HMRC scam messages are becoming increasingly convincing, putting taxpayers, landlords, self-employed individuals, and business owners at risk of financial fraud and identity theft. Fraudsters regularly impersonate HM Revenue and Customs (HMRC), using emails, text messages, telephone calls, and social media to trick people into revealing sensitive information or making payments.

Whether it is an unexpected tax refund, an urgent demand for payment, or a warning about a supposed tax investigation, these messages are designed to create confusion and pressure recipients into acting without checking the facts.

For many taxpayers, distinguishing genuine HMRC correspondence from fraudulent communication can be challenging. Criminals often copy official logos, use government-style language, and create websites that closely resemble legitimate HMRC services.

The consequences of responding to fraudulent messages can be serious. Victims may lose money, compromise their personal information, or unknowingly provide criminals with access to their tax accounts.

Understanding the warning signs is therefore essential.

In this guide, we explain how HMRC scam messages work, the common techniques fraudsters use, and the practical steps you can take to protect yourself and your business.

What Are HMRC Scam Messages?

HMRC scam messages are fraudulent communications that falsely claim to originate from HM Revenue and Customs.

Their primary purpose is to persuade individuals or businesses to disclose confidential information, transfer money, or visit malicious websites.

These scams can appear through several communication channels, including:

• Emails claiming that a tax refund is available.
• Text messages demanding immediate payment of outstanding tax.
• Telephone calls threatening legal action.
• WhatsApp messages pretending to provide government assistance.
• Social media accounts impersonating HMRC representatives.
• Fake letters requesting payments or personal details.

Some fraudsters use phishing techniques, directing recipients to websites designed to capture login credentials, banking information, or identity documents.

Others rely on intimidation, claiming that failure to respond immediately will result in penalties, account suspension, or arrest.

According to HMRC’s official guidance on identifying tax scams, unexpected contact, threatening language, requests for personal information, and offers of tax refunds are important warning signs.

However, not every unexpected communication is fraudulent. HMRC does contact taxpayers through legitimate channels, making independent verification particularly important.

Why Are HMRC Scam Messages So Common?

Tax-related scams are attractive to criminals because HMRC communicates with millions of individuals and businesses throughout the year.

Most people expect occasional correspondence regarding Self Assessment, PAYE, Corporation Tax, VAT, or other tax obligations.

Fraudsters exploit this familiarity by creating messages that resemble normal tax administration.

For example, someone who has recently submitted a tax return may be more likely to believe an email stating that a refund is available.

Similarly, a business owner awaiting a VAT repayment might consider a message about a delayed payment to be genuine.

Scammers also take advantage of important tax deadlines. During periods when taxpayers are preparing returns or making payments, fraudulent communications may appear more believable.

Modern technology has made these scams more sophisticated. Criminals can imitate email addresses, reproduce official branding, and generate convincing messages with few spelling errors.

Consequently, recognising fraud requires more than simply looking for poor grammar or suspicious formatting.

Taxpayers should consider the content, timing, sender, and requested action before trusting any communication.

12 Warning Signs of HMRC Scam Messages

1. Unexpected Tax Refund Notifications

One of the most common scams involves messages claiming that HMRC owes you money.

The communication may state that you have overpaid Income Tax, qualify for a rebate, or have an unclaimed refund awaiting collection.

You might receive a message saying:

Your HMRC tax refund is ready. Confirm your banking details within 24 hours to receive payment.

The message usually contains a link directing you to a fraudulent website.

Once there, you may be asked to provide your name, National Insurance number, bank details, or card information.

HMRC does not notify taxpayers of tax rebates by unsolicited text messages asking them to disclose personal or financial information.

If you are expecting a refund, access your tax account independently through GOV.UK rather than following a link in an unexpected message.

2. Threats of Arrest or Legal Proceedings

Fraudsters frequently use fear to pressure taxpayers into making immediate payments.

A scam call might claim that HMRC has issued an arrest warrant because of unpaid tax.

Other messages may threaten court proceedings, prosecution, or the seizure of assets.

These threats are intended to prevent recipients from questioning the caller’s identity.

Although HMRC has legitimate enforcement powers and can pursue unpaid tax, it does not make telephone threats of immediate arrest to demand payment.

If you receive a threatening call, end the conversation.

Never make a payment simply because someone claims to represent HMRC and threatens legal consequences.

3. Demands for Immediate Payment

Urgency is another major warning sign.

