{"id":4813,"date":"2026-11-13T23:44:51","date_gmt":"2026-11-13T21:44:51","guid":{"rendered":"https:\/\/audit-mk.com.ua\/uk\/lyst-vid-dps-pro-podatkovyi-borh-fishynh\/"},"modified":"2026-11-13T23:44:51","modified_gmt":"2026-11-13T21:44:51","slug":"lyst-vid-dps-pro-podatkovyi-borh-fishynh","status":"publish","type":"post","link":"https:\/\/audit-mk.com.ua\/en\/lyst-vid-dps-pro-podatkovyi-borh-fishynh\/","title":{"rendered":"Email from the Ukrainian tax service about a tax debt: how to spot phishing"},"content":{"rendered":"

<\/p>\n

An email from the Ukrainian State Tax Service (STS) about a tax debt that arrives in an ordinary inbox with a .pdf, .zip or .exe attachment is most likely phishing. On 4 November 2026 the STS warned of a mass mailing of such emails carrying malware. Genuine debt documents are posted in the taxpayer\u2019s Electronic Cabinet or sent by registered mail (Article 42 of the Tax Code of Ukraine).<\/p>\n

These emails usually land with the accountant, whose computer also holds the qualified e-signature (QES) keys, the online banking client and access to the tax cabinet. One careless click can cost far more than it seems. Below we explain how to tell a fake from a real tax demand and what to do in the company this week.<\/p>\n

What changed: the STS warning of 4 November 2026<\/h2>\n

According to the STS, taxpayers are receiving large numbers of emails supposedly from the tax service about an accrued tax debt (STS notice<\/a>). They are sent from third-party addresses, and the attachments or links hide software that gives remote access to the computer. The STS lists typical attachments: .pdf, .zip, .rar, as well as .exe and .scr files.<\/p>\n

The tax service reminds that its official addresses use the @tax.gov.ua domain, with post@tax.gov.ua as the general mailbox. A message from any other domain is a clear sign of a fake. We would add that fraudsters can spoof the sender address too, so even the \u201cright\u201d domain proves nothing. There is only one proof: the document is in your Electronic Cabinet.<\/p>\n

How the STS actually sends a tax demand<\/h2>\n

The procedure is set out in the Tax Code. Under paragraph 42.1, STS documents on taxes, audits and reconciliations must be in writing, signed and displayed in the electronic cabinet. Under paragraph 59.1, a tax demand for a debt is sent in the same way as a tax assessment notice.<\/p>\n

\n\n\n\n\n\n\n\n\n
Sign<\/th>\nGenuine STS document<\/th>\nPhishing email<\/th>\n<\/tr>\n<\/thead>\n
Channel<\/td>\nElectronic Cabinet (para. 42.4 TCU), or registered mail with acknowledgement of receipt, or hand delivery (para. 42.5 TCU)<\/td>\nOrdinary email to a shared or personal mailbox<\/td>\n<\/tr>\n
Where to check<\/td>\nThe document and its delivery receipt are in the Electronic Cabinet<\/td>\nNothing in the cabinet<\/td>\n<\/tr>\n
Attachment<\/td>\nThe document is signed and viewable in the cabinet<\/td>\n.zip or .rar archives, .exe or .scr files, or a \u201cpdf\u201d with a download link<\/td>\n<\/tr>\n
Tone<\/td>\nDetails, amount, legal basis, deadlines under the Tax Code<\/td>\nPressure: \u201curgent\u201d, \u201cyour accounts will be frozen today\u201d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

One more detail from paragraph 59.1: if the total debt does not exceed 180 tax-free minimum incomes, no tax demand is sent at all. So an email about a \u201cdebt\u201d of a few hundred hryvnias asking you to open an archive should raise a double red flag.<\/p>\n

Who is affected<\/h2>\n