Phishing: कर वसूली एवं दंड सूचना | Fake Income Tax Department Tax Recovery and Penalty Notice With a ZIP Attachment

Review of your return found under-reported income and undisclosed foreign assets. Refer to the attachment for full details. A bilingual Income Tax Department notice that says nothing about the tax, the amount, or the taxpayer, and defers to a ZIP file in every other sentence — sent from a domain registered seventeen days earlier, through a real-looking government address pasted into the wrong half of the sender.

Complete Email

from: श्री राजेश कुमार itd.complianceincometax.gov.in@soyoyz.com
date: 08/17/2026 9:08 AM
subject: कर वसूली एवं दंड सूचना

The subject line is Hindi: Tax Recovery and Penalty Notice. The message was received on Monday, 17 August 2026, and is published here out of sequence; it falls chronologically between the Judicial Notice of 10 August and the Hindi court notice of 2 September in the same campaign. The recipient address has been blurred. It carried one attachment: ITDTAX20260817.zip, 261,708 bytes. The attachment was not opened.

Email Body

The message is an HTML letter in which every line appears twice, first in Hindi and then in English. It is reproduced in that order.

भारत सरकार
GOVERNMENT OF INDIA

आयकर विभाग
Income Tax Department

(केंद्रीय प्रत्यक्ष कर बोर्ड)
(Central Board of Direct Taxes)

आधिकारिक सूचना
Official Notice

संदर्भ संख्या : ITD/TAX/2026/02241 — दिनांक : 17 अगस्त 2026
Reference No. : ITD/TAX/2026/02241 — Date : 17 August 2026

कर वसूली एवं दंड सूचना

Tax Recovery and Penalty Notice

1. सत्यापन परिणाम
आपके आयकर रिटर्न की समीक्षा में कम आय और विदेशी संपत्तियों का खुलासा न करना पाया गया। पूर्ण विवरण के लिए अनुलग्नक देखें।

1. Verification Result
Review of your return found under-reported income and undisclosed foreign assets. Refer to the attachment for full details.

2. देय राशि
आपको बकाया कर, ब्याज और दंड का भुगतान करना होगा। सटीक गणना अनुलग्नक में दी गई है।

2. Amount Due
You are required to pay outstanding tax, interest, and penalty. Exact calculation is provided in the attachment.

3. आपराधिक दायित्व
समय पर भुगतान न करने पर कारावास और जुर्माना हो सकता है। संबंधित कानूनी प्रावधान अनुलग्नक में हैं।

3. Criminal Liability
Non-payment within the deadline may lead to imprisonment and fine. Legal provisions are in the attachment.

4. समय सीमा
आपको 72 घंटे के भीतर जवाब देना या भुगतान करना होगा। विस्तृत निर्देश अनुलग्नक में हैं।

4. Deadline
You must respond or pay within 72 hours. Detailed instructions are in the attachment.

5. अनुलग्नक
सभी गणनाएँ, रिपोर्ट और कानूनी संदर्भ संलग्न हैं। कृपया ध्यानपूर्वक पढ़ें और आवश्यक कार्रवाई करें।

5. Attachment
All calculations, reports, and legal references are attached. Please read carefully and take necessary action.

⚠ महत्वपूर्ण : सभी विवरण अनुलग्नक में हैं। समय सीमा का पालन करें, अन्यथा कानूनी कार्रवाई होगी।

⚠ Important : All details are in the attachment. Adhere to the deadline, else legal action will follow.

भवदीय,
Yours sincerely,

(श्री राजेश कुमार)
(Shri Rajesh Kumar)
उपायुक्त (आयकर)
Deputy Commissioner of Income Tax
भारत सरकार · आयकर विभाग
Government of India · Income Tax Department

ईमेल : itd.compliance@incometax.gov.in | फोन : +91 1800 180 1234 (10:00–18:00)
Email : itd.compliance@incometax.gov.in | Phone : +91 1800 180 1234 (10:00–18:00)

* यह सूचना आयकर अधिनियम के तहत जारी की गई है। कानूनी संदर्भ अनुलग्नक में हैं।
* This notice is issued under the Income Tax Act. Legal references are in the attachment.

नोट : कृपया अनुलग्नक डाउनलोड करें। किसी भी प्रश्न के लिए आधिकारिक चैनलों का उपयोग करें।
Note : Please download the attachment. For queries, use official channels.

