A new wave of phishing attacks has been recorded in Ukraine, where cybercriminals are sending emails impersonating the State Tax Service (STS). This was reported by RBK-Ukraine, citing the press service of «Gosspestsvidz». According to the department, fraudsters deliberately use the name and visual attributes of the tax authority to make the message appear official and gain the recipient's trust. The goal of such mailings is to attract the recipient's attention and prompt them to take specific action, most often — clicking on an embedded link.
Mechanics of the Phishing Attack
The key element of the scheme is links embedded in the body of the email. Users are invited to click them «to review information» or «to fulfill certain requirements». In practice, however, these links lead to third-party resources created solely to steal confidential information. Primarily, this concerns personal data and payment details, which criminals subsequently use for unauthorized transactions. It is important to understand that even a perfectly formatted email imitating an official document does not guarantee its authenticity — visual similarity is easily reproduced.
STS Recommendations: How Not to Become a Victim
The State Tax Service urges citizens not to click on suspicious links in emails and to carefully verify any information allegedly coming from government bodies. If a message raises doubts, it is recommended to independently visit the official STS website to clarify the information or contact the service through its official communication channels. The tax authority also emphasizes: never disclose confidential data to strangers or enter it on resources whose authenticity is uncertain. Before opening a link, it is advisable to check the sender's address and the website URL it leads to: typos, unusual domains, or demands to urgently provide personal information are typical markers of a fraud scheme.
Contradictory Data
Cross-referencing sources revealed a discrepancy in the chronology of the event. The main text and the context from RBK-Ukraine tie the warning to the current period — August 2026, when law enforcement agencies were simultaneously exposing related fraud schemes. At the same time, a material from minfin.com.ua describing a mass mailing of phishing emails allegedly from the tax office is dated March 17, 2026. Thus, the same scheme is either recorded as resumed in August or was initially described back in March. The XAB.info editorial office notes this contradiction: the exact start date of the mailing is not consistent in the provided sources, and both versions are presented openly.
Context: A Growing Wave of Fraud Schemes
Phishing in the name of the tax office is not an isolated phenomenon. According to available data, in August, law enforcement exposed call centers that attracted people to fake investment platforms and gained access to their accounts. In the preceding month, the police reported a new scheme targeting education enthusiasts and online courses: users were offered to download a «certificate», but instead of a document, a malicious virus was downloaded to the device. The combination of these episodes indicates a systematic tactic by criminals who combine social engineering, forgery of official documents, and malware to extract financial and personal data from citizens.
