HMRC warns self-assessment taxpayers to watch out for scams – how can you protect yourself?

HMRC is warning people filing, or preparing to file, self-assessment tax returns for 2021-22 to watch out for tax scams.

The tax authority says it responded to 180,000 referrals of suspicious contact in the 12 months to August 2022. Of these bogus communications, 81,000 were fake offers of tax rebates, and some even threatened victims with arrest for tax evasion. 

With the deadline for paper returns on 31 October and online self-assessments due on 31 January, millions of people are likely to be more receptive to messages or phone calls purporting to be from HMRC. 

Here, Which? reveals what scams people should be particularly aware of, and how you can avoid becoming a victim to fraudsters.

What are the most common tax-related scams?

HMRC says fraudsters target customers when they know they are more likely to be in contact with the tax office, and is therefore warning self-assessment customers to be extra vigilant to suspicious emails, text messages and phone calls. 

The following are common methods fraudsters use to trick you into parting with personal details and cash. 

Fake phone calls and text messages

In the 12 months to August 2022, HMRC responded to 55,386 reports of phone scams, and has been working with the telecoms industry and Ofcom to remove 48 phone numbers being used to commit HMRC-related phone scams. 

There have been reports of fraudsters calling customers pretending to be from the tax office, and threatening potential victims with lawsuits, warrants for their arrest or demands for outstanding tax to be paid. It's likely that anyone convinced by this tactic may then be persuaded to make a payment over the phone – which would go to a scammer's bank account.

Fake text messages making similar threats, or offering a tax refund are also common. To make things more difficult to spot, scammers can use number spoofing to make your phone display ‘HMRC’ as the sender, instead of their phone number. 

The links in these messages will usually send you to a website that will harvest your personal information, or spread malware that can lead to identity theft, theft of your money or both. For this reason, you should avoid clicking on any links or giving any personal or financial information.

Phishing emails

Emails that spoof a genuine address or change the ‘display name’ to make it appear genuine are also used by scammers. 

Similarly to scam text messages, these emails will usually include a link to a website that will try to harvest your personal details or ask you to transfer a sum of money. 

Make sure you carefully check any emails for strange sender details, spelling mistakes and requests to part with your bank details. Do not click on any email links unless you're sure they're from a legitimate person or company. 

Misleading websites

Fake websites designed to make people pay for services that should be free or low cost – for example, charging to connect people to free HMRC phone helplines – are another common scam to look out for. 

Within the last year, the HMRC has reported 10,565 malicious webpages for takedown. It has tried to tackle this issue by disputing bogus sites it becomes aware of and taking ownership of HMRC-branded internet domains or website names. Since 2017, the department has recovered more than 183 websites hosting low-value services such as call-connection sites.

Social media

HMRC says it's also aware of scammers using social media and WhatsApp to contact taxpayers. For example, one spoof HMRC account on Twitter was found to have been sending direct messages to customers. It has since been closed down.

HMRC would not contact anyone via WhatsApp or social media to ask for tax payments. Any requests that suggest otherwise are scams.

• Find out more: spot and protect yourself from scams

Which? Money Magazine

Find the best deals, avoid scams and grow your savings and investments with our expert advice. £4.99 a month, cancel anytime

Sign up now

How to protect yourself against scams

Keep these points in mind the next time you're contacted by someone who says they're from HMRC:

How are you being contacted?

While HMRC does send some email and text message notifications, it will never ask for your bank account details or personal information via text. It also never sends notifications by email or text to notify you about being eligible for a tax rebate or refund.

Are you being put under pressure?

If someone contacts you saying they’re from HMRC, wanting you to urgently transfer money or give personal information, be on your guard. Don’t respond, don’t click on any website links within the email and don’t disclose any personal or payment information.

If you’re feeling pressured by someone on the phone or threatened in any way, there’s nothing wrong with challenging the request or rejecting it completely. You can then contact HMRC yourself, and check whether the request was from the tax office.

Does it seem like a genuine call, text, email or letter?

If a phone call, text or email is unexpected, don’t give out private information or reply, and don’t download attachments or click on links before checking on the government website to see if the contact seems genuine.

Remember, numbers and email addresses can be spoofed, so don’t take the sender’s details at face value.

Finally, you can report the suspected scam to HMRC to investigate and hopefully stop other people from becoming victims. 

You can forward suspicious texts claiming to be from HMRC to 60599 and emails to phishing@hmrc.gov.uk. You can also report tax scam phone calls, emails and texts via the Gov.uk website.

Which? Money Podcast

Join us on our weekly audio show for the latest money news and personal finance hacks to help make you better off.

Listen now

What to do if you’ve been scammed

If you think you have been tricked into transferring money to a scammer’s account, contact your bank immediately. 

Banks that have signed up to the voluntary Authorised Push Payment Scam Code have to take a number of steps to protect and reimburse customers who are victims of this kind of bank transfer fraud.

You should also report it to Action Fraud (in Scotland, contact the police on 101).

You can also take a look at our guide to getting your money back after a scam for advice on other types of payments, and if you're having trouble getting your money back after a scam.

• Sign up to our Which? Scam Alerts service, to hear about the latest scams and how to avoid them.