HMRC does not ring to threaten arrest, does not take payment in gift cards or crypto, and does not text or email you a link to collect a tax refund. If a message pushes you to act fast, pay someone, or type in your bank or login details, treat it as a scam until you have checked it yourself through GOV.UK. Forward suspicious texts to 60599 and emails to phishing@hmrc.gov.uk, and if you have lost money, call your bank first.
The most common scams
Fraudsters copy HMRC because almost everyone deals with it and most people find tax letters a little stressful. The approaches change, but the patterns are familiar.
- The refund that needs your details. A text or email says you are owed a few hundred pounds and links to a page asking for your card or bank details.
- The threatening phone call or voicemail. A recorded or live caller says there is a warrant for your arrest, or legal action starting today, unless you pay at once.
- Payment by unusual means. You are told to settle a "debt" with gift cards or vouchers, cryptocurrency, or a bank transfer to an account in a person's or company's name. Genuine Self Assessment payments go to HMRC's own accounts, named HMRC Cumbernauld or HMRC Shipley, using your tax reference.
- A spoofed number. Caller ID can be faked, so a call can show a number that looks like a real HMRC line. What appears on your screen proves nothing.
- Fake login pages. A link leads to a convincing copy of the Government Gateway or GOV.UK One Login sign-in page. Whatever you enter goes straight to the fraudster.
- Making Tax Digital offers. With quarterly updates now compulsory for some landlords and sole traders, expect messages saying you must "register" urgently or buy a particular package through a link. HMRC does not sell software: you choose a commercial product yourself, and you can check whether you need to join at all in our Making Tax Digital guide.
- Social media messages and posts. HMRC does not use social media to offer rebates or ask for personal information. Some posts recruit people to hand over their HMRC sign-in details for a "risk free" payout. The fraudster then claims repayments in that person's name, and the person can be left owing the whole amount back to HMRC.
- Refund companies with hidden costs. Some firms that reclaim tax for you are legitimate, but fees can be high and terms unclear. You can claim a refund directly through your HMRC online account or the HMRC app and keep all of it. If you do use a company and want the refund paid to it, that is now done by a nomination that you can cancel at any time.
How HMRC really contacts you
A lot of HMRC contact arrives by letter, or as a message in your online account or the HMRC app. HMRC does also use texts, emails and phone calls, sometimes as a follow-up to a letter it has already sent. Knowing what each channel is used for makes the fakes easier to spot.
| Channel | What genuine HMRC contact looks like | Red flags |
|---|---|---|
| Text message | Confirms something you did (a claim, a form, a complaint), or reminds you to check your online account. Some texts include a link to GOV.UK or HMRC webchat; many have no link at all. | A refund offer, a link to "claim", or any request for bank or personal details |
| Sent from an address ending hmrc.gov.uk, usually pointing you to guidance or your online account | Attachments you did not expect, a refund or penalty notice, a sign-in link | |
| Phone call | Possible in specific cases, such as a compliance check, a complaint or a National Minimum Wage enquiry. The number may show as withheld. | Threats of arrest or court, demands for instant payment, voicemails threatening legal action |
| Letter | Tells you what HMRC needs and how to reply or pay. QR codes on HMRC letters usually lead to GOV.UK guidance. | A reply address or email that is not HMRC's, or a QR code that asks you to enter personal details |
| WhatsApp and social media | Only one-way reminders if you have joined the UK Government channel on WhatsApp | Any direct message from "HMRC" offering money or asking for details |
Even an email address ending hmrc.gov.uk can be imitated, so the safest habit is the same for every channel: do not use the link, number or QR code you were sent.
How to check whether it is genuine
- Pause. Pressure to act quickly is the clearest sign of a scam. A genuine tax problem will not get worse because you took an hour to check it.
- Look it up on GOV.UK. HMRC publishes lists of the letters, texts, emails and calls it is currently sending, organised by subject, with dates. Search for "genuine HMRC contacts". Not every message is listed, but if yours describes a campaign that is, you have a useful check.
- Sign in yourself. Type gov.uk into your browser, or open the HMRC app, and sign in from there. If HMRC really wants something, it will normally show in your account.
- Call back on a number you found yourself. Use the contact pages on GOV.UK, not the number in the message or on your caller display.
- Ask us. If we act for you, forward the message or tell us about the call before you reply. We can check it against your records, and sometimes against what HMRC's agent services show us, to see whether it fits with anything real. We will never ask for your HMRC password, and HMRC itself says you should not share your sign-in details with anyone, your agent included.
How to report a scam
- Texts: forward to 60599 (standard network charges apply), then delete.
- Emails: forward to phishing@hmrc.gov.uk, then delete.
- WhatsApp or other app messages: screenshot the message and send the image to phishing@hmrc.gov.uk.
- Phone calls: use HMRC's online form for reporting a suspicious call, found by searching GOV.UK.
- Social media accounts: email the account name and platform to branddefence@hmrc.gov.uk.
- Scams not about tax: forward texts to 7726 (free) and emails to report@phishing.gov.uk.
Reporting helps HMRC have fake websites and phone numbers shut down, even if you did not fall for the message.
If you have already clicked, replied or paid
- Call your bank straight away if you gave card or bank details or sent money. Use the number on the back of your card. Speed can make the difference to whether a payment is stopped.
- Change your passwords, starting with your HMRC sign-in and email, and any other account that uses the same password.
- Tell HMRC's security team at phishing@hmrc.gov.uk what you disclosed (for example your user ID or National Insurance number), without including the details themselves.
- Report unexpected activity in your HMRC account to the online services helpdesk. Sign-in codes arriving when you are not signing in suggest someone has your password.
- Report the crime. In England, Wales and Northern Ireland, Action Fraud was replaced by Report Fraud on 4 December 2025: report at reportfraud.police.uk or call 0300 123 2040. In Scotland, call Police Scotland on 101.
When to be extra careful
Scam activity rises when people are expecting to hear from HMRC: in the run-up to the Self Assessment deadline, which for 2025/26 returns is 31 January 2027, and at times when refunds are being issued. Filing early helps, because a "your return is overdue" message is easy to dismiss once you know yours is in. Our Self Assessment guide covers the dates.
What to do now
- Save 60599 and phishing@hmrc.gov.uk in your phone so reporting takes seconds.
- Download the HMRC app, or bookmark your online account, so you always have a safe way to check.
- Use a unique password for your HMRC sign-in and keep the extra sign-in code (multi-factor authentication) switched on.
- Agree a rule with older relatives: no payment to "HMRC" until they have checked with you or with their accountant.
- If you have received a genuine HMRC letter and are not sure how to respond, see our HMRC enquiries service.
If something has arrived and you are unsure whether it is real, or you need help dealing with HMRC, book a consultation and we will help you sort it out.
This article is general information about UK tax, based on the law and HMRC practice at the date shown above. It is not advice, and reading it does not make you our client. Tax rules change and their effect depends on your circumstances, so please speak to us before acting on it.