केंद्र (CPC) से उत्पन्न एक आधिकारिक इलेक्ट्रॉनिक संचार है। आयकर अधिनियम, 1961 के तहत सभी वैध नोटिसों में एक विशिष्ट दस्तावेज़ पहचान संख्या (DIN) होना अनिवार्य है।

DIN संदर्भ / Document Identification Number: ITD/2026/CPC/982341029/01

विषय / Subject: Intimation under Section 143(1) of the Income Tax Act, 1961 regarding corporate tax discrepancies and outstanding demand for Assessment Year (AY) 2025-26. / निर्धारण वर्ष 2025-26 के लिए कॉर्पोरेट कर विसंगतियों और बकाया मांग के संबंध में सूचना।

महोदय/महोदया / Sir/Madam,

  1. This is with reference to the corporate return of income filed by your company for Assessment Year 2025-26. The data furnished has been processed under Section 143(1) of the Income Tax Act, 1961, and cross-verified with third-party statements (AIS, TIS, and SFT).

  2. Upon automated scrutiny and matching, discrepancies have been identified leading to an unremitted corporate tax liability and default penalties as summarized below:

विवरण / Default Natureकानूनी धारा / Legal Provisionबकाया राशि (रु) / Amount Due (INR)
Corporate Self-Assessment Tax Shortfall (कॉर्पोरेट स्व-आकलन कर कमी)Section 140A₹ 2,45,000
Default / Late Filing Penalty (विलंब शुल्क / जुर्माना)Section 234F₹ 10,000
Interest on Deferred/Delayed Corporate Tax Payment (ब्याज)Section 234B / 234C₹ 18,250
कुल देय राशि / Total Net Corporate Demand Payable:₹ 2,73,250

  1. अनिवार्य कार्रवाई / Mandatory Action Required: You are hereby called upon to review the detailed corporate breakdown annexure, rectify the anomalies, or deposit the total outstanding sum of ₹ 2,73,250 within 15 (fifteen) days from the receipt of this communication via the official e-filing platform.

  2. Failure to satisfy this demand within the stipulated time frame shall attract coercive corporate recovery proceedings, interest penalties under Section 270A, and legal actions as mandated by the Income Tax Act, 1961.

आधिकारिक नोटिस दस्तावेज, विवरण और चालान डाउनलोड करें / Access official notice document & challan mapping:

📥 Download Official Corporate Notice & Tax Documents (.ZIP) → https://juhuotv.com/download/5b5a4e10eb

भवदीय / Yours faithfully,

संयुक्त आयकर आयुक्त (कॉर्पोरेट वृत्त) / Joint Commissioner of Income Tax
केंद्रीय प्रसंस्करण केंद्र (CPC), बेंगलुरु / Central Processing Centre, Bengaluru
आयकर विभाग, भारत सरकार / Income Tax Department, Government of India

Attacking email screenshot, CPC Bengaluru intimation with demand table and ZIP download link

Red Flags​

This is government-impersonation phishing with a malware payload, and it is a message this archive has read before. On 7 September a penalty notice with this exact subject line — then truncated mid-phrase at "and" — arrived from a free Outlook mailbox and pointed at incometax.my.id, a personal Indonesian domain wearing the department's name. Ten days later the same operator is back, and the continuity is not a matter of resemblance. It is in the header.

What has changed is the polish. The four thin paragraphs of September have become a full Centralised Processing Centre intimation: a bilingual letterhead, a Section 143(1) framing, a demand table that adds up, real section numbers, AIS/TIS/SFT language, and — for the first time in this template — a Document Identification Number printed at the top. The attacker has been reading the same advice we publish, and has built a notice to answer it. What follows is why the answer fails.

1. The Reply-To Is Identical to the 7 September Notice — Same Operator, Different Mask​

  • Display name: Raj Kumar Sharma
  • From: pzdu83934175@outlook.com
  • Reply-To: estefanyfortdelapue@vfemail.net

A genuine message has one sender. This one shows three identities, and two of them are the tell.

The from address, pzdu83934175@outlook.com, is a disposable Outlook mailbox — a random local part with no connection to any tax office, changed since September, because sending accounts get suspended and are cheap to replace. The 7 September notice came from fanniepwkm@outlook.com; a month before that, the audit notification that is this template's ancestor came from somewhere else again. The sending mailbox is the part the attacker throws away.

