If you weren't expecting an income tax refund but discover a big deposit from the Internal Revenue Service in your bank account, don't celebrate. You may have been the target of a clever new scam.

The latest twist in tax-time identity fraud involves thieves who pilfer personal and financial information, often from professional tax preparers. They then use those details to file fake tax returns and have refunds — sometimes as large as $20,000 — sent electronically to your account with plans to collect it later.

The IRS initially warned about the scam Feb. 2, urging tax professionals to "step up security and beware of phishing e-mails that can secretly download malicious software that can help cybercriminals steal client data."

The agency next issued a warning to taxpayers Feb. 13 after reports of the incidents "mushroomed" from a few hundred potential victims nationwide to thousands, said Terry Lemons, an agency spokesman.

"This one is really worrisome to us," Lemons said. "Scammers are getting a government deposit into your account."

In the past few years, the IRS said, its Security Summit — a collaboration with state tax agencies and makers of do-it-yourself tax software — has helped reduce incidents of tax-related identity fraud, in which someone files a fake return in your name to collect a refund.

But now, criminals are increasingly targeting businesses, including tax professionals and human resource departments, because they are rich sources of sensitive personal information — including W-2 forms, bank statements and tax returns — that thieves can use to impersonate taxpayers and file bogus returns with authentic data.

"Criminals go where the data is," said Jonathan Horn, senior manager for tax policy and advocacy with the American Institute of Certified Public Accountants.

How does putting the money in your account benefit the criminals? The thieves think you'll give it to them.

The crooks, for example, will call victims and pretend they're a collection company for the IRS, which has deposited the funds in error. They then demand that victims transfer the money to a different account.

"They say, 'We made a mistake; send it back to us,' " Lemons said.

Or, they will leave voice messages threatening the taxpayer with criminal fraud charges or an arrest warrant if they don't call the number provided to return the "refund."

"It signifies the ingenuity of the fraudsters out there," said Russell Schrader, executive director of the National Cyber Security Alliance, which promotes online security.

The scam has the ring of truth for victims, as there is actually an erroneous deposit sitting in their bank account (or in some cases, a paper check in the mailbox). That can frighten victims into acting, especially if a caller is bullying them. But it's always best to hang up and independently check whether the information you were given is valid, said Eva Velasquez, chief executive of the nonprofit group Identity Theft Resource Center.

"Always go to the source when you get these kind of contacts," she said.

Look up a public number for the IRS online, she advised, and contact the agency to ask if the call was legitimate. (The IRS identity theft unit's number is 1-800-908-4490).