IRS warns Americans to beware of dangerous new scams this tax season

The IRS published its 'Dirty Dozen' list for the 2026 filing season, identifying 12 major tax scams — including AI-enabled phone impersonations, phishing/text scams with QR codes, identity-theft targeting IRS Online Accounts, fake charities, and abusive claims on Form 2439. The agency reported over 600 social-media impersonators in FY2025 and warned that increased use of AI, spear-phishing, ghost preparers, overstated withholding schemes and OIC 'mills' could lead to refund delays, enforcement actions and potential civil/criminal penalties for taxpayers and tax professionals.

Analysis

The immediate commercial lever from a sustained scam environment is not broad sales growth but reallocation within enterprise security budgets: identity, email-gateways, and voice/telephony authentication become higher priority versus generalized EDR spend. Expect a measurable pipeline reweighting — 2–5% sequential uplift in RFPs and pilot starts for identity/telephony-focused vendors over the next 2 quarters, translating to revenue recognition uplift 3–9 months later as pilots convert.

Telecom and infrastructure providers implementing cryptographic caller verification (STIR/SHAKEN-style upgrades) and downstream vendors that can monetize attestations stand to capture recurring revenue streams; the regulatory tailwind for mandated caller-auth could crystallize within 12–24 months, creating durable TAM expansion. Conversely, broadly valued endpoint/signal plays without clear identity or voice-auth roadmaps face multiple-quarter growth visibility compression as buyers reprioritize spend.

On the consumer side, legacy credit-monitoring and tax-prep platforms can monetize trust by bundling enhanced identity protection and paid verification services, but legal/regulatory friction (privacy enforcement, fee caps) creates a two-sided risk: modest near-term ARPU upside versus meaningful fine/exposure risk over 12–36 months. The prudent trade is event-driven: capture the filing-season uplift with time-limited instruments while avoiding long-duration exposure to regulatory re-pricing or failed product rollouts.

Key Decisions for Investors

• Long OKTA (Okta) — buy a 6–9 month call spread (buy ATM, sell +20–25% OTM) to play accelerated MFA/identity adoption. Thesis: 30–60% upside to the spread if pilot-to-production conversion accelerates; downside limited to premium (~100% loss of premium) if macro pullback or integration misses.
• Long PANW (Palo Alto Networks) — add to core position or buy 9–12 month calls to capture reweighted enterprise budgets toward network/ingress security tied to identity. Expect a steady 5–10% upside if renewal + cross-sell rates tick up; risk: valuation compression if macro IT spend softens.
• Long EFX (Equifax) or TRU (TransUnion) — buy 3–6 month calls or small outright positions to capture seasonal uptick in paid monitoring/subscription conversions. Reward: 10–25% near-term pop if churn falls and conversion rates rise by a few points; risk: regulatory/legal headlines could offset gains, so size accordingly.
• Pair trade (selective): Long INTU (Intuit) vs short ZS (Zscaler) — size as a modest tactical position ahead of filing season. Rationale: Intuit can monetize trust and verification features quickly; Zscaler’s valuation is tied to broader cloud security cadence and may underperform if buyers favor identity-native solutions. Target 3–6 month horizon; unwind on relative 10–15% movement or upon clear change in RFP trends.