The reply-to is the part they keep. estefanyfortdelapue@vfemail.net is the same anonymous address the 7 September notice used — character for character, on the same privacy-oriented free mail service. The sending Outlook account is disposable; the reply-to is the mailbox the operator actually watches, so that any reply — including a cautious recipient writing back to ask whether the notice is real — lands somewhere they still control after the sender is dead. That single reused string ties this message to the September campaign more firmly than any letterhead could, and it is the one field the attacker did not think to rotate.

The display name "Raj Kumar Sharma" is free text, typed by the sender and verified by nobody. And Mailed by / Signed by outlook.com attests only that Microsoft's servers really sent the mail; SPF and DKIM authenticate the transport, not the claim. The message is authentically from an Outlook account. The Government of India is not an Outlook account, and no amount of passing authentication makes it one.

2. It Now Carries a DIN — Which Is the Point, and Also the Problem​

  • Document Identification Number: ITD/2026/CPC/982341029/01
  • IMPORTANT NOTICE: "आयकर अधिनियम, 1961 के तहत सभी वैध नोटिसों में एक विशिष्ट दस्तावेज़ पहचान संख्या (DIN) होना अनिवार्य है।" — under the Income Tax Act, 1961, every valid notice must carry a unique Document Identification Number.

This is the sharpest edit in the rewrite, and it is aimed directly at the check this archive keeps recommending. Since 1 October 2019, under CBDT Circular No. 19/2019, every notice, order, summons, letter, or correspondence issued by an income-tax authority must carry a computer-generated DIN, and a communication issued without one is treated as invalid and deemed never to have been issued. Every previous fake in this campaign failed that test by having no DIN at all. This one has read the rule — it even quotes the substance of it — and supplied a number to fill the gap.

It changes nothing, because a DIN is not a decoration. Its entire value is that it is verifiable. Every genuine DIN can be entered into the e-Filing portal's Authenticate Notice/Order Issued by ITD service, which returns the actual notice it belongs to. ITD/2026/CPC/982341029/01 will not, because there is no notice behind it. The string is also not shaped like a real one: departmental DINs are generated by the Income Tax Business Application and the CPC systems, not assembled from an acronym, a year, and a serial. It is the same invention as this campaign's earlier fake references — TAX/PEN/2025-142 on the September penalty notice, [ITD/2026/ND/458721] on the September court notice, ITD/TAX/2026/02241 on the tax-recovery notice two days ago — now relabelled DIN to survive the one question a reader was told to ask.

The lesson is the durable one, restated from the other side. The attacker can print any number they like. What they cannot print is the portal record it is supposed to match. A DIN you cannot authenticate is not a DIN. It is a number in the shape of one.

3. A Section 143(1) Intimation That Does What Section 143(1) Cannot​

  • Subject: Intimation under Section 143(1) of the Income Tax Act, 1961.

The notice dresses itself as a 143(1) intimation, and that is a real, specific thing with a real, specific shape — none of which this matches. A genuine 143(1) intimation is the automated result of the Centralised Processing Centre processing your return: it makes only the limited adjustments Section 143(1)(a) permits, it arrives as a password-protected PDF (the password is your PAN in lower case followed by your date of birth) sent to the email registered against your PAN, and it appears in your e-Filing account. It is computer-generated and system-issued.

What it does not do is behave like this letter. A 143(1) intimation does not "impose default penalties." It does not, in the same breath, threaten "coercive recovery proceedings," a penalty under Section 270A, and "legal actions." Those are four different powers with four different procedures:

  • A demand arising from processing is a notice of demand under Section 156, payable in thirty days, not fifteen.
  • A penalty under Section 270A for under-reporting requires a separate proceeding, and Section 274 forbids imposing it without a show-cause notice and a hearing.
  • Recovery is what a Tax Recovery Officer begins after a demand has fallen into default — months later, under a certificate drawn under Section 222.
  • Prosecution is a matter for Chapter XXII, needing a Commissioner's sanction and a court.

