1
Authority
We are trained from childhood to comply with officials. A seal, a case number and formal language trigger that reflex.
How it showed up hereIRS branding, a "Compliance Division" signature, a CP2000 notice number.
Government Impersonation
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How fake notices from the IRS, regulators, courts and law enforcement use authority and fear to rush you into acting.
What this is about
Fake messages dressed up as an official government notice — a tax problem, a compliance deadline, a legal matter — are one of the most common scams. They look serious on purpose.
Government impersonation works because almost nobody wants to argue with the IRS, a state regulator, or a court. Attackers borrow that authority to make you act before you think. At Charitybuzz, these messages often target the company itself (registrations, tax filings, customs holds on auction lots) as well as you personally.
$798M
reported lost to government impersonation in 2025
32,424
government impersonation complaints filed with the FBI in 2025
~2×
jump in losses from 2024 ($406M)
Take the message apart
This is a typical fake government notice. Click on every detail that should stop you. There are eight.
0 of 8 red flags found Click anything in this message that looks suspicious.
FINAL NOTICE: Unreported 1099-K income — Case #IRS-2025-88417
Internal Revenue Service <notice@irs-gov-taxcenter.com>
Tue 9:12 AM
to me ▾
Dear Taxpayer,
Our records indicate a discrepancy between income reported by third-party payment processors and your most recent filing. This is your final notice before enforcement action begins.
You must respond within 48 hours to avoid penalties of up to $50,000 and referral to federal law enforcement.
To protect your identity, the secure portal will ask you to confirm your Social Security number and the bank account linked to your return.
View Case & Respond
Compliance Division
Internal Revenue Service
U.S. Department of the Treasury
HTML Notice_CP2000_88417.html
4 KB
4 KB
Link goes to:—
Click anything in this message that looks suspicious.
Why government scams work on smart people
These messages don't rely on you being careless. They rely on four predictable human reactions:
2
Fear
Threats of fines, arrest or losing something important push the brain into fight-or-flight, where careful checking switches off.
How it showed up here"Penalties of up to $50,000 and referral to federal law enforcement."
3
Urgency
A short deadline makes verifying feel like a risk in itself — "what if I miss it while I'm checking?"
How it showed up here"Respond within 48 hours."
4
Plausibility
Attackers mention things that really exist and that you half-remember — 1099-K forms, registrations, customs duties.
How it showed up hereA 1099-K "discrepancy" is believable for anyone who sells online or receives payments.
How this lands at Charitybuzz
Charitybuzz is a company that helps charities raise money, not a charity itself, so government lures aimed at us look different from the ones aimed at consumers or at nonprofits. Three we should expect:
Finance / Legal
The "lapsed registration" fee
An email "from a state attorney general's office" says a business or fundraising-related registration has lapsed and a $1,450 late fee must be paid today through a payment link, or the company's activity will be suspended.
The tell
Regulators send formal notices with reference numbers you can look up, and they do not collect fees through emailed links with same-day deadlines.The right move
Do not pay or click. Forward it to Legal/Finance and report it. Legal checks directly with the state agency whether any registration is actually due.Fulfillment / Operations
Customs is "holding" a lot
A text and email claiming to be from U.S. Customs and Border Protection say an international package for an auction winner is held, and a duty of $86.40 must be paid via the link within 24 hours or the item will be destroyed.
The tell
Customs duties are billed through the carrier or broker you actually used, not via a random link. "Will be destroyed" is a pressure tactic.The right move
Look up the shipment in the carrier account you already use. If there is a real hold, it will be there.Customer Experience
The "complaint filed against you" attachment
A message styled as a Better Business Bureau or consumer-protection complaint says a bidder has filed a formal complaint about Charitybuzz and asks you to open the attached "case file" to respond within 3 days.
The tell
The attachment is a .zip or .html, and the sender domain isn't the organization's real one. Complaint lures are a classic way to deliver malware to support teams.The right move
Don't open it. Report it, and if you want to check for a real complaint, sign in to the organization's site from a bookmark or search result you typed.Red flags in government messages
Quick check: for each sender address or link below, decide whether it is a red flag or looks fine.
