HMRC scams are fraudulent contacts that pretend to be HM Revenue & Customs in order to trick people into handing over money, bank details or personal information.
These scams arrive by email, text, WhatsApp, social media or phone and often claim you owe tax, are due a refund, or face legal action.
However, HMRC will never ask for payment by gift card, ask for your personal bank details in an unsolicited message, or threaten immediate arrest by automated phone call.
This article explains the current types of HMRC scams currently circulating, the information scammers try to obtain, how to tell real HMRC contact from a fake, and exactly what to do and who to tell if you think you are being targeted.
What is an HMRC Scam?
An HMRC scam is where criminals impersonate the UK tax authority to frighten, confuse or persuade people to hand over sensitive information or money.
Scammers exploit common processes such as Self Assessment, tax refunds, National Insurance queries and customs charges to make messages appear genuine.
HMRC publishes examples and guidance to help people spot these fake contacts.
What are the Current HMRC Scams?
Scammers adapt quickly, but the contact methods and themes remain fairly consistent.
Below are the most widespread types you should be aware of:
Phishing Emails
Phishing emails are designed to look like official HMRC correspondence.
They may use the HMRC logo, claim you are owed a tax rebate, say a refund has failed, or warn that legal action is pending.
Often they contain a link to a convincing fake website that asks you to enter personal or financial details.
HMRC states that genuine emails about refunds will only come from an address ending in hmrc.gov.uk, and warns against opening attachments or clicking links in unexpected messages.
One common way to spot fake emails is the sender field will usually state “Undisclosed recipients”, meaning the message wasn’t directly sent to you only – it went to hundreds, possibly thousands of other people too!
If in doubt, forward suspicious emails to [email protected] and then delete them immediately.
Text Messages (SMS)
Text scams often promise a tax refund or claim HMRC needs action from you.
The smishing text may include a link that takes you to a phishing page.
HMRC does send texts for limited purposes and may include links to GOV.UK, but you should never give personal or bank details in response to an unexpected SMS.
Suspicious messages should be forwarded to 60599 and then deleted.
Text Messages (WhatsApp)
Scammers use WhatsApp to send direct messages purporting to be HMRC, sometimes offering refunds or asking you to click a link.
HMRC only uses WhatsApp for a single, non-replyable government channel and not for customer service.
Any other WhatsApp message claiming to come from HMRC should be treated as fraudulent and reported to HMRC’s security team.
Telephone Calls
Fraudsters make automated or live calls claiming you owe tax, that court action is pending, or that you must “press 1” to speak to someone.
These calls are designed to cause panic and get you to reveal bank details or make instant payments.
HMRC warns there are automated call scams that say HMRC is suing you.
If you receive one of these calls, you should end the call immediately – never transfer funds at a caller’s request!
If you have lost money, you should report it to organisations like Action Fraud.
Fake Websites
Phishing sites mimic HMRC pages to harvest login credentials, National Insurance numbers, and debit or credit card details.
They may have realistic URLs, but often are slight misspellings or use different domain names.
HMRC’s guidance shows examples of fake pages and advises never to enter personal data via links you receive in unsolicited messages.
Always type GOV.UK addresses yourself or use bookmarks.
Social Media
Scammers use social networks to message users directly or to create posts and adverts offering large refunds or help with tax forms.
These messages can look genuine and may even use fabricated screenshots.
HMRC will not ask for personal or financial details via social media and will not offer refunds through direct messages.
You should report suspicious accounts and messages to the social platform and HMRC.
What Information are HMRC Scammers Trying to Get?
Scammers are typically after things they can use to steal money, commit identity theft or access accounts.
The most common targets are:
- Bank account numbers and sort codes used to withdraw funds.
- Full payment card numbers, expiry dates and CVV codes for fraudulent purchases.
- National Insurance numbers and passport data that can help commit identity fraud.
- HMRC online account logins and passwords that allow account takeover.
- Personal details such as date of birth and address, which help build believable fraud profiles.
Understanding what they want helps you resist pressure to disclose anything unnecessary during unexpected contacts.
Official HMRC guidance stresses never to share such information in response to unsolicited contact.
How Do I Know If an HMRC Contact is Genuine?
There are clear signs that separate a legitimate HMRC contact from a scam:
- Official HMRC emails will come from an address ending in @hmrc.gov.uk. Any other domain is suspect. However, sophisticated scammers can spoof the display name, so look at the actual email address.
- HMRC will never ask for bank details, card numbers, or passwords by email, text, social media or telephone. If you are asked for this information in an unsolicited contact, it is a scam.
- HMRC will not demand payment by unusual methods such as gift cards, cryptocurrency, or transfers to overseas accounts. These are red flags.
- Automated calls insisting you press a number to speak to someone about legal action are almost always scams. If a caller pressures you to act immediately, hang up, check your official HMRC account via GOV.UK, and report the call.
When in doubt, log onto GOV.UK yourself or use HMRC’s official contact channels rather than replying to or clicking links in the suspicious message.
What to Do If I Think I’m Being Scammed
If you suspect you have been targeted:
- Stop communication: Do not reply, click links, or open attachments.
- Keep evidence: Save a copy of the email or screenshot the message and note the caller number and time. These details help investigators.
- Report It: If you have given financial details and lost money, report it to Action Fraud and your bank immediately. Action Fraud will advise on next steps and investigate potential fraud.
- Submit Evidence: Forward suspicious emails to [email protected] and suspicious texts to 60599, as advised by HMRC. Then delete the message. If you have received a suspicious call, report the details via HMRC’s suspicious phone call reporting form.
- Reset Passwords: If your HMRC online account may have been compromised, change your passwords and check your account for unexpected activity via GOV.UK. Consider contacting the Citizens Advice Bureau for support if you feel confused or vulnerable.
HMRC’s own messaging makes it clear that reporting helps investigations and prevents others from being scammed.
Even if the scam appears common, reporting it contributes valuable intelligence.
How to Report HMRC Scams
Official reporting routes are simple and should be used every time:
- Forward suspicious emails to [email protected].
- Forward suspicious texts to 60599 (network charges may apply).
- Report suspicious phone calls using HMRC’s online reporting form and include as much information as possible.
- If you have lost money, report the crime to Action Fraud at actionfraud.police.uk. They will log your report and advise on next steps.
Trading Standards Scotland and local trading standards bodies also publish advice and can assist with consumer protection issues if the scam has local business implications.
Key Takeaways
HMRC scams come in many forms but share the same goal: to trick you into giving up money or personal information.
Common signs of fraud include unsolicited contact, requests for bank or card details, demands for immediate payment, and links that ask you to log in through non-GOV.UK pages.
Always verify through official HMRC channels, report suspicious messages to the addresses and numbers above, and report losses to Action Fraud.
Staying calm and knowing where to report makes you far less likely to fall victim, and your report helps protect others.