None of these is set in motion by a processing intimation, and certainly not all at once. The letter has stacked them because it is imitating the fear each word carries, not the procedure each one has. A real intimation cites the single power it actually exercises. This one cites the Act as a whole and gestures at all of them.

4. ₹10,000 Under Section 234F — a Fee That Stopped Existing Four Years Before the Year the Notice Cites​

  • Default / Late Filing Penalty — Section 234F — ₹ 10,000

This is the line a reader can disprove with one lookup. The maximum fee under Section 234F is ₹5,000 — and only ₹1,000 where total income does not exceed ₹5 lakh. The ₹10,000 figure was the old ceiling, and it was reduced to ₹5,000 by the Finance Act 2021, with effect from Assessment Year 2021-22. This notice claims to concern AY 2025-26 and demands a 234F fee that has been legally impossible for four assessment years. The number is a fossil: the attacker reached for the figure that was famous, not the one that is current, exactly as the 7 September notice reached for Section 271(1)(c), a penalty provision that has not applied to any assessment since April 2017.

The rest of the table is dressed to look right and reads wrong on inspection. The header calls the whole column "default penalties," but 234F is a fee, not a penalty, and 234B/234C are interest, not a penalty — the only actual penalty named anywhere, 270A, sits in the threat paragraph, not the table. The one line that is structurally plausible — a Section 140A self-assessment-tax shortfall picked up in processing — is surrounded by items that do not belong beside it. The arithmetic is the giveaway that this was built carefully: 2,45,000 + 10,000 + 18,250 does equal 2,73,250. Someone checked the sum. Nobody checked the law.

5. The Whole Letter Exists to Deliver One ZIP — From a Domain That Is Not the Department​

  • 📥 Download Official Corporate Notice & Tax Documents (.ZIP) → https://juhuotv.com/download/5b5a4e10eb

Every paragraph above the fold is scaffolding for one click. The letter offers its "official notice document, details, and challan mapping" not as the PDF a real intimation is, but as a ZIP archive to be downloaded from juhuotv.com — a domain with no relationship to the Income Tax Department beyond the words in the link text.

The Income Tax Department does not distribute notices as ZIP files, and it does not distribute them from a private .com. A 143(1) intimation is a password-protected PDF, delivered to your registered inbox and mirrored on the portal, carrying a DIN you can authenticate. A ZIP in an unsolicited "tax" email has exactly one purpose: to wrap a file so that a mail gateway does not inspect it on the way in. The email even names the format itself — (.ZIP) — which a government portal serving a PDF would never need to advertise.

The sending domain, looked up in the public registry, is ordinary criminal plumbing. juhuotv.com is a .com registered through Gname in Singapore and pointed, nine days before this message, at a US reseller host (206.119.189.10, Solustack); it publishes no mail records of its own, which is why the message was sent from Outlook and not from the domain it links to. It is a download host wearing a filename, not a portal. We did not download the archive, and neither should you — whatever a "tax document" that arrives as a compressed file turns out to be, no genuine tax communication in India has ever required you to fetch one from a website and open it. The PDF is on the portal. The ZIP is the attack.

6. CPC Does Not Write Like This, to a Mailbox Like This, Knowing Nothing About You​

  • संयुक्त आयकर आयुक्त (कॉर्पोरेट वृत्त) / Joint Commissioner of Income Tax, Central Processing Centre, Bengaluru

The signature asserts a named officer — a Joint Commissioner (Corporate Circle) — signing off "faithfully" from CPC Bengaluru. But CPC is an automated processing centre; its intimations are computer-generated and system-signed, not personally issued by a commissioner warning you of prosecution. There is no such thing as a "Corporate Circle" at CPC, which processes returns centrally and does not hold jurisdiction over a taxpayer the way a field Circle or Ward does.

And notice what the notice does not know. It processed "the corporate return of income filed by your company," it says — yet it names no company, no PAN, no acknowledgement number, and no date for that return. A real 143(1) intimation quotes every one of those, because it is the processing of your specific return and cannot exist without them. "Your company," repeated with no identifier attached, is the signature of a bulk send to a scraped address list — which is also why the message reached a general company mailbox rather than the address registered against a PAN, and why Gmail dropped it into Spam as "similar to messages that were identified as spam in the past." The mail system had already met this campaign. It did not need the portal to tell it.