Attachment: ITDTAX20260817.zip (261,708 bytes)

---

Red Flags

This is government-impersonation phishing delivered by attachment, and it belongs to the Income Tax Department campaign this archive has been tracking since August. The Audit Notification of 9 August and the Judicial Notice of 10 August each carried a link. So did the Hindi court notice of 2 September, the English court notice of 4 September — whose link we followed to a disk image and a side-loaded DLL — and the penalty notice of 7 September. This message, received a week after the Judicial Notice, is the third template in the series and the only one so far that dispenses with a link altogether. The payload is in the mail.

It is also the most polished of the six. The Hindi is grammatical, the layout is clean, the letterhead is bilingual in the way real Government of India stationery is bilingual, and the sender address contains the string incometax.gov.in. Every one of those improvements is cosmetic. What follows are the things that are not.

1. The Sender Address Is a Government Address With Its @ Removed — Inside Someone Else's Domain

• from: श्री राजेश कुमार itd.complianceincometax.gov.in@soyoyz.com
• Signature block: itd.compliance@incometax.gov.in

Read the sender address from the right. The domain — the only part of an email address that a mail system enforces — is soyoyz.com. Everything to the left of the @ is the local part, and a local part is free text: the owner of soyoyz.com can put any string there, including one that looks like a government address. This one is itd.complianceincometax.gov.in, which is the signature block's itd.compliance@incometax.gov.in with its own @ deleted so the whole thing fits on the left of a different one.

The trick is aimed at mail clients that show the address in a narrow column, where the eye reads itd.compliance, then incometax.gov.in, and stops. It works only until you find the @. The message claims to come from incometax.gov.in, signs itself as incometax.gov.in, and was sent from soyoyz.com. A department writes from the address it signs with. This one could not, because it does not control incometax.gov.in, and the address it used to say so is the confession.

2. soyoyz.com Was Registered Seventeen Days Before the Send, and Has Never Hosted Anything

The public WHOIS and DNS records for the sending domain, looked up on 13 September 2026:

• Registered on 31 July 2026 through Spaceship, Inc., a budget registrar; the notice was sent on 17 August. Seventeen days from purchase to phishing.
• Set to expire on 31 July 2027. One year, the minimum term.
• Nameservers at Cloudflare, which hides the hosting provider behind Cloudflare's proxy for anything served over the web.
• Mail routed through Zoho Mail — MX records at mx.zoho.com, an SPF record of v=spf1 include:zohomail.com ~all, and a Zoho domain-verification TXT record. The attacker signed a fresh domain up for a hosted mailbox service and sent from it. That is why the message passed SPF: Zoho was authorised to send for soyoyz.com, and soyoyz.com is not the Income Tax Department.
• The domain's A record points to 103.74.194.149, an address allocated to Baud Linker Network Co., Limited, in Mong Kok, Hong Kong. Nothing answers on port 80 or 443. The domain exists to send mail, not to be visited.

The name itself, soyoyz, means nothing in any language. It is the kind of string that comes back from a registrar's availability search when every real word is taken. Compare incometax.gov.in: a gov.in domain can be registered only by a verified Indian government body through the National Informatics Centre, and it cannot be bought from Spaceship for the price of a coffee.

3. There Is No DIN, and ITD/TAX/2026/02241 Is Not One

• Reference No. : ITD/TAX/2026/02241

The department's own rule, stated in the two penalty-notice posts and restated here because it is the single most decisive check available: since 1 October 2019, under CBDT Circular No. 19/2019, every notice, order, summons, letter, or other correspondence issued by any income-tax authority must carry a computer-generated Document Identification Number, and a communication issued without one is treated as invalid and deemed never to have been issued. A DIN can be authenticated in seconds through the e-Filing portal's Authenticate Notice/Order Issued by ITD service. It is the one number a real notice cannot be without.

This notice has a Reference No. instead. ITD/TAX/2026/02241 is the same kind of invention as [ITD/2026/ND/458721] in the September court notice and TAX/PEN/2025-142 in the September penalty notice: an acronym, a year, and a serial, in the shape a person imagines a filing number would have. Real DINs are generated by the Income Tax Business Application and look like ITBA/PNL/S/271/2026-27/ followed by a long numeric string, and they are tied to a PAN, an assessment year, and a section of the Act. This one is tied to nothing, because the notice names no PAN, no assessment year, and no section.

