PhishPin / Brands Live Phishing Data / Government & public services
Government & public services phishing: which brands are copied the most
28 government & public services brands are tracked in PhishPin's index. Together they have 1,010 hostnames in phishing feeds and 76 newly registered lookalike domains from the last 15 days.
Ranking: most impersonated government & public services
| # | Brand | Share of category hosts | Pressure | Hosts | Lookalikes |
|---|---|---|---|---|---|
| 1 | IRS | 56% | 56 · High | 565 | 2 |
| 2 | E-ZPass | 13% | 42 · Elevated | 130 | 1 |
| 3 | HMRC | 7% | 40 · Elevated | 71 | 2 |
| 4 | Ameli (Assurance Maladie) | 6% | 36 · Elevated | 58 | 1 |
| 5 | Impots.gouv (France) | 4% | 33 · Moderate | 39 | 1 |
| 6 | Australian Taxation Office | 3% | 28 · Moderate | 33 | 0 |
| 7 | GOV.UK | 3% | 27 · Moderate | 28 | 0 |
| 8 | Medicare | 2% | 46 · Elevated | 23 | 40 |
| 9 | Canada Revenue Agency | 2% | 29 · Moderate | 23 | 1 |
| 10 | DVLA | 2% | 30 · Moderate | 19 | 2 |
| 11 | DMV | 1% | 21 · Moderate | 6 | 2 |
| 12 | ELSTER | 0% | 26 · Moderate | 5 | 8 |
| 13 | TV Licensing | 0% | 13 · Low | 4 | 0 |
| 14 | Social Security (SSA) | 0% | 25 · Moderate | 3 | 11 |
| 15 | Services Australia & myGov | 0% | 9 · Low | 2 | 0 |
| 16 | SunPass | 0% | 5 · Low | 1 | 0 |
| 17 | USCIS | 0% | 6 · Low | 0 | 2 |
| 18 | FasTrak | 0% | 4 · Low | 0 | 1 |
| 19 | Global Entry | 0% | 4 · Low | 0 | 1 |
| 20 | NHS | 0% | 4 · Low | 0 | 1 |
| 21 | Aadhaar (UIDAI) | 0% | 0 · Low | 0 | 0 |
| 22 | Belastingdienst | 0% | 0 · Low | 0 | 0 |
| 23 | FAFSA & Federal Student Aid | 0% | 0 · Low | 0 | 0 |
| 24 | HealthCare.gov | 0% | 0 · Low | 0 | 0 |
| 25 | Income Tax Department (India) | 0% | 0 · Low | 0 | 0 |
| 26 | Login.gov | 0% | 0 · Low | 0 | 0 |
| 27 | TSA | 0% | 0 · Low | 0 | 0 |
| 28 | TxTag | 0% | 0 · Low | 0 | 0 |
Common lures against government & public services
- A "refund", "overdue balance" or "unclaimed benefit" message with a link to a fake portal.
- A toll or fine notice by text with a short link and a tight payment deadline.
- A call or message from a "case officer" threatening arrest or deportation unless you pay.
- A request to "verify your identity" for benefits, student aid or a travel programme.
Red flags
- Government agencies do not demand payment by gift card, crypto or text link.
- Official sites end in .gov; lookalikes use .com, .xyz, .top or words like "refund" and "pay".
- The first contact is a text or an unsolicited call rather than a letter or your own online account.
If you already clicked or entered details
Do not pay. If you shared your SSN or ID, place a fraud alert or credit freeze, and report it at reportfraud.ftc.gov and identitytheft.gov. Reach the agency through its official .gov website.
Is your government or public-service agency being copied?
Attackers copy any brand whose customers log in or pay. Enter your domain for a free check of email-spoofing gaps, registered lookalikes and feed listings.
Talk to us about takedownsQuestions
Which government & public services brands are impersonated the most?
IRS leads with 565 hostnames in phishing feeds, followed by E-ZPass (130) as of 1 Nov 2026.
How can I spot phishing that targets government & public services?
Government agencies do not demand payment by gift card, crypto or text link. Official sites end in .gov; lookalikes use .com, .xyz, .top or words like "refund" and "pay". The first contact is a text or an unsolicited call rather than a letter or your own online account.
What should I do if I fall for a fake government or public-service agency page?
Do not pay. If you shared your SSN or ID, place a fraud alert or credit freeze, and report it at reportfraud.ftc.gov and identitytheft.gov. Reach the agency through its official .gov website.