HMRC phishing and scams: detailed information
To help our investigations report all HMRC related phishing emails, suspicious phone calls and text messages.
Report suspicious phone calls, emails or texts to HMRC.
Even if you get the same or similar scam contacts often, report them.
Do not open attachments or click any links in an unexpected email or text message, as they may contain malicious software or direct you to a misleading website.
Delete any emails or texts once you’ve reported them.
QR codes
You can use your mobile phone to:
- Scan a QR code.
- Continue your payments on your mobile.
We use QR codes to help you complete a payment to HMRC using a mobile phone and we include them on letters where we:
- ask you to update your contact details
- tell you about a debt payment that is due
- confirm that you’re newly-registered for Self Assessment — the codes take customers to the GOV.UK Self Assessment advice pages
The QR code is also displayed on a desktop browser when you first log into your HMRC online account using Government Gateway.
Text messages
HMRC does send text messages to some of our customers.
In the text message we might include a link to GOV.UK information or to HMRC webchat.
HMRC will never ask for personal or financial information when we send text messages.
We advise you not to open any links or reply to a text message claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details.
To help fight phishing scams, you should send any suspicious text messages to 60599 (network charges apply) or email phishing@hmrc.gov.uk then delete them.
Image showing an example of a scam HMRC text message which is trying to get you to click on a hyperlink and enter personal details.
Coronavirus (COVID-19) scams
Text scams
‘COVID-19 refund’ SMS
Beware of various text scams offering an HMRC tax refund in connection with the COVID-19 pandemic.
Do not reply to the text and do not open any links in the message.
Tax refund and rebate scams
Emails
HMRC will never send notifications by email about tax rebates or refunds.
Do not:
- click on the links to visit the a website mentioned in a ‘tax rebate’ email
- open any attachments
- disclose any personal or payment information
Fraudsters may spoof a genuine email address or change the ‘display name’ to make it appear genuine. If you are unsure, forward it to us and then delete it.
Example of a phishing email and misleading website
Image showing an example of a scam email with a hyperlink which directs you to a phishing website.
Image showing an example of a phishing website designed to trick you into disclosing personal information.
Suspicious phone calls
HMRC is aware of an automated phone call scam which will tell you HMRC is filing a lawsuit against you, and to press 1 to speak to a caseworker to make a payment. This is a scam and you should end the call immediately.
Other scam calls may refer to National Insurance number fraud or offer a tax refund and ask you to provide your bank or credit card information. If you cannot verify the identity of a caller, we recommend that you do not speak to them.
If you’ve been a victim of a scam and suffered financial loss, report it to Action Fraud.
Phishing calls use a variety of phone numbers. To help us investigate, share call details on our suspicious phone call reporting form. Include the:
- date of the call
- phone number used
- content of the call
WhatsApp messages
HMRC will never use ‘WhatsApp’ to contact customers about a tax refund. If you receive communication through ‘WhatsApp’ saying it’s from HMRC, it is a scam. Email details of the message to phishing@hmrc.gov.uk then delete it.
Social media scams
HMRC is aware of direct messages sent to customers through social media.
A recent scam was identified on Twitter offering a tax refund.
These messages are not from genuine HMRC social media accounts and are a scam. We never use social media to:
- offer a tax rebate
- request personal or financial information
If you cannot verify the identity of a social media account, send the details by email to: phishing@hmrc.gov.uk and ignore it.
Refund companies
HMRC is aware of companies that send emails or texts offering to claim tax refunds or rebates on your behalf, usually for a fee. These companies are not connected with HMRC in any way.
You should read the ‘small print’ and disclaimers before using their services.
HMRC customs duty scams
HMRC is aware of a text and email scam where the customer is told they must pay customs duty to receive a valuable parcel which does not exist.
These scams should not be confused with changes introduced on 1 January 2021, advising that some UK consumers buying goods from EU businesses might need to pay customs charges when their goods are delivered. Find out more about these new rules on GOV.UK.
If in doubt, we advise you not to reply to anything suspicious, but to email HMRC at phishing@hmrc.gov.uk straight away and read HMRC phishing and scams guidance.