# German tax email regulations and phishing threats

> Live situation record from CLSTR: https://clstr.news/situations/german-tax-email-regulations-and-phishing-threats
> Updated: 2026-09-24T08:24:27.000Z. Sources: 7. Developments: 2.

The German Federal Fiscal Court (Bundesfinanzhof) has ruled that tax-relevant emails must be retained for external audits. Under this mandate, business correspondence such as offers and orders must be kept for six years, while emails serving as accounting vouchers or containing invoices must be archived for ten years in an unalterable, electronic format.

Following these regulations, warnings have been issued regarding a surge in phishing attempts. Fraudulent emails are impersonating the Federal Central Tax Office by claiming to announce external audits. These scams often use deceptive sender addresses and HTML files instead of PDFs to prompt users for passwords or personal data. Some fraudulent messages also falsely claim that administrative fine proceedings are pending to solicit IBAN details.

## Timeline

### 2026-09-24: German tax authorities warn of phishing emails regarding fake audits

Tax advisors are warning of phishing emails impersonating the German Federal Central Tax Office to steal personal data through fake audit notices and fraudulent requests for passwords or banking details.

2 sources. https://clstr.news/cluster/german-tax-authorities-warn-of-phishing-emails-regarding-fake-audits

### 2026-08-31: Germany: Federal Fiscal Court mandates email retention for tax audits

The German Federal Fiscal Court ruled that tax-relevant emails, including business correspondence and invoices, must be archived and presented during tax audits.

6 sources. https://clstr.news/cluster/germany-federal-fiscal-court-mandates-email-retention-for-tax-audits

---
Cite as: German tax email regulations and phishing threats. CLSTR, https://clstr.news/situations/german-tax-email-regulations-and-phishing-threats