Fraudulent messages often insist that payment must be completed within minutes or hours.

They may claim that failing to act will result in additional penalties or immediate enforcement action.

Criminals sometimes request payment through unusual methods, including transfers to unfamiliar bank accounts, cryptocurrency, or gift cards.

Legitimate tax liabilities should be verified using official HMRC records and payment instructions.

If a message demands immediate action, independently check whether the amount is genuinely outstanding.

Do not rely on bank details or payment links provided by an unverified caller or message.

4. Suspicious Email Addresses

A fraudulent email may display the name HMRC while originating from an unrelated address.

For example, the sender’s visible name might appear official, but the underlying address could belong to an unfamiliar commercial domain.

Criminals can also manipulate email display names and spoof addresses, making messages appear to originate from trusted organisations.

Checking the sender is useful, but it should never be your only verification method.

Even an apparently legitimate sender address does not guarantee authenticity.

Avoid opening unexpected attachments or following links until you have independently confirmed the communication.

5. Fake HMRC Websites

Some HMRC scam messages direct taxpayers to websites designed to resemble official government services.

These websites may include familiar colours, logos, navigation menus, and sign-in screens.

However, their addresses are often slightly different from genuine government websites.

Fraudsters may insert additional words, misleading subdomains, or unusual domain endings.

A website might look convincing while being controlled entirely by criminals.

Always examine the full website address before entering sensitive information.

The safest approach is to visit GOV.UK directly and navigate to the required HMRC service yourself.

Remember that a padlock symbol or HTTPS connection only indicates an encrypted connection. It does not prove that a website is legitimate.

6. Requests for Personal or Banking Information

Fraudsters often attempt to collect information that can later be used for identity theft.

A suspicious message might ask you to confirm:

• Your National Insurance number.
• Your date of birth or residential address.
• Government Gateway login credentials.
• Bank account or payment card details.
• Passwords or security verification codes.

Some genuine HMRC processes require identity verification. However, unsolicited messages requesting confidential information should be treated cautiously.

Never share passwords or one-time security codes with someone who contacts you unexpectedly.

If information genuinely needs updating, access the relevant service through your official account.

7. Suspicious Links and Attachments

Phishing links are commonly disguised as buttons labelled Claim Refund, Verify Account, or View Tax Notice.

Clicking them may open a fraudulent website or initiate a malicious download.

Attachments can also contain harmful software intended to compromise computers or steal stored information.

Businesses are particularly exposed because employees may routinely receive invoices, financial statements, and tax-related correspondence.

An unexpected attachment claiming to contain an HMRC penalty notice should therefore be verified before opening.

If you are unsure whether a message is genuine, avoid interacting with its links or attachments.

Instead, access the relevant government service independently.

8. Messages Containing Spelling or Grammar Errors

Poor spelling, unusual sentence structures, and inconsistent formatting can indicate fraudulent communication.

Some scams contain obvious mistakes, including incorrect government department names or awkward payment instructions.

However, sophisticated criminals increasingly produce polished messages that resemble professional correspondence.

Artificial intelligence and readily available design tools can help fraudsters create convincing content.

As a result, grammatically correct messages should not automatically be trusted.

Treat writing quality as one factor rather than definitive evidence.

The sender’s identity, the purpose of the message, and its requested actions remain more important.

9. Fake WhatsApp and Social Media Messages

Criminals may impersonate HMRC through WhatsApp, Facebook, Instagram, and other platforms.

These accounts can use government logos and names resembling official departments.

Some promise tax refunds, grant payments, or assistance with outstanding liabilities.

Others direct taxpayers towards fraudulent websites.

HMRC does not use social media direct messages to offer tax rebates or request personal or financial details.

HMRC-related reminders may appear through the official UK Government WhatsApp Channel, but these are one-way alerts rather than individual conversations requesting information.

Messages claiming to offer personalised HMRC assistance through WhatsApp should be viewed with suspicion.

10. Fake Tax Penalty Notices

Fraudsters sometimes send communications claiming that taxpayers have missed an important filing deadline.

These messages may refer to Self Assessment, VAT, PAYE, or Corporation Tax obligations.

The notice might include an invented penalty amount and demand immediate payment.

Because genuine HMRC penalties exist, these scams can appear particularly credible.

However, receiving a penalty notification does not automatically mean the amount is legitimate.

