Chapter 24: Authorities and Tax Refunds: Impersonating Government Institutions

In the complex relationship between the citizen and the state, two extreme emotions rule supreme: fear and hope. Fear arises when a letter with the state emblem lands in the mailbox, announcing a debt, a fine, or an audit; hope is ignited when that same envelope—or in the 21st century, that same text message—announces a tax refund, a grant, or a credit balance waiting for us. These emotions are the fuel that powers one of the most well-oiled and effective fraud industries operating today in Israel.

While previous chapters dealt with scams exploiting our consumer habits or the anticipation of a package from abroad, here we enter entirely different territory. Here, the scammers do not impersonate a courier from a delivery company or a customer service representative of a credit card company. They impersonate the sovereign. They don the mantle of authority of the Tax Authority, the National Insurance Institute, or the Ministry of Justice. They use legal terminology, national symbols, and familiar logos to paralyze our critical faculties. After all, who among us would want to argue with a message that says, "Your debt to the Income Tax Authority requires immediate attention," and who among us would not be happy to click on a link promising "A tax refund of 4,200 NIS is waiting in your account"?

The Psychology of Authority: Why Do We Fall for This Specifically?

Scams impersonating state authorities do not operate in a vacuum. They rely on "Authority Bias"—an ingrained human tendency to comply with figures perceived as possessing legal power. When we receive a message from the "Tax Authority," our brain goes into high alert. For most law-abiding citizens, an encounter with tax authorities is a stress-inducing event. Scammers know this and exploit that pressure to make us act quickly, without thinking, and without checking the credibility of the address from which the message was sent.

Beyond fear, there is the element of "free money." Tax refunds are perceived by the Israeli public as a kind of small lottery win—money that was ours, taken from us, and is now returning by magic. This momentary euphoria blurs our natural caution. In such a state, the critical barrier that prevents us from handing over credit card details or bank access codes simply evaporates.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

Yair, a 42-year-old freelance architect from Ra'anana, was sitting in his office late at night, struggling with submission plans for the municipality. His phone, lying on the table, vibrated. A new SMS message. The sender appeared as "IL-TAX".

"Important notice from the Tax Authority: Based on the calculations of the last tax year, it has been found that you are entitled to a refund of 4,380 NIS. To receive the refund directly to your bank account, please complete your contact details via the secure link: https://mof-gov-il.online/refund"

"Finally, something going smoothly," Yair muttered to himself. As a freelancer, he knew that dealing with the Income Tax Authority is usually a gauntlet of bureaucratic suffering. The fact that the message arrived precisely during a period when he felt the financial pressure of advance tax payments seemed like a stroke of fate.

He clicked the link. The page that opened looked perfect. The State of Israel logo in the top corner, the familiar blue and white colors of government websites, and even the current Minister of Finance's photo in the bottom corner. The header was "Government Payment Portal – Tax Refund Application Form." Yair was asked to enter his ID number, date of birth, and phone number. Afterwards, the next screen appeared: "To verify your identity and transfer the payment, please enter the credit card details to which the credit will be applied."

For a brief moment, a thought crossed Yair's mind: Why do they need a credit card to refund money? Aren't they supposed to use the bank account? But then he saw a small note at the bottom of the screen: "According to Bank of Israel regulations, refunds up to 5,000 NIS are processed via immediate credit to the customer's credit card." This sounded logical, professional, and above all—profitable.

He entered the details. The card number, expiration date, and the three digits on the back of the card (CVV). After clicking "Confirm," a loading screen appeared: "Processing data... Please wait." Within seconds, another SMS message arrived, this time from his bank: "Your verification code for the transaction is 8842." On the fraudulent site, a box appeared: "Enter the code sent to your mobile to confirm the transfer of funds to your account."

Yair entered the code. The site thanked him and announced that the money would appear in his account within 3 business days. He closed the tab and returned to his architectural plans, feeling a bit lighter in his heart. He did not know that at those very seconds, in a distant place, automated software was using his details and the code he provided to set up his credit card in a foreign digital wallet and make a purchase of luxury watches on a foreign website for 12,000 NIS.

The discovery came only the next morning. Yair received an alert from his credit card company about "unusual activity." When he called the call center, the representative asked if he was currently in Dubai purchasing electronics. "Absolutely not," Yair shouted, "I am in Ra'anana! And besides, I was supposed to receive a tax refund, not pay!"

The silence from the representative on the other side of the line was the harshest answer of all. "Sir," she said quietly, "the Tax Authority never requests credit card details via SMS to provide refunds. It appears you have fallen victim to a phishing scam."

Anatomy of a Scam: From an Innocent Link to Emptying the Account

Yair's story is a classic of modern authority fraud. To understand how to protect ourselves, we must break this mechanism down into components. The fraud consists of three critical stages:

1. The Bait Stage: Impersonating Authority

Scammers use SMS distribution services that allow them to change the Sender ID. Instead of a phone number, a name appears such as "Gov-IL," "Tax-Authority," or "Israel-Post." This is the first step in building trust. The language is always formal, urgent, and sometimes veiled in implied threats (for example: "Failure to settle the debt will lead to foreclosure").

