IRS Notices

How to Tell If an IRS Letter Is Real: 5 Checks and the 2026 Scam Tells

By Angeline Balsitis, EA · Reviewed by Melissa Ly, Chief Tax Officer · Published June 11, 2026 · Updated November 4, 2026 · Editorial Standards

The envelope says Internal Revenue Service, the letter inside says you owe thousands, and you have also read that scammers now mail fake IRS letters. So you are stuck between paying something you might not owe and ignoring something that might be very real. That paralysis is what both the scammers and the interest clock feed on. You can settle the real-or-fake question yourself, in about fifteen minutes, without calling anyone.

This guide covers what an official IRS letter and envelope look like, the five marks that separate a real notice from a fake one, the mail scams circulating in 2026, what the IRS always does by mail first, the common real notice numbers and what each wants, and how to verify a letter in fifteen minutes.

Knowing how to tell if an IRS letter is real starts with knowing what an official one looks like, and the short version Clarity Tax Relief gives every caller is this: a real IRS letter can be verified without using anything printed on the letter itself, and a fake one cannot. The annotated sample further down shows an authentic notice and where each verification mark sits on the page.

What does an official IRS letter look like?

An official IRS letter is a plain, typed document on white paper with "Department of the Treasury, Internal Revenue Service" at the top, a notice or letter number in the right corner, a notice date, the tax year or period it covers, and a truncated taxpayer ID. It tells you why it was sent, what the IRS wants you to do, the date to do it by, and a phone number for that specific notice. There is no glossy design, no eagle watermark across the page, and no QR code pointing anywhere but IRS.gov.

Here is what you will find on nearly every genuine notice, roughly top to bottom:

• Return address block. Department of the Treasury, Internal Revenue Service, followed by a service center city (Ogden, Kansas City, Austin, Philadelphia and a few others). The IRS does not mail from a "Bureau," a "Processing Division," or a P.O. box in a city it has no campus in.
• Notice or letter number. IRS.gov says you can find the CP or LTR number "on the right corner of the letter." Examples: CP14, CP2000, CP504, LTR 5071C, LT11.
• Notice date and tax year. Every claim ties to a specific year or period. "Your taxes" with no year is a scam tell.
• Truncated SSN or EIN. Only the last four digits print on most correspondence. A letter showing your full SSN, or asking you to write it in and send it back, is suspect.
• A caller ID or reference number and a phone line for that notice. The number should match a number published on IRS.gov. Scam letters print a number that routes to the scammer.
• Payment instructions that name only the United States Treasury. Pay at IRS.gov or by check payable to "United States Treasury." Never to a person, company, or "agent."
• Your rights and options. Real bills explain how to dispute, how to appeal, and how to set up a payment plan. Fakes skip all of that and go straight to the threat.

What does mail from the IRS look like on the outside?

Mail from the IRS comes in a standard white government envelope, usually with a window showing your name and address, a return address naming the Department of the Treasury and Internal Revenue Service, and "Official Business, Penalty for Private Use $300" printed near the return address. Postage is metered or presorted, never a hand-applied stamp. High-stakes notices such as a final notice of intent to levy or a notice of deficiency often arrive by certified mail with a green signature card, because the law requires the IRS to prove you were notified.

Two outside tells point to a scam. The first is any delivery that is not U.S. Postal Service mail: a private courier, a cardboard or padded envelope, or a letter that arrives as an email attachment or a text link. The IRS states that it "normally" makes first contact "by mail delivered by the U.S. Postal Service." The second is a return address or agency name that does not exist. A "Bureau of Tax Enforcement," a "Tax Processing Unit," or a state-sounding "Tax Lien Division" are inventions. Our guide to why did I get a letter from the IRS covers the real reasons a letter shows up.

Is a letter from the Department of the Treasury the IRS?

Usually, yes. The IRS is a bureau of the Department of the Treasury, which is why every genuine IRS envelope and letterhead reads "Department of the Treasury, Internal Revenue Service" together, with a service center city underneath. An "IRS Treasury letter" is simply an IRS letter, and it passes or fails the same five checks as any other.