Taxpayers should compare the alleged liability against their HMRC online account and official correspondence.

If necessary, contact HMRC using independently obtained details or consult a qualified accountant.

11. Suspicious QR Codes

QR codes are another method criminals use to direct people towards misleading websites.

A fraudulent letter or email may contain a QR code claiming to provide access to a payment portal.

Scanning it could lead to a website requesting personal or banking information.

Importantly, HMRC does legitimately use QR codes in certain communications.

Therefore, the presence of a QR code alone does not establish that something is fraudulent.

HMRC generally explains when a QR code directs users somewhere other than GOV.UK and does not use correspondence QR codes to send taxpayers to pages requesting personal information.

Always verify unfamiliar QR codes before using them.

12. Messages That Discourage Independent Verification

Scammers frequently attempt to prevent victims from checking whether their claims are genuine.

A caller may insist that you must remain on the telephone until payment is completed.

Others might warn that contacting an accountant or HMRC directly will delay a refund or trigger penalties.

These instructions are designed to isolate the recipient and maintain pressure.

A genuine organisation should not prevent you from independently checking its identity.

If someone discourages verification, treat that behaviour as a significant warning sign.

End the conversation and investigate through trusted channels.

How to Check Whether HMRC Communication Is Genuine

Recognising warning signs is useful, but independent verification provides stronger protection.

HMRC maintains an official list of genuine HMRC contacts, which describes selected communications issued by different departments.

The list includes examples of legitimate emails, telephone calls, letters, and text messages.

However, it does not contain every genuine HMRC communication.

Taxpayers should also check their online tax account where appropriate.

For individuals, the Personal Tax Account provides access to information about certain taxes, tax codes, and repayments.

Businesses can review relevant tax information through their official HMRC online services.

If uncertainty remains, contact HMRC using telephone numbers published on GOV.UK rather than numbers supplied in suspicious messages.

Your accountant may also be able to confirm whether a particular liability or tax notice is consistent with your records.

How to Report HMRC Scam Messages

Reporting suspicious communication helps authorities identify fraudulent activity and potentially prevent others from becoming victims.

HMRC provides different reporting routes depending on how the scam was received.

Type of scam	Reporting method
Suspicious HMRC email	Forward to phishing@hmrc.gov.uk
Suspicious HMRC text	Forward to 60599 (network charges apply)
Suspicious phone call	Use HMRC’s online reporting service
Suspicious WhatsApp message	Send a screenshot to phishing@hmrc.gov.uk
Fake HMRC social media account	Email branddefence@hmrc.gov.uk
Suspicious HMRC letter	Verify it with the relevant HMRC department

You can find the appropriate procedures through the official HMRC scam reporting service.

After reporting a fraudulent email or text, delete it from your device.

Avoid replying to suspicious senders, even if your response simply asks them to stop contacting you.

What Should You Do If You Have Already Responded?

If you have clicked a suspicious link or disclosed personal information, taking prompt action is essential.

The appropriate response depends on what information you provided and whether money was transferred.

If you disclosed banking information, contact your bank immediately using its official telephone number.

Explain what happened and ask whether additional security measures are required.

If you entered Government Gateway credentials on a fraudulent website, change your password through the genuine government service.

You should also review other accounts where the same password may have been used.

If you downloaded an attachment, perform a security scan and seek technical assistance where necessary.

Where personal information has been disclosed, notify HMRC’s security team using its published reporting arrangements.

If you have suffered financial loss, consider reporting the incident through the UK’s Report Fraud service. In Scotland, contact Police Scotland using the appropriate reporting channel.

Acting quickly may reduce further financial damage or unauthorised account activity.

Why Self-Employed Individuals and Landlords Should Be Particularly Careful

Self-employed taxpayers and landlords regularly interact with HMRC regarding tax returns, expenses, rental profits, and payments on account.

This creates opportunities for criminals to send messages that appear relevant to their circumstances.

For example, a landlord might receive an email claiming that a property tax refund requires verification.

A self-employed individual might receive a message alleging that their Self Assessment return contains errors.

Fraudsters may also refer to tax deadlines to make their communications appear urgent.

These tactics are particularly dangerous when taxpayers are already expecting correspondence from HMRC.

Maintaining accurate financial records can make verification easier.

When you understand your expected tax liabilities, payments, and refunds, unexpected demands become easier to question.

Working with a professional accountant can also provide an additional layer of protection when dealing with unfamiliar tax communications.

