24 Jan 2023

Common HMRC scams to watch out for

As the self-assessment tax return deadline gets closer, fraudsters are attempting to cash in

As anyone who submits a tax return will know, HMRC commonly sends out a number of texts and emails reminding you to fill out your tax return and pay the tax you owe. However, fraudsters are aware of this too and often use the self-assessment deadline to try to dupe potential victims.

HMRC acknowledged more than180,000 public reports of potential HMRC scams in the 12 months to August 2022, with most being from fraudsters offering fake tax rebates.

What's more, the National Cyber Security Centre (NCSC) recently revealed that HMRC scams were the third most-reported email impersonation scams via its Suspicious Email Reporting Service  (SERS).

Here, Which? reveals some of the most common HMRC impersonation scams and how to report scam communications.

Text scams

Scam texts offering you a tax refund from HMRC may be particularly attractive at a time when household budgets are being squeezed because of the cost of living crisis - but any links in the texts will usually send you to a dodgy website that’s geared up to steal your details. Some refer to the Covid-19 pandemic and offer a tax refund in relation to this.

HMRC will never ask you for financial or personal details via text. HMRC also advises that it will never use WhatsApp to contact customers about tax refunds.

Email scams to watch out for

Various email scams impersonating HMRC have been circulating. Examples we've heard about include emails telling you to update your details, emails to say your details have already been changed, and notifications requesting you to pay customs duty to receive a non-existent valuable parcel - this is also being sent via text.

These emails use HMRC branding to appear genuine - fraudsters can also spoof email addresses, making it difficult to tell if it's a scam. They'll usually include links to phoney websites where scammers will be aiming to get your personal and financial information.

Scam letters being received

Scammers have been sending letters saying you are in debt and owe money to HMRC, using the typical scam tactic of scaring you into action.

These letters also use HMRC’s recognisable logo and reference the official government website, but include a scam phone number - and they’re banking on you calling it.

Once they have you on the phone, you’re likely to be asked for your bank details and duped into making a payment to them.

Common scam phone calls

HMRC has warned of scam calls doing the rounds, including one that features an automated message telling you that HMRC is taking you to court and instructing you to press one to speak to a caseworker.

If you stay on to speak to someone, scammers on the other end of the call will most likely eventually ask for your bank information.

Other HMRC scams

Scammers are also using social media, including sending direct messages pretending to be from HMRC, asking customers for payment via gift cards or vouchers. HMRC would never contact you in this way, and would never request this kind of payment.

Separately, watch out for scam QR codes. While the tax office does use QR codes to help you complete payments on your mobile - this will appear when you log into your personal tax account on a computer - if you receive a QR code supposedly from HMRC via text or email, it’s a scam.

Which? Money Magazine

Find the best deals, avoid scams and grow your savings and investments with our expert advice. £4.99 a month, cancel anytime

Reporting HMRC scams

If you receive something suspicious claiming to be from HMRC, you can help protect others by reporting it:

Text messages: You can report scam HMRC text messages by sending them to 60599 (network charges apply). You can also forward them to 7726 for free. You can report scam WhatsApp messages by pressing and holding the message before selecting ‘Report’.
Emails: Forward scam emails to phishing@hmrc.gov.uk with a subject line describing the email, such as ‘Scam HMRC email’. You can also select the ‘Report Spam’ on Gmail, the ‘Report phishing’ button on Hotmail and send scam emails to abuse@yahoo.com if you’re using a Yahoo account.
Letters: You can report scam HMRC letters by contacting the HMRC team the letter says it’s from, such as debt management. You can also report scam letters to the Royal Mail via its website for it to investigate.
Calls: You can report scam calls received on your mobile to 7726 as well as using this HMRC link (you'll be asked to sign in using your Government Gateway user ID or your email address).
Websites: report a suspicious website to the National Cyber Security Centre, National Cyber Security Centre (NCSC).
Social media: You can report direct messages on Twitter by tapping and holding the message and selecting 'Report Message'. On Instagram, tap the space next to the message and press ‘Report’ and on Facebook, press and hold the message you want to report, press more and then ‘Report’.