7. Fifteen Days, Then Recovery, 270A, and "Legal Actions" — a Menace With No Single Procedure Behind It​

  • "deposit the total outstanding sum of ₹ 2,73,250 within 15 (fifteen) days"
  • "shall attract coercive corporate recovery proceedings, interest penalties under Section 270A, and legal actions as mandated by the Income Tax Act, 1961."

The deadline has been softened from this campaign's usual 72 hours to a more credible 15 days — a cosmetic improvement, since a lawful demand under Section 156 gives thirty, and any penalty requires a hearing first. The consequence, though, is still a pile-up designed to frighten rather than to inform: coercive recovery, a 270A penalty, and unspecified "legal actions," none of which follows from a processing intimation and none of which begins with an emailed archive. The passage names just enough real machinery to sound authoritative and arranges it in an order the Act does not permit. That is the tell across this entire message: the vocabulary has been upgraded; the grammar of the law has not.

How This Scam Works​

The notice is not the demand. It is a carefully built justification for downloading one file, and every improvement over the September draft is aimed at making that download feel like compliance. The sequence, if the target follows it:

  1. The Template: The penalty-notice template — this campaign's second lure alongside the court notice — reappears for its third outing, its subject line now complete, its body rebuilt as a CPC Bengaluru 143(1) intimation.
  2. The Continuity: The sending Outlook mailbox is rotated, but the reply-to at vfemail.net is reused from 7 September, because that is the inbox the operator watches.
  3. The Credibility Kit: A DIN, real section numbers, an AIS/TIS/SFT reference, and a demand table whose total adds up. Each is there to pre-empt a specific objection a reader might raise.
  4. The List: Company addresses harvested from the web. The notice names no PAN, no company, and no return, because the operator holds none of them — which is why every specific is either absent or "in the attachment."
  5. The Clock: Fifteen days, then recovery and prosecution. Long enough to seem procedural, short enough to be resolved by downloading the file before phoning a chartered accountant.
  6. The Download: Download Official Corporate Notice & Tax Documents (.ZIP) points at juhuotv.com. The ZIP wrapper exists so the mail gateway did not get to look inside first.
  7. The Foothold: Whatever the archive holds runs on the machine of the person who handles tax notices — the workstation with the e-Filing session, the banking portal, and the mailbox that talks to every supplier.
  8. The Next Draft: The Outlook account is abandoned, the domain dropped when blocklisted, the archive rebuilt, and the template sent again — cleaner still. Between 9 August and today this operator has sent this organisation notice after notice, each a revision of the last.

Conclusion and Recommendations​

There is no DIN ITD/2026/CPC/982341029/01 that authenticates on the portal, no ₹10,000 fee under Section 234F for AY 2025-26, no CPC "Joint Commissioner, Corporate Circle" writing personally to threaten prosecution, and no 143(1) intimation that demands payment in fifteen days on pain of recovery and a 270A penalty in the same sentence. There is a disposable Outlook mailbox, a reply-to reused from the September campaign, a demand table built to add up, and a ZIP on a Singapore-registered .com that the letter exists to make you download.

This is the most convincing draft the campaign has produced, and it is worth being honest about why. The Hindi is clean, the layout is a fair imitation of real bilingual stationery, the sections are real, the sum is correct, and the notice now carries the very DIN that every previous version conspicuously lacked. Every one of those is an improvement in the costume. Not one of them is an improvement in the facts. The DIN does not resolve. The 234F figure was abolished in 2021. CPC does not sign letters or send ZIPs. The notice is not on the portal. Those are properties of Indian tax administration, and no amount of redrafting reaches them.

A notice that has learned to print a DIN, cite the right sections, and make the total add up, but still can only prove itself by having you download a file, has improved everything except the one thing that would make it real.