Two other kinds of Treasury mail are real and get mistaken for scams. The first is a check: federal tax refunds paid by paper arrive as a United States Treasury check, printed by the Bureau of the Fiscal Service rather than the IRS. The second is an offset notice. The Fiscal Service runs the Treasury Offset Program, which collects past-due debts owed to federal and state agencies (child support, defaulted federal student loans, state income tax) by withholding federal payments, including your tax refund. If your refund came up short and the letter explaining why names the Treasury Offset Program, the number to call is its automated line, 800-304-3107, which is published on fiscal.treasury.gov rather than on the letter alone.

The tell works the other way too. A letter that invokes "the Treasury" or "the Department of Treasury" without naming the Internal Revenue Service, or that names a unit that does not exist, such as a "Bureau of Tax Enforcement" or a "Treasury Tax Lien Division," is not Treasury mail at all. Real Treasury bureaus are listed on treasury.gov, and none of them collects income tax except the IRS.

How to tell if an IRS letter is real: the 5 marks to check

Every genuine IRS letter carries a notice or letter number, a notice date, the tax year it covers, a masked taxpayer ID, and a balance (if any) that matches your IRS online account. Check the five marks in this order:

• 1. A notice or letter number. Look in the right corner for a code like CP14, CP59, or LTR 5071C. This number identifies which form letter you are holding, and you can look it up on the IRS's Understanding your IRS notice or letter page. The IRS says that if the letter does not appear in that search, or looks suspicious, call 800-829-1040.
• 2. A notice date and tax year. Real letters tie every claim to a specific tax year and print the date the notice was issued.
• 3. A masked SSN or EIN. The IRS truncates your identifier to the last four digits on most correspondence.
• 4. Payment instructions that point only to the U.S. Treasury. Genuine letters direct payment to IRS.gov or by check payable to the United States Treasury.
• 5. A balance that matches your IRS online account. This is the decisive check. Log in at IRS.gov. If the letter claims you owe $16,400 and your account shows the same balance for the same year, the letter is real. If your account shows nothing, treat the letter as hostile until proven otherwise. IRS.gov notes that "certain notices and letters" also appear in the online account itself.

The table below puts the genuine markers and the scam tells side by side, so you can run the comparison with the letter in your hand.

What is the single clearest tell?

Ask Clarity Tax Relief for one tell and this is it. The IRS does not open contact by demanding financial information, card numbers, or immediate payment by an unusual method. IRS.gov puts it plainly: a contact is not from the IRS if it is unexpected, rushes you, threatens you, asks for personal or financial information, or demands payment now. A real notice tells you what it is about and gives you a way to check it independently. Anything that resists being checked is the thing to doubt.

Which fake IRS letters are making the rounds in 2026?

The fastest scam tell is the payment demand. The IRS accepts payment only to the United States Treasury or through IRS.gov. In its own words, the IRS "never asks for or accepts gift cards as payment for a tax bill," and it does not demand immediate payment by a specific method such as a gift card, prepaid debit card or wire transfer (IRS gift card scam warning). Any letter naming another channel, including cryptocurrency or a payment app, is fake, no matter how good the letterhead looks.

“If a letter tells you to pay with a gift card or wire money to a person, you can stop reading. The IRS doesn't take payment that way,” says Angeline Balsitis, EA, an IRS Enrolled Agent at Clarity Tax Relief.

Three mail-scam formats keep resurfacing. First, the fake refund letter: an official-looking notice claiming an "unclaimed refund" and asking for your full SSN, bank details, and a photo of your driver's license to release it. The IRS's own scam alerts warn about impersonation mail that "misleads you about an unclaimed refund" and tries to trick people into sending photos and bank account information. Second, the phony lien letter: a "Final Demand" from an invented agency threatening a lien or seizure unless you call their number. Third, the verification hijack: a letter that mimics a real IRS identity letter but routes you to a non-IRS phone number or website that harvests your credentials.

