HMRC Scams and how to report them

Cybercriminals often attempt to deceive people and businesses by masquerading as HMRC through phishing emails, phone scams and text messages.

It’s crucial to be able to recognise HMRC phishing emails and fraudulent texts or calls to protect you or your business from potential threats.

To avoid falling victim to an HMRC scam it’s important to know what actions the real HMRC will never take and if something does happen to know who to contact to minimise the effects.

How do I Identify an HMRC Scam?

Understanding the tactics used by fraudsters is good way to learn how to spot HMRC phone, text and email tax scams.

These scams often target individuals around key online tax deadlines for example the 31 January self assessment tax return deadline.

Recognising common HMRC phishing emails:

Emails claiming to be from HM Revenue & Customs (HMRC) may contain fraudulent links or attachments designed to steal your personal information.

To identify a phishing email look for poor grammar, spelling mistakes, or an urgent tone demanding immediate action.

Check the email address of the sender; if it doesn’t finish with “@hmrc.gsi.gov.uk” or “@gov.uk”, it’s probably a fraud.

Detecting fraudulent HMRC texts or calls:

Fraudsters can also impersonate HMRC through texts and phone calls. They might claim you’re owed a tax refund or have outstanding taxes due in order to obtain your financial details.

How do I avoid an HMRC Scam?

• Never provide personal information over the phone unless you initiated the call.
• If you receive an unexpected text message claiming to be from HMRC with a link included do not click on it as this could lead you towards entering sensitive data into fake websites.
• Beware of callers using aggressive tactics like threatening legal action – genuine HMRC representatives will never behave this way.

In case of doubt about any communication supposedly coming from HM Revenue & Customs (HMRC), always verify its authenticity before responding by contacting them directly via their official channels listed on their website: gov.uk/contact-hmrc.

What HMRC will never do

To safeguard your personal information it’s essential to know what actions the real HM Revenue & Customs (HMRC) will never take when contacting you about outstanding tax bills or other matters.

This knowledge helps you differentiate between genuine HMRC communication and scam attempts.

HMRC automated messages

Firstly, be aware that HMRC will not use automated voice call systems to inform you about a tax rebate or penalty.

Hang up the phone immediately if you receive an unexpected call with a pre recorded message claiming to be from HMRC as it’s likely to be a fraudulent attempt to obtain your personal information.

In some cases legitimate automated voicemails can come from the Debt Management department at HMRC regarding outstanding debts; however scammers also use similar tactics which can lead to confusion.

Never disclose your personal information in response without verifying its authenticity first by contacting HMRC.

Text messages from HMRC

Some text messages from HMRC may be genuine but they will never request personal or financial details. An example would be a text often urgent in nature asking for a password or PIN number.

If you receive a suspicious message (especially texts that appear urgent) don’t click on any links or provide information without checking with HMRC first.

HMRC on social media

HMRC has a presence on social media channels like Facebook, Twitter, Instagram, LinkedIn and Youtube. They use it to promote news, updates and official HMRC announcements.

HMRC cannot accept messages via social media relating to an individuals tax matters.

If you engage on an HMRC social media channel it’s very important not to share any of your personal information.

It is HMRC social media policy to only respond to general tax queries and will not respond to any personal requests.

If an account claiming to represent HMRC contacts you through social media avoid sharing any sensitive information with them and report such accounts directly to the social media platform.

Never share your bank details via email

Emails are another common method used by scammers pretending to represent HMRC.

The real HMRC would never ask for your bank account details via email or send notifications regarding unpaid taxes through such means.

Always verify the authenticity of any emails claiming to be from HMRC before taking any action.

Tip:

• Check the sender’s email address – if it doesn’t end in “@hmrc.gsi.gov.uk” or “@gov.uk”, it’s probably fake.
• Even if an email appears legitimate at first glance, avoid clicking on links within these messages as they may lead to malicious websites designed for phishing purposes.

By understanding the communication methods HMRC will never use you can protect yourself from falling victim to scams and be able to respond more confidently to legitimate HMRC communication.

Reporting suspected HMRC Scams

If you suspect that a message is part of an ongoing scam targeting taxpayers you can report it to HMRC.

HMRC can use the information to investigate and take action against the perpetrators.

Scam Text forwarding instructions (60599)

If you receive a text message that appears to be from HMRC don’t interact with it or provide any personal information Instead, forward the entire text message to 60599.