0 of 6 answered
notice@irs.govThe IRS sends from irs.gov, a .gov domain. (Even so, it would almost never start a conversation by email.)
support@irs-gov-help.comAdding "gov" to a name does not make it a government domain. This is a .com that anyone can register.
https://www.irs.gov/paymentsThe part before the first single "/" is www.irs.gov, which is the real site.
https://irs.gov.account-verify.net/payRead the domain right-to-left from the first "/": the real owner is account-verify.net. "irs.gov" here is just a sub-name the attacker chose.
"IRS Notices" <irs.notices.team@gmail.com>A government agency does not email from a free Gmail address. The display name is easy to fake; the address is what matters.
Pay your balance today with gift cards or a wire transferNo government agency takes gift cards, cryptocurrency or wire transfers as payment. This is a scam on its own.
First contact is an email or text
The IRS and most agencies start with postal mail. An unexpected email about a "case" is suspicious on its own.
The domain isn't .gov
U.S. federal and state agencies use .gov. Look-alikes such as irs-gov-help.com, ssa-online.net or gov-notice.org are fake.
Threats of arrest, deportation or seizure
Real agencies explain the process and your rights. They don't threaten jail by email.
Payment by gift card, crypto, wire or app
No government agency takes payment in gift cards, cryptocurrency or peer-to-peer apps. That alone makes it a scam.
Asking you to "confirm" what they already have
SSN, date of birth, bank account — agencies have these. Requests to re-enter them are data harvesting.
Hours, not weeks
Deadlines of 24–72 hours are designed to stop you from verifying.
Secrecy
"Do not discuss this case with anyone" is how attackers stop a colleague from pointing out the scam.
Odd attachments
.html, .zip, .iso or macro-enabled Office files are almost never how official notices arrive.
Real government contact
- Usually begins with a letter by postal mail
- Comes from a .gov domain or a secure portal you already use
- Gives weeks to respond and explains appeal rights
- Can be verified by calling the number on the agency's own website
- Never demands gift cards, crypto or wire transfers
Government phishing
- Arrives out of the blue by email or text
- Look-alike domain with "gov" somewhere in the name
- Demands action within hours
- Only gives a phone number or link inside the message
- Wants payment or identity data right now
How to check if a notice is real
Stop. Don't click, reply or call the number in the message
Every contact detail inside the message could be controlled by the attacker.
Go to the agency yourself
Type the address (irs.gov, ssa.gov, cbp.gov, your state AG's site) or use a bookmark. Sign in to any account you have there and look for the notice.
Call a number you found independently
For example the IRS at 800-829-1040 or the FDIC at 1-877-ASK-FDIC, taken from their official websites — never from the message.
If it's about Charitybuzz, hand it to the owner
Registrations and tax matters go to Legal/Finance; shipments go to Fulfillment. They know what's really pending.
Report it
Use Gmail's Report phishing, and let the security team know. IRS-themed phishing can also be forwarded to phishing@irs.gov.
If you clicked — or entered something
Shared your SSN or bank details? Protect your identity today
Place a free fraud alert or credit freeze with Equifax, Experian and TransUnion, tell your bank, and use IdentityTheft.gov (the FTC's official site) for a step-by-step recovery plan.
Paid a "fee"? Call the bank or card issuer right now
Card payments and some transfers can be disputed or recalled, but only if you move fast. If it was a company payment, tell Finance immediately.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email jsand@charitybuzz.com with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT (jsand@charitybuzz.com) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Government agencies almost always contact you first by postal mail — not by surprise email or text.
- Check the domain: real U.S. agencies use .gov. Anything else wearing a government name is fake.
- Threats, tiny deadlines and secrecy are signs of a scam, not of a real legal process.
- No agency accepts gift cards, crypto, wire transfers or payment apps.
- Verify by going to the agency yourself; hand company matters to Legal, Finance or Fulfillment.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Government agencies almost always contact you first by postal mail — not by surprise email or text.
- Check the domain: real U.S. agencies use .gov. Anything else wearing a government name is fake.
- Threats, tiny deadlines and secrecy are signs of a scam, not of a real legal process.
- No agency accepts gift cards, crypto, wire transfers or payment apps.
- Verify by going to the agency yourself; hand company matters to Legal, Finance or Fulfillment.