2. The Forgery Stage: The Duplicate Site

The link leads to a site that is an almost perfect copy of official government websites. Scammers use URLs (domains) that look very similar to the original. Instead of gov.il, they will use gov-il.org, il-tax.online, or israel-refund.com. The human eye tends to skip over these small changes, especially when the page itself looks credible.

3. The Bypass Stage: The OTP (One Time Password)

This is the most sophisticated part. Banks and credit card companies have implemented security mechanisms where any unusual action requires a code sent to the mobile device. Scammers have learned to "bridge" this gap. While the victim enters their details on the fraudulent site, the scammer enters them on a real site (such as purchasing a product or setting up a digital wallet). When the bank sends the code to the victim, the victim thinks they are confirming the *receipt* of money, while in reality, they are confirming its *expenditure*. This is the moment the fraud turns from an attempted breach into an act where the customer, unknowingly, "authorizes" the theft.

Legal Liability: Where is the Line Between Negligence and Fraud?

In cases where a person discovers they have fallen victim to such a theft and seeks to examine their options, the first question that arises is: "Who will return my money?" The answer is not simple, and it depends on the legal interpretation of the circumstances. The primary regulatory framework in Israel is the Payment Services Law, 2019.

The law is intended to protect the consumer in cases of unauthorized use of payment means. Section 20 of the law states that if unauthorized use is made of a payment instrument (such as a credit card), the customer is not liable for the damage, unless certain conditions are met. This is where the legal battle begins.

Is This "Gross Negligence"?

Credit card companies tend to argue that the provision of the verification code (OTP) by the customer constitutes "gross negligence." The argument is that the message from the bank explicitly states: "Do not share this code with anyone." If the customer entered the code on the site, the company may argue that they have lost the protection of the law.

The Bank's Duty of Care

In the Israeli legal system, there is recognition of an increased duty of care of banks toward their customers. This is a professional and social obligation. Examining liability depends on questions such as: Were there "red flags" in the bank's systems? Was a transfer made to a beneficiary in a high-risk country? Was the pattern extremely anomalous to the customer's typical conduct? In certain cases, liability of the payment institution may arise if it did not act to stop an obviously suspicious transaction, even if the customer provided the code.

Litigation Against Powerful Entities: The Procedural Aspect

It is important to understand—credit card companies and banks are not quick to admit liability. Their policy may include rejecting the initial appeal on the grounds that the customer provided the details of their own volition. This is where legal representation comes in. The goal is to examine whether it can be proven that this was not "gross negligence," but rather falling into a professional trap designed to mislead even the most cautious person.

Each case must be examined on its own merits. Did the message contain threats? Was it under time pressure? Did the fraudulent site use fake security certificates? Every such detail may be significant in building the legal argument for considering the possibility of recovering the funds. However, it must be stated honestly: recovering funds in such frauds is not guaranteed. It requires an in-depth examination of the circumstances, an understanding of the Payment Services Law, and sometimes the readiness to manage legal proceedings.

Warning Signs: How to Identify That the State Is Not Really Talking to You

In order to avoid the financial damage and distress involved in these cases, here are warning signs that may indicate authority fraud:

• Requesting a credit card for a refund: The Tax Authority, National Insurance Institute, and other government ministries will never ask for your credit card number in order to transfer money to you. Government refunds are typically processed to the bank account updated in their systems.
• Suspicious Domain (website address): Government websites in Israel always end in .gov.il. Any other suffix (such as .com, .org, .net, .online) attached to the word "gov" is a highly suspicious sign.
• Language and Pressure: Official messages tend to be matter-of-fact. If the message uses dramatic language ("Last chance!", "Immediate action required!") or language with grammatical errors, extreme caution should be exercised.
• Verification Code (OTP): If you received an SMS code from the bank while you are on a site presenting itself as "government-related," this requires an immediate halt to the activity. The bank will usually not send a code for the purpose of receiving funds.

What to Do If You Have Fallen Victim?

If a suspicion arises that details were entered on a fraudulent site, it is recommended to act quickly:

1. Immediate Blocking: Contact the credit card company or bank immediately to cancel the card or freeze the account.
2. Documentation: It is worth saving screenshots of the SMS message, the website, and the unauthorized charges.
3. Filing a Police Report: A report can be filed online via the Israel Police website. This action may be required later when dealing with financial institutions.
4. Official Appeal to the Credit Card Company: It is recommended to file an appeal detailing the event and examining the possibility of recovering funds under the Payment Services Law.
5. Changing Passwords: It is recommended to change passwords on relevant accounts if identifying details were entered.

Legal Summary

The struggle for fund recovery in cases of fraud depends largely on the legal interpretation of the parties' conduct. While credit card companies may raise arguments regarding the customer's negligence, reality shows that these are often highly sophisticated social engineering methods. The law in Israel grants certain protections to the consumer, out of an understanding of the power imbalances against banking and technological systems, but this protection is not absolute and depends on the circumstances of each case.

Awareness is the primary tool for prevention. The state may sometimes act in a bureaucratic manner, but procedures for tax refunds are generally not executed by requesting credit card details via a link sent in an SMS. In the digital world, it is important to maintain vigilance and healthy suspicion toward offers for quick and unexpected receipt of money.