The short answer: Revenue phishing emails usually promise a tax refund or demand urgent payment. Most link to a fake login page. Revenue says it will never contact you by email, text or phone about a refund or bill. So, protect your practice with four things. First, regular phishing awareness training. Second, email filtering and multi-factor sign-in on Microsoft 365. Third, careful handling of ROS certificates and passwords. Finally, a simple rule: never click a Revenue link, and always go to revenue.ie directly.
This guide is for small and mid-sized accountancy and bookkeeping practices in Meath, Cavan, Westmeath, Louth and Dublin. It focuses on the weeks before the November Pay and File deadline, when scam messages are easiest to believe.
Why Revenue phishing emails peak before Pay and File
The ordinary Pay and File date for 2025 Form 11 returns is 31 October 2026. However, Revenue has extended this to Wednesday 18 November 2026. The extension applies to customers who both pay and file through ROS. For practices, that means weeks of heavy ROS use and a full inbox.
Scammers know this. A message about a refund, an audit or a missed payment feels believable when everyone is working on returns. Busy staff click faster, and that is exactly what Revenue phishing emails rely on.
What Revenue phishing emails and texts look like
Revenue publishes a page on fraudulent emails, SMS and phone calls. It says scam messages often claim you are “due a tax refund”. Others say you must pay a tax bill immediately. In its words, Revenue “will never contact you by email, SMS or phone call” about a refund or bill.
According to the same page, warning signs include:
- A sender using something other than a Revenue email address.
- Poor grammar or spelling.
- An exact amount of money owed.
- Urgency or a deadline to respond.
- Links to pages outside of revenue.ie.
Revenue also warns about recent scam emails claiming you are “due an audit”, with a link to arrange it. These often use official-looking letterheads and logos. Fake texts follow the same pattern as Revenue phishing emails. Revenue’s security guidance says it “will never send unsolicited text messages”.
For a practice, the risk is twofold. On one hand, staff may enter ROS or Microsoft 365 details on a fake page. On the other, clients may forward a scam to you and ask whether their refund is real.
Phishing awareness training and simulations
People are the last line of defence against Revenue phishing emails. The NCSC’s quick guide to phishing notes that attackers exploit social instincts, “such as being helpful and efficient”. That describes most accountancy staff in November.
Short, regular training works better than one long session each year. In particular, show staff real examples from Revenue’s own page. Simulated phishing emails can also help, because they let people practise spotting a fake safely. Afterwards, focus on learning rather than blame, so staff feel comfortable reporting mistakes quickly.
Email filtering and MFA in Microsoft 365
Technology catches many Revenue phishing emails before anyone sees them. Good email filtering checks senders, links and attachments, and quarantines likely scams. Even so, some Revenue phishing emails always get through, so filtering is only one layer.
Multi-factor sign-in is the next layer. If someone enters their Microsoft 365 password on a fake page, a criminal still needs the second factor. Therefore, turn it on for every account, including shared mailboxes and seasonal staff. For more on protecting the wider practice, see our guide to IT security for accountancy practices.
Protecting ROS certificates and passwords
A fake ROS login page is a particular danger, and many Revenue phishing emails link to one. Revenue explains that a ROS digital certificate is an encrypted file saved on your device. It adds that “You need access to the certificate and the password to log on to ROS.”
In practice, that means a few simple habits:
- Keep certificate files on practice-managed devices only.
- Store certificate passwords in a password manager, not in emails or notebooks.
- Give each person their own sub-user certificate, never a shared login.
- Open ROS by typing the address or using a saved bookmark, never from an email link.
Our guide to secure remote working for accountants covers ROS sub-user certificates in more detail.
A simple check-before-you-click process
A written rule makes the right response to scam messages automatic, even on the busiest day. For example, your process could say:
- Never click a link in a message claiming to be from Revenue.
- Go to revenue.ie, ROS or myAccount directly to check for any real correspondence.
- Report suspected Revenue phishing emails to the practice manager or IT provider, then delete them.
- Tell clients that Revenue does not email or text about refunds, and that they can check with you.
- If anyone has entered details, change the password at once and tell your IT provider.
Revenue’s own advice matches this. It says to “manually type www.revenue.ie” into your browser. It also advises anyone who gave Revenue account details to reset their password immediately. Likewise, the NCSC advises reporting phishing, smishing and vishing scams to An Garda Síochána.
Hypothetical example
A week before the ROS deadline, a junior accountant gets an email saying a client is “due a tax refund”. The link opens a page that looks like ROS. Instead of logging in, she types revenue.ie herself and finds nothing waiting. She reports the email, and the practice warns its other staff.
How Sweeney Computer Services helps with Revenue phishing emails
Oliver Sweeney founded the company in 1985. Today, we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. We set up and manage Microsoft 365 security for practices, including multi-factor sign-in and email filtering. In addition, our Gold package includes email security and phishing awareness training for staff.
Payment fraud is a related risk, and our guide to payment redirection fraud covers it. If you’re also reviewing where client files live, read our guide to server or cloud for accountants. Find out more about our IT support for accountants and bookkeepers, cyber security and Microsoft 365 services. To see where your practice stands, try our free Cyber Health Check.
A quick sense-check
Ready for Pay and File?
Book a short call with Michael Sweeney to check your practice’s email security before the deadline.
