I went onto the IRS website today to make a payment. In the security part of the address bar it is written Bank of America:

Snapshot of IRS website address bar

My question is this: Is this truly the IRS payment site, or some kind of scam?

  • 2
    Something weird is going on. That specific URL does show a BOA cert for me too. But entering directpay.irs.gov instead redirects to irs.gov/payments/direct-pay which doesn't show BOA. I don't know of it's significant, but pages are using (different) certificates from Entrust Certification Authority. Commented Aug 29, 2018 at 0:32
  • 2
    @DanNeely If you click the 'make a payment' button from your first link you're back to the BOA one.
    – Hart CO
    Commented Aug 29, 2018 at 2:01

3 Answers 3


Yes, this is the real IRS payment site. The IRS uses Bank of America as its payment processor. From this Department of the Treasury document (PDF):

Bank of America is the EFTPS Financial Agent (FA) that processes and financially settles the various Federal tax payment types.

The EFTPS is the Electronic Federal Tax Payment System, which I suspect is the backend for other IRS direct pay options. Additionally, if you go to this exhaustive description of electronic methods of tax payments from the IRS, they will also tell you that Bank of America is acting as the federal government's agent in regards to tax collection (repeatedly).

Thinking about it logically, note that there's a valid Bank of America certificate on the site. Therefore, the site is either legitimate or it's a scam being pulled off by Bank of America itself. But there's no reason why Bank of America would try to dupe people into paying taxes to it; given the size of Bank of America, the punishment for being found to carry out such a fraud would be far, far larger than the payoff. So we can conclude that it is almost certainly not a scam (as it indeed is not).


It seems legit. The IRS must have contracted this out to BOA.

enter image description here

enter image description here


If the URL you are visiting ends "irs.gov", then yes, that's really the IRS. A domain of "xxx.irs.gov", where "xxx" can be anything, is still the IRS. And the same for any other domain name. "xxx.yyy.com" is owned by the same people who own yyy.com.

Watch carefully for typos. There are scammers out there who get domain names with slight misspellings, like "amazom.com" instead of "amazon.com", making their scam site look like the real site. So if you mistype then you land on their site. It looks right, you type in your ID and password or credit card number and they take your money.

Another trick is to put the name of the real organization at the beginning of the domain name, like "bankofamerica.hacker.com". It's the end of the domain name that matters. That domain would be owned by hacker.com, not Bank of America. Sometimes they'll give very long domain names to confuse you, like "bankofamerica.com.login.account.management.northwest.hacker.com", hoping you'll quit reading after a certain point or it won't fit in a text box and you think it ended, etc.

My favorite scam email ever: I got an email claiming to be from my county courthouse that said that I was the target of a lawsuit and the legal documents were attached. I was suspicious for three reasons:

  1. Attachments from unknown sources are often viruses.

  2. The text of the email did not contain any specific information other than my email address. It didn't include my name or street address, or even the name of the county, i.e. it said "County Courthouse" not "Monroe County Courthouse". This seemed unlikely, more like they just got a bunch of email addresses and wrote one generic email.

  3. One other subtle clue was that the 'From' address on the email was "sugardaddiesgalore.com". I don't know what the domain name of my county courthouse is but I'm going to go out on a limb here and say that it is probably not sugardaddiesgalore.com.

  • 2
    There are attacks/exploits which feed fake domain name resolution (DNS) results to the victim, which can result in the irs.com domain name in the victim's browser not really being the real IRS website.
    – Beanluc
    Commented Aug 31, 2018 at 0:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .