Webroot is warning users about fraudulent IRS W-2 emails, in this article. The IRS won’t send you emails (except to verify that returns have been accepted – thru HRBlock). State tax departments (like Virginia) often send business customers legitimate emails (like when sales tax reports are due).
And PayPal users are often targeted in phishing attacks (lately through Gmail), as in this Webroot story. Since some small non-profits take Paypal but not credit cards (to help “unbanked” clients), most people need Paypal (which can be connected to a credit card for replenishment).