Phishing Emails Impersonating German Tax Portal ELSTER Circulating Again

Fraudulent emails impersonating Germany's ELSTER electronic tax declaration portal are being used to steal personal information. The scammers trick recipients into downloading malicious PDF files by using official-looking language and false deadlines. Consumer protection agencies warn of telltale signs that can help identify these phishing attempts.

How the Scam Works

Scammers are sending emails impersonating ELSTER (Elektronische Steuererklärung), Germany's official electronic tax declaration portal run by the tax authority. These fraudulent emails contain subject lines such as "Mein ELSTER: Notification regarding data synchronization" and include taxpayer identification numbers. The messages create urgency by setting a false deadline (August 4, 2026) and pressure recipients to download a PDF document via an embedded link. Once victims download the file or provide requested information, criminals gain access to sensitive personal and financial data.

Warning Signs of This Phishing Scam

According to consumer protection agencies, several red flags indicate this is a phishing email:

Impersonal greeting: Generic language that doesn't address you by name
File download request: Attempts to make you download a file through a suspicious link
Lack of specifics: No clear explanation of why you're being contacted or what action is required
Artificial deadline: A false sense of urgency to bypass your critical thinking
Official-sounding language: Deliberately designed to look like a legitimate government notice

Genuine ELSTER communications do not contain these suspicious elements.

How to Protect Yourself

Delete suspicious emails immediately: Do not open attachments or click links; move the email to spam or delete it
Never download files from email links: Even if an email appears official, do not download files from embedded links
Verify through official channels: If uncertain, visit the official ELSTER website or app directly to check for legitimate communications. Never click links within suspicious emails
Guard your personal information: Never provide tax identification numbers, bank account details, passwords, or other sensitive information in response to unsolicited emails
Use strong passwords and authentication: Enable two-factor authentication on your official tax accounts

Where to Report

If you receive a suspected phishing email, you can report it to Germany's consumer protection agency (Verbraucherzentrale) at: phishing@verbraucherzentrale.nrw

Personal information is anonymized before being used to help authorities combat fraud.