The same logic applies off the page. The IRS says it emails, calls, or texts "only when you opt in," and a social media direct message is never the IRS. Our guide on whether the IRS calls, texts, or emails you covers every legitimate contact channel. In-person visits are uncommon and a letter usually comes first: a revenue officer mails Letter 725-B to set up an appointment. Anyone at your door claiming to be IRS without prior mailed contact deserves the same skepticism as a gift-card demand.

What does the IRS always do by mail first?

The IRS's rule, in its own words, is that it normally contacts you the first time by mail delivered by the U.S. Postal Service. That covers a balance due, an income mismatch, an audit, identity verification, an unfiled return, and assignment to a private collection agency. If the first you hear of a tax problem is a phone call, a text, an email, or a knock on the door, the contact is out of sequence and you should treat it as a scam until a mailed notice with a real number backs it up.

The one place people get tripped up is private collectors. The IRS does assign some overdue accounts to three contracted agencies (CBE Group, Coast Professional, and ConServe), and those agencies do call. But the IRS mails Notice CP40 first, naming the agency, and the agency then mails its own letter. Both letters carry a taxpayer authentication number the caller must be able to repeat back to you.

What happens if you ignore a letter that turns out to be real?

Clarity Tax Relief warns callers that tossing a real letter costs far more than checking a fake one. A real IRS letter you ignore does not go away. It is one step in an automated sequence that ends with levy power, and the machine advances whether or not a human ever reviews your file. Reaching a person by phone can take hours (our 188-call hold-time study measured it), but the notice stream and the automated levies never pause while you wait.

If your letter is about a balance due, the sequence runs like this:

1. CP14 notice: the first bill. Pay or arrange payment by the due date printed on the notice.
2. CP501 / CP503: reminder bills. Still no enforcement, but the balance grows every month.
3. CP504: Notice of Intent to Levy. The IRS can now seize your state income tax refund, and the failure-to-pay penalty rate doubles to 1% per month if the balance is not paid within 10 days of a levy notice.
4. LT11 / Letter 1058: the final notice. Your Collection Due Process appeal rights attach (Form 12153), and once the window on the letter runs, wage and bank levies become legal.

If your letter is about unfiled returns, the track is different but just as automated: CP59 ("no record that you filed") escalates through CP516 and CP518, and if you still do not file, the IRS can prepare a Substitute for Return using only the gross income on your 1099s, then mail a CP3219N Notice of Deficiency. You have 90 days from that notice (150 if outside the U.S.) to petition Tax Court before the amount is assessed. Both scams and real letters punish the same behavior: doing nothing.

Not sure if the letter in your hand is real?

Do not guess, and do not pay a stranger to find out. Send us a photo of the letter and an experienced tax professional will confirm whether it is genuine, decode what it actually demands, and map your options. If it is real, interest is accruing while you wonder. The review is free, confidential, and takes minutes.

Get My Free Letter Review Call (888) 825-7779

Which real IRS notice numbers are common, and what does each one want?

Most genuine IRS mail falls into a short list of notice numbers, and each one calls for a different first move. Match the code on your letter against this table, then confirm it on the IRS.gov notice lookup:

Two real letters deserve special mention because they look so alarming that people assume they are scams: IRS Letter 6173 and IRS Letter 6174, the crypto compliance letters. Both are genuine IRS mail (6173 requires a response, 6174 does not) and both pass every verification mark above. If the letter references transaction codes from your account, our IRS transcript codes guide decodes what each one means.

If the letter is real, what are your options?

A verified IRS balance of $50,000 or less can usually be handled with a long-term online payment plan, with no financial disclosure package. Run the numbers first with our free IRS payment plan calculator to see what a monthly plan would cost before you commit. The full playbook for handling a verified balance on your own lives in our guide to how to settle tax debt yourself. Here is the map of which program fits which situation, with the fees as published on IRS.gov in November 2026:

Beware the mirror-image scam here, too: companies that promise to erase any verified balance through a special "secret program." The Fresh Start initiative is a real umbrella of IRS options, not a magic wand. Our guide on whether the IRS Fresh Start program is real separates the actual rules from the marketing, and our tax relief cost comparison shows what legitimate help actually costs.