4. A Tax Notice With No Tax In It — Everything Is "In the Attachment"

Count the deferrals. Refer to the attachment for full details. Exact calculation is provided in the attachment. Legal provisions are in the attachment. Detailed instructions are in the attachment. All calculations, reports, and legal references are attached. All details are in the attachment. Legal references are in the attachment. Please download the attachment. Eight in English, and the same eight in Hindi. The letter has sixteen English sentences, and half of them point at the ZIP.

What the letter itself contains is nothing. It alleges under-reported income and undisclosed foreign assets without an amount, a year, a return, or a PAN. It demands payment of outstanding tax, interest, and penalty without a figure. It threatens imprisonment and fine without a section. It calls itself a Tax Recovery and Penalty Notice — three different proceedings, under three different parts of the Act, each with its own form, its own issuing authority, and its own timetable — and cites none of them. Even the footnote, This notice is issued under the Income Tax Act, cannot say which section. Real notices are titled by their section, because the section is what gives the officer the power to send them: Notice under section 143(2), Notice of demand under section 156, Show-cause notice under section 274 read with section 270A. A notice that cites the Act as a whole is a notice written by someone who does not know which part applies.

A genuine demand notice states the amount on its face, because the amount is the notice. A genuine penalty proceeding begins with a show-cause and a hearing, because the Act requires one. Here the body's only function is to make the reader open the archive. The letter is the envelope; the ZIP is the letter.

5. The Attachment Is a ZIP File, and the Income Tax Department Does Not Send Those

• ITDTAX20260817.zip — 261,708 bytes

The department's automated systems do send email attachments — the Centralised Processing Centre's intimations under section 143(1) arrive as PDFs, password-protected with the taxpayer's PAN and date of birth, from intimations@cpc.incometax.gov.in, each with a DIN, each mirrored on the portal. They are never ZIP archives. A ZIP has one purpose in an unsolicited email: to wrap a file that a mail gateway would otherwise inspect, flag, or strip — an executable, a script, a shortcut, a disk image, a document with macros. Compression is the excuse; concealment is the function.

The filename says when the archive was built: ITDTAX for Income Tax Department tax, then 20260817, the date of the send. The notice's own date, 17 August 2026, matches. Both were stamped by the same tool on the same morning — the message was generated, not issued, and the archive was generated alongside it.

We did not open it. The September court notice in this campaign led, at the end of its link, to a disk image carrying a legitimately signed Tencent executable and the unsigned DLL it side-loads; a 262-kilobyte archive is too small to be that particular payload, and what it holds instead is not something we will guess at. It is enough that a government department's calculations, reports, and legal references would be a PDF on a portal, and that nothing a Deputy Commissioner needs to tell you requires you to extract an archive to read it.

6. The Contact Details Are for Verifying the Notice, and Both Are Fake

• Email: itd.compliance@incometax.gov.in
• Phone: +91 1800 180 1234 (10:00–18:00)
• Note: For queries, use official channels.

The closing line tells you to use official channels, and the signature block supplies two — its own. The email address is not a published Income Tax Department mailbox; it is the address the attacker wanted to have, and could not, which is why it turned up on the wrong side of an @ in the sender field. The phone number is not one the department publishes either. The Aayakar Sampark Kendra is 1800 180 1961; the e-Filing helpdesk is 1800 103 0025 and 1800 419 0025. 1800 180 1234 shares its first six digits with the real ASK number and ends in the four digits a person types when inventing a number. And it carries a +91 prefix that no Indian 1800 number takes: toll-free numbers are domestic and not reachable in international format, which is why the department lists its overseas line separately as +91-80-46122000.

Every genuine notice has a route to verification that does not pass through the notice: the DIN, the portal, the assessing officer's published contact. This one offers a mailbox nobody answers and a number nobody has, and calls them official.

7. Seventy-Two Hours to Pay or Face Prison — a Timetable the Act Does Not Contain

• You must respond or pay within 72 hours.
• Non-payment within the deadline may lead to imprisonment and fine.

The 72-hour clock is this campaign's constant. It was in the 9 August audit notification, the 7 September penalty notice, and the landing page behind the 4 September court notice, and it is here. It does not appear anywhere in the Income Tax Act. A notice of demand under section 156 gives thirty days to pay. A penalty cannot be imposed without a show-cause notice and an opportunity to be heard under section 274, and the response period for that is set by the officer in the notice, typically a fortnight or more. Recovery — the word in this notice's title — is what the Tax Recovery Officer does after a demand has fallen into default and a certificate has been drawn under section 222, a process measured in months. Prosecution is a separate matter again, under Chapter XXII, requiring sanction from a Commissioner and a court to hear it.

