Tax scams: verifying a message from HMRC

A message claiming to come from HMRC should be verified through an independent official route before you use links, disclose information or make a payment. Familiar logos, caller identification and quoted personal details do not prove authenticity.

Preserve the suspicious message without forwarding sensitive material widely. Check the genuine account position separately so a scam does not distract from a real tax obligation.

Pause before acting on an unexpected demand

Read the message without following its links, opening unexpected attachments or making a payment. Note what it asks you to do and whether it uses urgency, threats, a refund offer or a request for personal information. HMRC's scam guidance identifies these as warning signs and directs people to check genuine contact information. ^[1] A message quoting your name or a tax reference still needs verification through a trusted route.

Preserve the message in a way that does not spread it widely. Keep the sender details, time, subject and relevant screenshot or voicemail information. For a business, alert the person responsible for tax correspondence and the appropriate security contact. Avoid forwarding a suspicious attachment to several colleagues for opinions; a short description and safe evidence can be reviewed under the organisation's established process.

Check the claim independently

Open your tax account through a known official route or obtain HMRC contact details independently from GOV.UK. Compare the claimed tax, period and amount with genuine notices and account records. If the message refers to an adviser or colleague, contact that person using details already known to you. Do not verify a new bank instruction by replying to the same message that supplied it.

HMRC does use some electronic communications, so simply deciding that every text is fake is not a reliable verification method. Its published guidance explains genuine contact patterns and warning signs, including threatening calls. ^[1] The safer question is whether the particular request can be confirmed independently without exposing information or sending money through the unverified channel.

Treat account access and payments as separate risks

Do not provide passwords, one-time codes or recovery details to a caller or message sender. A link labelled as a refund portal may be designed to capture credentials rather than issue a payment. If you need to check a real repayment, use the official account and the existing claim record. HMRC repayment delays: keeping supporting records explains how to distinguish a pending repayment from one that has actually been approved and paid.

For payment requests, verify the tax reference and official payment method before acting. A genuine outstanding debt can coexist with a fraudulent message about it, so the existence of a tax bill does not authenticate the sender. Keep the payment approval process in place even where the request appears urgent or comes from a familiar-looking email thread. Confirm changed instructions through a separate trusted contact.

Report the message through the appropriate route

HMRC publishes different reporting instructions for suspicious emails, texts, calls, letters and social media messages. Its guidance includes forwarding suspicious emails to phishing@hmrc.gov.uk and texts to 60599, with the stated network-charge position checked before using that route. ^[2] Follow the current official instructions for the type of contact received rather than replying to the suspicious sender or using a reporting address copied from the message itself.

If personal details have already been disclosed, HMRC asks for a brief description of what was shared without repeating the actual sensitive details in the report. ^[2] Keep a record of the report and any action taken. Where money or banking information is involved, contact the bank promptly through a trusted channel and follow its incident instructions. Do not wait for a tax enquiry response before addressing an active account-security problem.

Restore a clear view of genuine tax obligations

After the suspicious contact is dealt with, check whether any real return, payment or response remains due. Separate the scam record from the genuine HMRC correspondence while linking them where useful. A fraudulent demand can distract from an existing deadline, especially if the taxpayer assumes every related letter must now be false. Verify each genuine obligation from the official account or confirmed correspondence.

For assistance organising the tax records and clarifying a genuine account query, see HMRC enquiry response support. Explain that authenticity has been checked and provide the verified notice through the agreed process. An adviser can help with the tax position, while bank, account-security or fraud-reporting actions may need their own appropriate channels. Avoid sending unnecessary personal details in an initial website enquiry about the suspicious message.

Keep a short incident note describing the warning sign, verification route, outcome and any follow-up required. For businesses, use the factual lesson to update staff instructions on changed payment details and tax messages. The goal is a repeatable checking process that works even when a future message looks more convincing than the one already identified.

Illustrative scenario

A taxpayer receives a text promising a refund through a link. They avoid the link, use the official HMRC service independently and follow the published reporting process for the suspicious message.

Preparation checklist

• Avoid unverified links
• Use an independent official route
• Protect credentials and payment details
• Report the suspicious contact