Does DJP ever send legitimate emails about refunds?

DJP may notify you that a refund process has started, but it will always tell you to log in yourself via djponline.pajak.go.id rather than provide a direct login link, and it will never ask for your EFIN or an OTP by email or SMS.

I already clicked the link and entered my NPWP and EFIN. What should I do?

Immediately change your DJP Online password and EFIN if possible, monitor your tax account for unusual activity, and report the incident to your organization's security team or IT helpdesk right away.

How can I tell a fake DJP domain from the real one?

The only official domain is pajak.go.id and its subdomains like djponline.pajak.go.id. Any variation such as an added word, hyphen, or a different extension (.com, .net, .info) is not official.

Why do these scams often appear around tax filing season?

Attackers time these lures to when taxpayers are already thinking about refunds, deadlines, and SPT filing, which makes the fake message feel timely and plausible rather than suspicious.

Government / Tax

The Fake DJP Tax Refund Notice

Attackers impersonate Indonesia's Directorate General of Taxes (DJP) to trick taxpayers into clicking a link for a refund that does not exist. This walkthrough is a fictional, illustrative example built for training.

The scenario

An email or SMS arrives with a DJP-style logo and a subject line like 'Notification of Tax Overpayment: Refund of Rp 2,450,000 Available'. The sender name reads 'DJP Online Notification' but the actual address is something unrelated, such as a free webmail account or a domain that only resembles pajak.go.id.

The message states that the recipient overpaid their annual tax (SPT Tahunan) and is eligible for a refund, or alternatively that a balance is overdue and will be escalated to enforcement action if not settled within 24 to 48 hours. Both versions exist and rely on the same urgency.

A button reads 'Claim Refund Now' or 'Pay Immediately' and links to a page styled to resemble djponline.pajak.go.id, complete with a similar color scheme and government emblem. The URL itself is a lookalike domain, for example pajak-online-refund.com or a shortened link that hides the real destination.

The fake page asks the visitor to log in with their NPWP (tax ID number), EFIN, date of birth, and sometimes a one-time password sent to their phone. Once submitted, the attacker now holds enough information to attempt account takeover or identity-based fraud, and the victim is redirected to the real DJP site so nothing looks wrong.

Red flags to spot

Urgency with a short deadline

Tax authorities do not typically demand action within hours. Artificial time pressure is designed to stop you from thinking or verifying before you act.

Sender domain does not match pajak.go.id

Legitimate DJP communication comes from official .go.id government domains. A similar-looking but different domain is the single clearest sign of impersonation.

Request for NPWP, EFIN, and OTP together

DJP's real systems never ask you to submit your EFIN and a one-time password through an email link. Collecting all three at once gives an attacker everything needed to take over your tax account.

Generic greeting instead of your registered name

Real DJP correspondence tied to your tax file typically references your registered name or NPWP number directly, not a generic 'Dear Taxpayer'.

Refund or penalty amount that feels oddly specific but unverifiable

A precise-looking rupiah figure creates false credibility. There is no way to confirm it is real except by checking your account directly on djponline.pajak.go.id, which the message conveniently discourages.

The lesson

Never click a link in an unsolicited tax message. Instead, open a browser yourself and type djponline.pajak.go.id directly, or use the official DJP mobile app, to check your tax status and any refund or balance due. If you are unsure whether a message is genuine, contact DJP through the official Kring Pajak hotline (1500200) rather than any phone number or link provided in the message itself. Treat any tax communication that pressures you to act within hours, and asks for your EFIN or OTP by link, as fraudulent by default.

These are illustrative examples built for training purposes only, not real messages sent by Claro or any actual organization.

Run this simulation with Claro

Frequently asked questions

DJP may notify you that a refund process has started, but it will always tell you to log in yourself via djponline.pajak.go.id rather than provide a direct login link, and it will never ask for your EFIN or an OTP by email or SMS.

Run these patterns as real simulations

Claro turns each of these lures into a localized, trackable phishing simulation your team can learn from safely.

Request a demo