The core check: look at the sender's domain
Genuine LHDN (HASiL) correspondence comes only from an @hasil.gov.my address. If the email is from a Gmail, Yahoo, Outlook or any other consumer or unfamiliar domain, it is not from LHDN — no exceptions. This single check catches most of the fake emails described below, before you need to think about anything else in the message.
Pattern 1 — fake arrears / tax-owed demands
A common scam email claims you owe tax arrears and instructs you to pay into a bank account that has nothing to do with LHDN. LHDN's own fraud-alert page documents this pattern. Real tax owed to LHDN is never settled by transferring money to a personal account named in an email — payments go through LHDN's own official channels.
Pattern 2 — fake audit notices
Another documented pattern impersonates an LHDN audit or investigation, demanding an urgent extra payment to "resolve" a suspected offence. One example that has circulated is a phishing email headed "PEMERIKSAAN CUKAI: DISYAKI MENGELUARKAN INVOIS PALSU" ("Tax Audit: Suspected of Issuing Fake Invoices") — sent from a private or Gmail address, not @hasil.gov.my. A genuine audit does not arrive as an unsolicited email demanding payment.
Pattern 3 — the "safe account" instruction
In this pattern, someone impersonating an LHDN officer accuses the victim of a tax offence or money-laundering, then instructs them to transfer their money into a "safe account" — supposedly to protect it while the matter is "investigated". This is never a real LHDN procedure. No genuine LHDN process ever asks you to move your own money into any account, "safe" or otherwise, in response to an accusation.
Pattern 4 — fake refund emails
The last documented pattern offers a tax refund and asks you to click a link and enter your banking credentials to "claim" it. LHDN does not issue refunds this way. Do not click the link or enter any banking details; go to HASiL's own channels instead.
If you're not sure
Don't reply to the email or call any number written inside it. Instead, contact HASiL directly through its Contact Centre (03-8911 1000), live chat, or customer feedback form, or visit a nearby LHDN office, and ask them to confirm whether the notice is genuine.
FAQ
The sender address really does end in @hasil.gov.my — could it still be fake?
It's far less likely, but treat any email demanding payment to a personal account, a "safe account", or containing a suspicious link with the same caution regardless of the sender domain, and verify directly with HASiL's Contact Centre before acting.
I already clicked a link or entered my banking details — what now?
Contact your bank's fraud hotline immediately to flag your account, then follow the steps in our first 24 hours guide. If you also shared a TAC/OTP, see I gave my TAC/OTP to someone.
Does LHDN ever contact taxpayers by phone or SMS instead of email?
This page covers only the documented email fraud pattern on LHDN's own fraud-alert page. For any contact by phone or SMS claiming to be LHDN, apply the same rule: don't act on payment instructions or links from the message itself — verify independently through HASiL's official Contact Centre first.