This service allows HM Revenue & Customs to track and investigate potential scams.

Note that there may be a small charge for sending texts to 60599 depending on your mobile network provider.

Phishing Email reporting address ([email protected])

If you come across a phishing email pretending to be from HMRC avoid clicking any links or downloading attachments within the email.

You should immediately forward the complete email with its original subject line and content intact to [email protected].

After forwarding the email delete it from your inbox without replying.

Scam phone call reporting

To report a scam phone call to HMRC you will need to follow an online process through your government gateway account.

HMRC will need you to give them your email address and potentially share your email address and phone number with other organisations to enable them to close down the scam.

Besides reporting these scams directly to HMRC through text messages and emails you can also inform action fraud. Ran by the police action fraud let’s you report fraud cases online through their website.

Protecting yourself against online fraud

Protecting your own personal and business information online should be a top priority especially when the it comes to tax and financial data.

By following some basic best practices you can significantly reduce the risk of falling victim to HMRC scams online.

Antivirus software and passwords:

Consider using a free or paid for antivirus software on all devices. You should try to keep the antivirus software and all other programs up to date with periodic updates.

Additionally using strong passwords for all your accounts related to taxes or finances is highly recommended.

Verifying contact authenticity before responding:

Before responding to any communication claiming to be from HMRC always verify its authenticity.

Genuine contacts will have a valid reference number that can be checked on the official HMRC website.

Be cautious about sharing personal details over phone calls, texts or emails without confirming their legitimacy first.

Using secure methods for submitting financial documents:

• Password protection: When sending documents electronically password protect them using strong passwords that combine letters, numbers and special characters.
• Email encryption: Use email encryption services like PGP (Pretty Good Privacy) or S/MIME (Secure/Multipurpose Internet Mail Extensions) to protect sensitive data during transmission.
• Sending physical copies: If submitting paper forms or documents by post use registered mail services with tracking features so you know when they’ve been received safely by HMRC.

• Filing online: Try to file tax returns and other financial submissions through the secure government gateway portal or a trusted third party tax return software provider. This helps you avoid phishing websites designed to steal your information.

Monitoring accounts for suspicious activities:

• Emails: Be vigilant about any unexpected emails requesting personal information or containing suspicious links. Forward any emails that seem suspicious to [email protected] for review.
• Calls: If you receive any suspicious calls claiming to be from HMRC do not disclose any personal details and report them immediately by contacting their official helpline at +44 (0)300 200 3300.
• Banks: Regularly monitor your bank statements for unusual activities and set up alerts for large transactions on your accounts.

Staying updated on HMRC scam alerts

Staying up to date on possible scams and frequently consulting official HMRC resources can help protect your personal information and funds from the constantly changing tactics of tax fraudsters.

Subscribing to reliable scam alert services:

By signing up for scam alerts from trusted sources like Which? you can be aware of new tactics used by fraudsters to deceive taxpayers and protect your business from potential financial loss.

Regularly checking official HMRC updates:

In addition to subscribing to scam alert services make a habit of regularly checking official updates from HM Revenue & Customs (HMRC).

Their website features a dedicated section called “Phishing and bogus emails – examples“, where they share examples of known phishing attempts along with advice on how to recognise them.

• Action point: Bookmark the official HMRC website and visit it frequently for any important announcements or security tips related specifically to taxes.
• Action point: Follow HMRC’s social media accounts like Twitter and Facebook, as they often share updates on scams and fraud prevention measures.
• Action point: Participate in online forums or communities where you can exchange information about potential scams.

What should I do if I have replied to an HMRC Scam?

If you unfortunately fall prey to an HMRC scam taking immediate steps can help mitigate potential damage caused due to loss of money or identity theft.

You should contact the HMRC security team as soon as you can if you’ve disclosed personal information in reply to a fraudulent email or text.

HMRC ask you to email [email protected] with details of what you have disclosed only for example your self assessment UTR number.

In the event of unauthorised transactions resulting from scams notify your bank or payment provider as soon as possible.

They have a dedicated customer protection team that will assist in securing your account and investigating the issue. Additionally they may be able to reverse the transaction if reported quickly enough.

If you suspect that you have received a phishing email, phone scam, text message, or suspicious call asking for your bank details or personal information contact your dedicated customer protection team immediately.