A worked example: the $16,400 letter and three unfiled years

Say you are a gig worker with three years unfiled, and a letter arrives claiming you owe $16,400. Step one is the verification checklist: notice number, tax year, masked SSN, Treasury-only payment instructions, and a matching balance in your IRS online account. Suppose it checks out. It is a real CP3219N built from a Substitute for Return.

Here is what that means. An SFR uses your gross 1099 totals with zero business deductions, no mileage, no phone, no supplies. If your actual expenses would cut your taxable gig income substantially, filing your real returns for those three years could shrink the $16,400 before you ever negotiate payment. That is why the order of operations is: verify, then file, then resolve.

If the balance holds at $16,400, it sits under the $50,000 long-term plan threshold, so a long-term online plan spread over six years as an illustration runs roughly $16,400 ÷ 72 ≈ $228 per month before interest and the late-payment penalty that keep accruing on the shrinking balance. And because the failure-to-file penalty (5% per month, up to 25%, with a $525 minimum for returns due after December 31, 2025 that are over 60 days late) is ten times the failure-to-pay penalty, filing those missing returns immediately is the single highest-value move. You can estimate what the penalties are adding with our Penalty & Interest Calculator. For the full catch-up sequence, see our guide for people who haven't filed in 3 years.

How to verify an IRS letter is real, step by step

Clarity Tax Relief uses this same order of checks. You can verify almost any IRS letter in under fifteen minutes without speaking to a single person. Follow these five steps in order:

1. Find the notice or letter number. Look in the right corner for a code like CP14, CP59, or LTR 5071C, plus a notice date and tax year. Write all three down. They are your verification keys.
2. Look the number up on IRS.gov and compare the letter to your IRS online account. Search the code on the IRS notice lookup page, then log in at IRS.gov and check whether the balance, tax year, and recent notices match what the letter claims. A genuine balance-due notice mirrors your account; a fake one will not.
3. Call the IRS through IRS.gov, never the letter's number. If anything does not match, call the IRS at 800-829-1040, the number published on IRS.gov. Scam letters print their own phone numbers so you "verify" with the scammer.
4. Refuse every payment channel except the U.S. Treasury. Pay only through IRS.gov or by check payable to the United States Treasury. Any demand for gift cards, wire transfers, cryptocurrency, or payment apps proves the letter is fake.
5. Report a fake letter. Report IRS impersonation to the Treasury Inspector General for Tax Administration at tigta.gov (hotline 800-366-4484), file a report at reportfraud.ftc.gov, and forward related scam emails to phishing@irs.gov. Shred nothing; keep the letter as evidence.

For step two, your IRS online account setup takes about ten minutes with a photo ID. It becomes your permanent lie detector for every future letter. If the account will not verify your identity, the transcript route works too. Here is how to get your IRS transcript online.

What about private collectors, certified mail, and crypto letters?

Three kinds of genuine IRS contact get mistaken for scams more than any others, and each has its own verification key.

Private collection agencies. The IRS really does assign some overdue accounts to private collectors, but never by surprise: Notice CP40 arrives first, naming the specific agency, and the agency's own letter follows. Both carry a taxpayer authentication number the caller must be able to repeat back to you. Only three agencies hold the contract: CBE Group, Coast Professional, and ConServe. Even with a legitimate collector, payment goes to the United States Treasury through IRS.gov, never to the agency's own account.

Certified mail. A certified letter from the IRS is usually a sign of authenticity. The IRS uses certified delivery when the law requires proof you were notified, typically because a rights clock is starting on a final levy notice or a notice of deficiency. Scammers almost never pay for certified postage.

Crypto letters. Letters 6173 and 6174 read like accusations and arrive out of nowhere, which is why so many recipients assume fraud. Both are real IRS compliance mail, verifiable by their LTR numbers, and 6173 carries a required response.

