See “How to verify contact from the IRS”.

If you determine that the contact is not legitimate:

• If the scam is IRS-related, report the incident to TIGTA and to us at phishing@irs.gov.
• If the scam is tax-related, report and to us at phishing@irs.gov.

If you are a victim of a security incident, please review Publication 4557PDF and contact your Stakeholder Liaison (SL)

For additional guidance please see FTC Data Breach Guidance: A Guide for Businesses.

https://www.irs.gov/privacy-disclosure/report-phishing