None of these can happen in three days, and none of them is set in motion by a Deputy Commissioner emailing a ZIP file. The deadline is not a legal term. It is the interval the attacker has judged short enough that the reader opens the attachment before calling a chartered accountant.

8. A Deputy Commissioner With No Jurisdiction, Writing to a Mailbox No Officer Would Have

• (Shri Rajesh Kumar), Deputy Commissioner of Income Tax, Government of India · Income Tax Department

An income-tax officer has a charge: a Circle, a Ward, a Range, a city, and an office address, and every notice states it, because jurisdiction is what makes the notice valid against you. This signature has a name and a rank and nothing else — no Circle, no Range, no city, no Aayakar Bhawan, no employee code. Shri inside the parentheses is a courtesy title, not a signature; officers sign as (Rajesh Kumar) with the designation beneath. The name is also this campaign's third variation on the same officer: Raj Kumar Sharma, Assistant Commissioner, signed the August and September penalty notices, and Rajesh Kumar, Deputy Commissioner, signs this one. A promotion and a shortened name between drafts.

The letterhead is wrong in the same way. Income Tax Department (Central Board of Direct Taxes) puts the Board in brackets under the Department as if it were a sub-office. The CBDT is the statutory body, within the Ministry of Finance's Department of Revenue, that administers the Income Tax Department; a real notice from a field officer names neither, because it comes from an office, not from an organisation chart. The Ministry of Finance, present on every real letterhead, is absent here.

And it went to a general-purpose functional mailbox scraped from a company website — an address that appears on no PAN, no e-Filing profile, and no return. The department writes to the email registered against the PAN, and simultaneously posts the notice under e-Proceedings on the portal, where its DIN can be checked. A Deputy Commissioner who wanted to tell this company anything would have its registered address on file. The sender had a public one.

---

How This Scam Works

The letter is bait for a single action — extracting the archive — and everything in it is arranged to make that action feel like compliance. The sequence, if the target follows it:

1. The Template: A bilingual HTML letter, laid out as a Government of India notice, with five numbered sections that each defer to an attachment. It is the campaign's third template alongside the court notice and the penalty notice, and the only one built around an attachment rather than a link.
2. The Infrastructure: A meaningless .com bought on 31 July from a budget registrar, parked on Cloudflare, signed up for Zoho Mail so that it passes SPF, with its web address pointing at Hong Kong hosting that serves nothing. Total cost, a few dollars. Total setup time, an afternoon.
3. The Disguise: A real-looking government address is placed in the local part of the sender, so a narrow mail client shows incometax.gov.in before the real domain. The same address is repeated in the signature so the two appear to agree.
4. The List: Company addresses harvested from websites. The notice knows nothing about the recipient, which is why it names no PAN, no year, and no amount — and why all of those are said to be in the attachment.
5. The Blast: Sent at 09:08 on a Monday morning, the first working hour of the week, when finance and admin mailboxes are being cleared in bulk.
6. The Clock: 72 hours, imprisonment for non-payment, a warning box in red. The urgency is designed to be resolved by opening the ZIP.
7. The Extraction: The target saves ITDTAX20260817.zip and opens it. What is inside is whatever the operator packed on 17 August — a document with a macro, a shortcut that runs a script, an executable named as a PDF, a disk image like September's. The ZIP wrapper is there so that the gateway did not get to look first.
8. The Foothold: Whatever runs, runs on the machine of the person who handles tax notices — saved passwords, an open e-Filing session, the bank portal, the mailbox that talks to every customer and supplier.
9. The Next Draft: The domain is dropped, the Zoho account abandoned, the archive rebuilt, the officer renamed. Between 9 August and 7 September this campaign sent six notices to one organisation under three templates and six sender identities.

---

Conclusion and Recommendations

There is no reference ITD/TAX/2026/02241, no Deputy Commissioner named Rajesh Kumar with no Circle to his name, no itd.compliance@incometax.gov.in, no helpline 1800 180 1234, and no Tax Recovery and Penalty Notice under an Act that provides for demand, penalty, and recovery separately, each on its own timetable and each with a DIN. There is a domain bought seventeen days before the send, a government address pasted into the wrong half of a sender field, a letter that defers every fact it claims to a ZIP archive, and the same 72-hour clock this campaign has used since August.

