Fake "NTS e-Notice" Phishing Emails in Korea: How to Spot Them

“[NTS] Mandatory e-Notice registration — legal action if you don't comply…” Have you received an email like this? Recently, phishing (hacking) emails impersonating Korea's National Tax Service (NTS) e-Notice service have been circulating, luring recipients to fake portal (Naver) login pages to steal account credentials. The bottom line: the NTS does not send emails like this. If you know the simple checks below, you can spot a fake in about 30 seconds.

🚨 3-line summary

• The NTS does not send emails about e-Notice registration, tax audits, refunds, or tax-evasion reports.
• The only official NTS sender domains are @nts.go.kr and @hometax.go.kr.
• Verify authenticity via Hometax / Sontax send history or the NTS call center at 126.

🔎 What scam is going around right now

The current scheme uses alarming subject lines such as “Mandatory e-Notice service registration / legal action for non-compliance,” then redirects victims to a fake portal login page (e.g., Naver) to harvest their ID and password. Because AI and domain-spoofing techniques have become more sophisticated, the sender address can look genuine — so never judge by the subject line alone.

📭 Email types the NTS never sends

Treat any email or text on the topics below as suspected impersonation.

Common fake subject line	Tactic
e-Notice mandatory registration / legal action	Fake login lure
Income tax refund notice	Refund bait
Tax audit notice / document submission	Fear/pressure
Tax-evasion report / unpaid tax notice	Urgency
Account (ID / password) verification request	NTS never asks for credentials

✅ A 3-step checklist for every email

Step	Check	What to do
1	Suspicious subject	Before opening: delete + report as spam
2	Unknown sender address	Do not click links or attachments (official: @nts.go.kr / @hometax.go.kr)
3	Request for credentials	Never enter your ID or password (the NTS never asks)

🔐 How to verify a genuine NTS email or text

When in doubt, verify through the channels below — not through the link inside the email.

Channel	Path
Hometax (PC)	My Hometax → My Notifications (mail/notices) → Email·Text send history
Sontax (mobile)	My Hometax → Email·Text send history
NTS call center	☎ 126

💡 The NTS also runs a “sent-message authenticity check” service. If an email is not listed in your send history, it is very likely a fake.

📱 Watch out for text, phone, and social-media scams too

Beyond email, scammers use smishing texts (“You have a refund — claim it via this link,” “Your account will be seized for unpaid tax”) and even KakaoTalk channels or phone calls that ask for an advance payment or personal information under the pretext of a refund. The NTS never requests money or account credentials by email, text, or phone, and never asks you to install an app.

🆘 If you already clicked or suspect a breach

• Immediately change the password you entered (portal / Hometax); change it on any other site that reuses it.
• If you entered bank or card details, ask your bank/card company to suspend the account and monitor for fraud.
• Report the email as spam on your portal (Naver, Kakao, etc.) and delete it.
• If you suffered harm, report to the Korean National Police (Cyber Safety Keeper) — ☎112 (emergency) or ☎182 (help line).
• To confirm an email's authenticity or a refund, call the NTS at ☎126.

Unsure? Type the address yourself — don't click the link

If an "NTS" email looks suspicious, check your send history in Hometax/Sontax or call 126. Please share this with friends and family to help prevent damage.

❓ Frequently Asked Questions

Is the "register for NTS e-Notice" email real or fake?

An email with a subject like “Mandatory e-Notice registration / legal action for non-compliance” that pushes you toward a fake login page is a scam. The NTS does not send such emails. To confirm whether any notice is genuine, check your Hometax / Sontax send history.

What are the official NTS email (sender) domains?

The official NTS sender addresses are @nts.go.kr and @hometax.go.kr. If a message comes from a personal account (gmail, naver, daum, etc.) or mixes in another address, suspect impersonation. Because domains can be spoofed, checking your send history is the most reliable test.

Where do I report a fake NTS email?

Report it as spam on your portal (Naver, Kakao, etc.) and delete it. If you suffered harm, report to the Korean National Police — ☎112 (emergency) or ☎182 (help line). For email authenticity or refund questions, call the NTS at ☎126.

I accidentally entered my ID and password. What now?

Change that portal/Hometax password immediately, and change it anywhere else you reused it. If you also entered bank or card details, ask your bank/card company to suspend the account and monitor for fraud, and consider filing a police report.

📚 Sources

• NTS notice, “Beware of NTS-impersonating phishing emails” (Korea.kr policy briefing)
• Korea Tax News (한국세정신문), NTS e-Notice phishing alert, 2026
• Official NTS sender domains (@nts.go.kr / @hometax.go.kr) and call center 126

※ This article is guidance based on public information as of August 21, 2026. Always confirm whether a specific email is genuine through your Hometax/Sontax send history or the NTS call center (126). Reporting procedures and contact numbers may change.