How Can Businesses Protect Themselves Against HMRC Scams?

Businesses should adopt practical procedures to reduce the risk of employees responding to fraudulent messages.

Staff responsible for bookkeeping, payroll, finance, or tax administration may be targeted because they regularly handle payments and confidential information.

Businesses should consider implementing the following measures:

• Train employees to recognise suspicious tax-related communication.
• Require independent verification before changing payment instructions.
• Use strong, unique passwords and available multifactor authentication.
• Restrict access to sensitive accounting and payroll information.
• Regularly update computers and security software.
• Establish clear procedures for reporting suspected fraud.

Particular attention should be given to messages requesting changes to bank details or urgent transfers.

A second person reviewing an unusual payment request may identify inconsistencies that were initially overlooked.

Companies should also maintain secure communication channels with their accountants and authorised tax advisers.

Common Misconceptions About HMRC Scam Messages

Several misconceptions can leave taxpayers unnecessarily vulnerable.

Misconception 1: HMRC never sends text messages.

HMRC does send legitimate text messages, including certain reminders and updates. The important distinction is whether the message requests sensitive information or directs you towards an unsafe action.

Misconception 2: Official logos prove authenticity.

Government logos and branding can be copied easily. Their presence does not establish that communication is genuine.

Misconception 3: A familiar telephone number guarantees legitimacy.

Criminals can manipulate caller identification information, making fraudulent calls appear to originate from trusted numbers.

Misconception 4: Scam messages always contain obvious mistakes.

Many fraudulent communications now use professional language and convincing designs. A polished appearance should not replace proper verification.

Understanding these misconceptions helps taxpayers avoid relying on misleading signs of authenticity.

Can an Accountant Help You Identify Suspicious HMRC Messages?

A qualified accountant can help taxpayers understand whether an unexpected communication relates to an actual tax obligation.

For example, if you receive a demand for additional Corporation Tax, your accountant may review previous returns and payment records to identify whether the amount appears reasonable.

Similarly, concerns about Self Assessment penalties, VAT liabilities, or unexpected repayments can often be investigated against existing records.

Accountants can also help businesses establish procedures for checking tax correspondence before payments are made.

However, no accountant can guarantee that every fraudulent communication will be identified.

The strongest protection comes from combining professional support with secure account practices and independent verification.

Where suspicious activity involves compromised login credentials or financial losses, contacting HMRC, your bank, or the appropriate reporting authority remains essential.

Practical Tips to Stay Protected Throughout the Year

Protecting yourself from HMRC scam messages should be an ongoing habit rather than something considered only during tax season.

Start by bookmarking the official government website and using that bookmark whenever you need to access tax services.

Avoid searching for tax payment websites through unfamiliar advertisements or links received in unsolicited messages.

Regularly review your HMRC account for unexpected activity and keep your contact details up to date.

Be cautious when receiving messages that combine financial rewards with strict deadlines.

If something appears unusual, take time to investigate before responding.

The National Cyber Security Centre’s guidance on reporting suspicious emails and texts also explains how potentially fraudulent communications can be reported beyond HMRC-specific scams.

Finally, share scam awareness information with employees, family members, and anyone who may be less familiar with online tax services.

A few minutes spent verifying communication can prevent considerable financial and personal difficulties.

Final Thoughts

HMRC scam messages can affect anyone, regardless of their financial knowledge or experience dealing with the tax authorities.

Fraudsters continually adapt their methods, using convincing branding, urgent payment demands, and increasingly sophisticated digital techniques.

The most important principle is simple: never allow an unexpected message to pressure you into disclosing sensitive information or transferring money without independent verification.

Be particularly cautious of unexpected refund offers, threatening telephone calls, suspicious links, and messages requesting banking details.

If you believe a communication may be fraudulent, report it through the appropriate official channels and avoid further contact with the sender.

At Taxes Done Right Ltd, we help individuals, landlords, self-employed professionals, and businesses manage their UK tax obligations with confidence.

If you have received an unexpected HMRC demand or are uncertain about a tax-related communication, our team can help you review the underlying tax position and understand the appropriate next steps.

Need professional UK tax advice?

📞 Call: 0161 710 1901

📧 Email: Tax@TaxesDoneRight.co.uk

Visit: www.taxesdoneright.co.uk

Get professional support to ensure your business expenses are recorded correctly and your tax position is managed efficiently.