Fraudsters improve their schemes: taxpayers receive fake letters supposedly from the State Tax Service with "demands" in criminal cases

Press service of the State Tax Service of Ukraine, published 08 July 2026 at 17:07 Chapter: News

Fraudsters continue to use name of the State Tax Service of Ukraine to distribute dangerous electronic messages. In a new wave of fake mailings, payers receive letters from attackers with alleged “official demand from the State Tax Service within framework of criminal proceedings”.

Subject of such messages may contain information about alleged “requirements to provide materials in case of a criminal violation under Article 212 of the Criminal Code of Ukraine”.

It should be emphasized that: such letters have no relation to the Tax Service.

Fake messages come from the third-party email addresses, in particular from addresses that do not belong to official domain of the State Tax Service. One such example is address reply@okservice.shop.

Using similar messages, attackers try to force users to open attachments or click on links.

The main danger of such emails is in attached files. Most often, they can have extensions .pdf, .zip, .rar, .exe, .scr. Under the guise of documents or archives, they can contain malicious software that allows unauthorized access to the user’s computer.

Tax Service’s email addresses have domain @tax.gov.ua, and official email is post@tax.gov.ua. If the message comes from different domain, this is a clear sign of forgery.

To avoid becoming a victim of cybercriminals, taxpayers should follow simple security rules:

- do not open suspicious attachments and files received from unknown senders;

- carefully check email address from which the letter was sent;

- do not click on dubious links;

- do not trust even familiar contacts without additional verification.

Taxpayers are urged to be careful and remember: Tax Service does not send official documents from unofficial email addresses. If you receive suspicious messages, do not open attachments or follow instructions in such emails.