Common mistakes with a suspicious IRS letter

• Calling the number printed on the letter. Scam letters print a number that routes to the scammer. Call 800-829-1040, the number published on IRS.gov.
• Treating an alarming tone as proof of a fake. Letters 6173 and 6174, CP504 and LT11 are all real and all read harshly. Run the five marks instead.
• Treating a polished letterhead as proof of a real one. The payment channel decides it. Gift cards, wire transfers, crypto or payment apps mean fake, every time.
• Ignoring a letter while you decide. A real notice prints its own response date, and interest and the 0.5% monthly penalty keep adding to a real balance.
• Paying a private collector directly. Even a legitimate agency named on a CP40 is paid only through IRS.gov or to the United States Treasury.
• Shredding a fake. Keep it as evidence and report it to TIGTA and the FTC.

Can you handle this yourself, or does help change the outcome?

If the letter passes the five-point check, matches your online account, and involves a balance you can pay within 180 days, you do not need professional help. Pay through IRS.gov or set up the plan yourself and you are done. The same goes for a fake letter: report it, warn family members (these scams target seniors heavily), and move on.

Experienced help changes the outcome in a narrower set of situations. Multiple unfiled years where the IRS has already built SFR balances that overstate what you really owe. A letter that is several steps into the collection sequence (CP504 or LT11), where appeal rights have deadlines. A disputed amount that requires reconstructing income records. Or identity theft, where someone filed in your name and every notice compounds the mess. In those cases the question is what order to fix things in, and that order changes what you pay. If you are comparing help, our checklist of tax relief scams shows what legitimate firms never promise.

Terms on your letter, decoded

• Notice number (CP / LTR): the code identifying which form letter you received, CP for computer-generated notices and LTR for letters, printed in the right corner.
• United States Treasury: the only payee ever named on a genuine IRS payment; any other payee is a scam marker.
• Taxpayer authentication number: the code on a CP40 notice and the collector's letter that a legitimate private collection agency must repeat to prove it really holds your account.
• Substitute for Return (SFR): a return the IRS builds for a non-filer from gross income records only, with no deductions, usually overstating the true tax.
• TIGTA: the Treasury Inspector General for Tax Administration, the watchdog that investigates IRS impersonation scams (800-366-4484).
• CDP rights: Collection Due Process, the formal appeal right (Form 12153) that attaches to a final levy notice like the LT11.

Official IRS letter questions, answered

The bottom line on telling if an IRS letter is real

A real IRS letter comes by U.S. mail, carries a CP or LTR number in the right corner, names the tax year, masks your SSN, points payment only to the United States Treasury, and matches what your IRS online account shows. Anything that demands gift cards, wire transfers or crypto, threatens arrest, or resists being checked is a fake. Verify through IRS.gov rather than the letter's own phone number, and do it today, because a real notice's printed date controls and the balance behind it keeps growing.

Your next 24 hours

1. Find the notice number, notice date, and tax year on the letter, right corner first. Those three items are what every verification path runs on.
2. Log into (or create) your IRS online account and compare the balance and notices shown there against the letter. While you are at it, pull your last filed return and any 1099s for the year the letter names.
3. Get a free professional read. If the letter matches your account, or if you cannot get the account verified, send us a photo through the 2-minute form or call (888) 825-7779. If the balance is real, interest and penalties are compounding on it right now. If you have been contacted about a fake, TIGTA and the FTC are the official reporting channels, and payments on real balances only ever go through IRS.gov/payments.

This guide is general information, not tax or legal advice for your specific situation. Eligibility for IRS programs depends on individual facts and circumstances; no outcome is guaranteed.

Related guides: IRS IP PIN CP01A: What It Means and How to Use It · IRS Letter 6173 (Crypto): What It Means, Your Deadline, and What to Do · IRS Letter 6174 & 6174-A: What It Means and What to Do · IRS Letter June 2027: What the New Notice Wave Means and What to Do · The IRS Says I Owe More Than I Do: How to Dispute an Incorrect Balance