Email from the Ukrainian tax service about a tax debt: how to spot phishing
An email from the Ukrainian State Tax Service (STS) about a tax debt that arrives in an ordinary inbox with a .pdf, .zip or .exe attachment is most likely phishing. On 4 November 2026 the STS warned of a mass mailing of such emails carrying malware. Genuine debt documents are posted in the taxpayer’s Electronic Cabinet or sent by registered mail (Article 42 of the Tax Code of Ukraine).
These emails usually land with the accountant, whose computer also holds the qualified e-signature (QES) keys, the online banking client and access to the tax cabinet. One careless click can cost far more than it seems. Below we explain how to tell a fake from a real tax demand and what to do in the company this week.
What changed: the STS warning of 4 November 2026
According to the STS, taxpayers are receiving large numbers of emails supposedly from the tax service about an accrued tax debt (STS notice). They are sent from third-party addresses, and the attachments or links hide software that gives remote access to the computer. The STS lists typical attachments: .pdf, .zip, .rar, as well as .exe and .scr files.
The tax service reminds that its official addresses use the @tax.gov.ua domain, with post@tax.gov.ua as the general mailbox. A message from any other domain is a clear sign of a fake. We would add that fraudsters can spoof the sender address too, so even the “right” domain proves nothing. There is only one proof: the document is in your Electronic Cabinet.
How the STS actually sends a tax demand
The procedure is set out in the Tax Code. Under paragraph 42.1, STS documents on taxes, audits and reconciliations must be in writing, signed and displayed in the electronic cabinet. Under paragraph 59.1, a tax demand for a debt is sent in the same way as a tax assessment notice.
| Sign | Genuine STS document | Phishing email |
|---|---|---|
| Channel | Electronic Cabinet (para. 42.4 TCU), or registered mail with acknowledgement of receipt, or hand delivery (para. 42.5 TCU) | Ordinary email to a shared or personal mailbox |
| Where to check | The document and its delivery receipt are in the Electronic Cabinet | Nothing in the cabinet |
| Attachment | The document is signed and viewable in the cabinet | .zip or .rar archives, .exe or .scr files, or a “pdf” with a download link |
| Tone | Details, amount, legal basis, deadlines under the Tax Code | Pressure: “urgent”, “your accounts will be frozen today” |
One more detail from paragraph 59.1: if the total debt does not exceed 180 tax-free minimum incomes, no tax demand is sent at all. So an email about a “debt” of a few hundred hryvnias asking you to open an archive should raise a double red flag.
Who is affected
- LLCs and private companies where the accountant uses the director’s QES and the banking client on the same computer;
- NGOs and charitable foundations: compromised access to a project account is a problem not only with the tax office but also with the donor;
- representative offices of foreign companies where one office manager opens all Ukrainian-language mail;
- companies with outsourced accounting: phishing can reach both the director and the contractor.
What to do and by when
There is one deadline: now, while the mailing is still going on. Here is a short plan for the director and the chief accountant.
- Check whether the company has applied to receive documents via the Electronic Cabinet. If so, every STS demand arrives there, and a “debt” email can be checked in two minutes.
- Agree a team rule: any email about a debt, fine or audit is first checked against the cabinet, and attachments are not opened.
- Keep QES keys on a protected token rather than in files on the desktop, and do not leave the token permanently plugged in.
- Turn on filtering of .exe, .scr and password-protected archives on the mail server.
- If the attachment has already been opened: disconnect the computer from the network, change cabinet and bank passwords from another device, contact your trust service provider to block the QES, and notify the bank.
Common mistakes
- Trusting the domain. A tax.gov.ua address in the “From” field does not mean the email is from the STS. Check the document in the cabinet.
- “I’ll just open it to see the amount.” That is exactly the step that launches the malware.
- Checking from the same computer. If the attachment is already open, change passwords from a different device.
- Keeping quiet. An accountant afraid to admit the click gives the attacker several days of bank access. A “report at once, no blame” rule works better than bans.
A similar need to check the cabinet arose after the outage in late October; what to reconcile then is covered in our article on the STS e-cabinet outage. November deadlines are collected in our accounting calendar.
Frequently asked questions
How can I check whether an STS email about a tax debt is genuine?
Log in to the Electronic Cabinet separately, not via a link in the email, and check incoming documents and the budget settlement status. A genuine tax demand is displayed in the cabinet under paragraph 42.1 of the Tax Code.
Does the STS send tax demands by email?
No. Documents are sent via the Electronic Cabinet if the taxpayer has applied for this, or by registered mail with acknowledgement of receipt, or delivered by hand (paragraphs 42.4 and 42.5 of the Tax Code).
What should we do if the accountant has already opened the attachment?
Disconnect the computer from the network, change cabinet and bank passwords from another device, contact the trust service provider to block the QES, notify the bank and review recent payments.
How we help
As part of our accounting outsourcing we work in the client’s Electronic Cabinet every day, reconcile budget settlements and respond to genuine STS demands on time. Fees start from UAH 5,000 per month for an LLC, and the calculator shows the exact amount. If you have received a suspicious email or demand, contact us.
Prepared by the MK Audit team