Here is the IRS Notice 6417, that your clients may have received. Since it is in the public domain, it would be easy enough for a scammer to reproduce and include a link requesting personal data.
https://www.irs.gov/pub/irs-utl/l6417sample.pdf