Immediate Actions:​

  • Do Not Download the ZIP: juhuotv.com/download/... is the attack. If the archive has already been saved, delete it without opening it. If it was extracted and anything inside was run, treat the machine as compromised: disconnect it from the network, do not log in to anything from it, and hand it to IT or security. From a separate device, change every credential that machine held or used — e-Filing, banking, email — and turn on multi-factor authentication wherever it was not already enabled.
  • Do Not Reply, and Do Not Forward It "To Check": The reply-to is an anonymous mailbox the attacker watches; a reply confirms a live target. If you want finance or your accountant to be aware, tell them about the phishing attempt in a fresh message — do not forward the original as though it were a notice, which only carries the ZIP further inside your perimeter.
  • Check the Portal Yourself: Open a browser, type incometax.gov.in, log in, and look under e-Proceedings and Pending Actions. A real 143(1) intimation is there, with a DIN you can authenticate and a PDF you can open with your PAN and date of birth. Ninety seconds settles it.
  • Report and Delete: Use the mail client's phishing report so the sender and domain reach the gateway's blocklist. Forward the message as an attachment to report.phishing@incometax.gov.in, the department's own reporting address, and — because a payload is involved — you can also report it to India's National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline.

Verification Steps:​

  • Authenticate the DIN — Do Not Just Read It: A DIN printed in an email proves nothing. Enter it in the portal's Authenticate Notice/Order Issued by ITD service. If it does not resolve to a real notice, the notice is fake, whatever else it contains.
  • Find the @ and Read Right of It: pzdu83934175@outlook.com is an Outlook account. The Government of India does not correspond from outlook.com, and that ends the enquiry before the letterhead is worth reading.
  • Ask What the Notice Knows About You: A real 143(1) intimation names your PAN, your company, the assessment year, and the acknowledgement number of the return it processed. This one names none of them. A notice with no facts in it is not a notice.
  • Check the Section Against the Year: Cited provisions can be looked up in minutes. Section 234F's maximum fee has been ₹5,000 since AY 2021-22; a ₹10,000 charge under it in 2026 is not a rounding error, it is a provision that no longer exists.
  • A ZIP Is Not a Notice: The department serves a password-protected PDF from the portal, never a compressed archive from a .com. If you are being asked to download and extract something, you are being attacked, not notified.
  • Verify Through a Route You Already Had: Your chartered accountant, your assessing officer, the portal you log into yourself. Never a link, address, or number supplied by the message you are trying to check.

Additional Protection Tips​

  • Block or Quarantine Archives From Unknown Senders: A ZIP from an address your organisation has never corresponded with should not reach a mailbox unexamined. Gateway rules that hold or strip archives for inspection remove this entire vector at negligible cost to legitimate mail.
  • Treat a Printed DIN as a Prompt to Verify, Not a Reason to Trust: Attackers have started supplying DINs precisely because we told people to look for one. The check was never "is there a DIN?" — it is "does the DIN authenticate on the portal?" Teach the second question, because the first now has a fake answer.
  • Learn the Structural Checks, Not the Cosmetic Ones: In five weeks this campaign has gone from emoji-strewn Portuguese leftovers to a clean bilingual CPC intimation with a demand table that balances. Grammar, layout, and even the DIN are things an attacker can improve. Portal presence, DIN authentication, the real ceiling of a cited section, the identity of the issuing office, and the type of file being offered are things they cannot.
  • Route Tax Correspondence Through One Named Owner: A tax notice that lands in a general company mailbox is, by that fact alone, not from the department, which writes to the address registered against your PAN. One person who verifies every such notice on the portal turns every other channel into an automatic tell.
  • Never Let a Deadline Choose Your Response Time: Fifteen days, seventy-two hours — the number is a pressure device, not a legal period. A real demand survives a phone call to your accountant; a fabricated one is destroyed by it.
  • Make It Safe to Say "I Downloaded It": Whatever an archive like this drops calls home within seconds, and the containment window is minutes. A workplace where a mistake can be reported immediately, without blame, isolates the machine in time. One built on blame finds out from the bank.

Remember: A genuine tax notice sits in your e-Filing account, authenticates by its DIN, quotes your PAN and the return it processed, and arrives as a PDF you open with your own credentials; it never comes from a consumer mailbox, never asks to be forwarded, and never asks you to download a ZIP from a domain you have never heard of. This one printed a DIN, cited the right sections, and made the total add up — and still could prove none of it, because the only thing it could actually give you was a file to open. When a notice has been improved in every way except whether it is true, the improvements are the disguise, and the download is the point.

Share this post