This draft is the cleanest of the six by some distance: correct Hindi, a plausible letterhead, no emoji in the header, no Portuguese, no stale date. It is worth noticing how little that helps it. The sender domain is still not gov.in. There is still no DIN. The notice is still not on the portal. The officer still has no jurisdiction. And the thing the notice exists to deliver is still a file that has to be extracted and opened, which no tax communication in India has ever required.

A notice that cannot tell you what you owe, for which year, or under which section, but can tell you exactly which file to open, was written to be opened, not read.

Immediate Actions:

• Do Not Open the Attachment: ITDTAX20260817.zip is the attack. If it has been saved, delete it. If it has been extracted and anything inside was opened, treat the machine as compromised: disconnect it, do not log in to anything from it, and hand it to IT or security. From a different device, change every credential that machine held or used — e-Filing, banking, email — and enable multi-factor authentication where it was not already on.
• Do Not Reply, Call, or Forward: The email address and phone number in the signature belong to the attacker or to nobody. A reply confirms a live mailbox; a call reaches whoever set up the number, if anyone. Do not forward the notice to finance or accounts for their opinion — tell them about the phishing attempt in a fresh message and let the original stay where it is.
• Check the Portal Yourself: Open a browser, type incometax.gov.in, log in, and look under e-Proceedings and Pending Actions. A real notice is there, with a DIN you can authenticate. Ninety seconds settles it.
• Report and Delete: Use the mail client's phishing report so the sender and domain reach the gateway's blocklist. Forward the message as an attachment to report.phishing@incometax.gov.in, the department's own reporting address for impersonation, and report the sending domain to Zoho's abuse desk and to its registrar.

Verification Steps:

• Find the @ and Read Right of It: Everything before the @ is text the sender typed; everything after it is the domain the mail actually came from. itd.complianceincometax.gov.in@soyoyz.com is from soyoyz.com, full stop.
• Demand the DIN: Since October 2019, no DIN means no notice, by the department's own circular. A Reference No. is not a DIN and cannot be authenticated.
• Ask What the Notice Knows: A real notice names your PAN, the assessment year, the section, and the amount. This one names none of them and says they are in the attachment. A notice with no facts in it is not a notice.
• Check the Section: Every real notice is issued under a specific section, and the section tells you what the officer can and cannot do. Under the Income Tax Act is not a section.
• Check the Helpline Against the Portal, Not the Email: The department's numbers are on incometax.gov.in. If the number in the message is not there, the message is not from the department.
• Verify Through a Route You Already Had: Your chartered accountant, the assessing officer named on your last real order, the portal helpdesk. Never a channel supplied by the message you are trying to check.

---

Additional Protection Tips

• Block or Quarantine Archives From Unknown Senders: A ZIP from an address your organisation has never corresponded with should not reach a mailbox unexamined. Gateway rules that hold archives for inspection, or strip them and deliver a notice, remove this vector almost entirely at negligible cost to legitimate mail.
• Teach the Local-Part Trick by Name: The realaddress@ pattern — a genuine-looking address, with or without its own @, placed before the real one — is common enough to deserve its own line in security awareness material. Once someone has been shown it once, it never works on them again.
• Learn the Structural Checks, Not the Cosmetic Ones: This campaign has gone from Portuguese leftovers and emoji letterheads to correct bilingual stationery in five weeks. Grammar and layout are the first things an attacker improves. Registry suffix, DIN, portal presence, jurisdiction, and the type of file being offered are things they cannot.
• Route Tax and Legal Correspondence Through One Named Owner: A notice arriving at a general functional mailbox is, by that fact alone, not from the department, which writes to the address registered against your PAN. One person who verifies every such notice on the portal turns every other channel into an automatic tell.
• Expect the Sixth Sender and the Third Template: An operator who has sent six revised notices to one organisation in a month, under three templates, will send a seventh. Keep a record of what made each one fake — not what made it look fake — so the person who opens the next, cleaner version has something durable to check against.
• Make It Safe to Say "I Opened It": Whatever an archive like this drops calls home within seconds, and the containment window is minutes. A workplace where a mistake can be reported immediately, without consequence, isolates the machine in time; one built on blame finds out from the bank.

Remember: A real tax notice knows your PAN, your assessment year, the section it is issued under, and the amount it demands; it carries a DIN, it sits on the portal, and it comes from incometax.gov.in. This one knew none of that and could produce none of it — only the name of a file. When every fact a notice claims to contain is "in the attachment", the attachment is not the evidence. It is the purpose.

---