HMRC scam emails, texts and calls: how to tell if it's really HMRC

You can't reliably tell a real HMRC message from a fake by how it looks, so don't try. If an email, text or call mentions a tax refund, a penalty or money you owe, ignore its links and contact details, go to GOV.UK yourself and sign in to your HMRC online account. If HMRC really needs something from you, that's where you'll find it.

That matters most in the run-up to 31 January. For the 2025 to 2026 tax year, online Self Assessment returns and payment are due by 11:59pm on 31 January 2027, and scammers know a deadline makes people hurry.

What does HMRC really do, and what will it never do?

HMRC does contact people by email, text and phone, so a message isn't fake just because it claims to be from HMRC. What gives scams away is what they ask for. GOV.UK's guidance on identifying tax scams lists the warning signs. A message could be a scam if it:

• rushes you
• is threatening
• is unexpected
• asks for personal information like bank details
• tells you to transfer money
• offers a refund, tax rebate or grant

The same guidance says HMRC will never leave a voicemail threatening legal action, never threaten arrest, and never ask you to pay with gift or payment vouchers. It also says HMRC won't use social media to offer a tax rebate or ask for personal or financial information, and that it uses WhatsApp only for one-way government channel alerts.

On email, HMRC's published examples page says it will only ever email you about a tax rebate, or ask for personal or payment information, from an address ending in hmrc.gov.uk. It adds a warning worth repeating: scammers can spoof a genuine address or change the display name. So a correct-looking sender is not proof on its own.

Real HMRC vs scam: a side-by-side check

The quickest way to judge an HMRC message is to compare what it asks you to do with how HMRC normally works.

What does a fake HMRC tax refund email look like?

A fake HMRC tax refund email usually promises a specific sum of money, sets a short deadline and sends you to a page that asks for your bank or card details. Here's a made-up example, with the clues marked.

You can see more lures like this, including a tax refund one, with their red flags in our free common phishing lures gallery.

Which HMRC scams target small businesses?

Businesses get the same refund and penalty scams as individuals, plus versions built around VAT, PAYE and company filings, because those involve bigger sums and more people who can pay.

Tax refund emails and texts

These are the classic version: a refund is waiting, click to claim. GOV.UK says HMRC does text some customers, but advises against opening links in, or replying to, a text claiming to be from HMRC, and flags texts that offer a refund in exchange for personal or financial details.

“Penalty” and “arrears” threats

The flip side of the refund lure is fear: you've missed a deadline, a penalty has been issued, pay now to avoid court. The message often includes a reference number and a payment link or new bank details. A real penalty will show up in your HMRC account, so check there and nowhere else.

Fake HMRC calls threatening arrest

HMRC's examples page describes an automated phone scam that says HMRC is filing a lawsuit against you, and its advice is to end the call immediately. Some scam calls offer a refund and ask for bank or card details instead. A number on your screen that looks right is not proof, as caller ID can be faked. If you can't verify who's calling, don't talk to them. See vishing for how phone scams work more generally.

VAT and PAYE scams aimed at businesses

Finance and payroll staff may see emails about a “VAT refund”, a VAT account that needs “re-activating”, or PAYE arrears for the company. Some go after the HMRC business account sign-in rather than money, because access to it is valuable in itself. Genuine HMRC emails of this kind, according to GOV.UK's list of genuine HMRC emails, won't ask for personal, company or financial information. Treat any request to pay HMRC into a new account the way you'd treat supplier bank detail changes: stop and verify.

Fake Companies House notices (briefly)

Companies House isn't HMRC, but directors get both. Companies House's scam guidance says real emails come from an address ending “.gov.uk”, lists asking for an authentication code as a sign of a scam, and describes fake emails telling directors to “verify your identity now”. Report them to phishing@companieshouse.gov.uk.

How is AI changing HMRC scams?

AI tools let scammers write HMRC messages with clean grammar, an official tone and your real name and company details, so the old advice to look for spelling mistakes no longer works on its own.

A scammer can pull a director's name and company from public records and produce a polished, personal “VAT review” email in seconds. None of that changes what the scam needs from you: a click, a login, a payment or a code. Judge the request, not the writing. We go into this in more depth in how to spot AI-written phishing emails.

How do I check if an HMRC message is real?

The safe way to check an HMRC message is to go round it: use a route you chose, never one the message gave you.

1. Don't click, reply or call back. Leave the links, buttons, QR codes and phone numbers in the message alone.
2. Go to GOV.UK yourself. Type gov.uk into your browser or use a bookmark you made earlier, then sign in to your HMRC online account (personal or business) from there, or use the official HMRC app.
3. Look for the same thing in your account. A real refund, penalty, VAT or PAYE issue will be there. If it isn't, that's a strong sign the message was fake.
4. Check GOV.UK's lists. HMRC publishes a page of genuine HMRC emails and a list of genuine HMRC contacts. If a message isn't on them, be extra careful.
5. Ask someone. Your accountant or a colleague can give you a second opinion.

How do I report an HMRC scam?

You report HMRC scams to HMRC directly, using the channel that matches how the scam reached you. These are the routes on GOV.UK's report scam HMRC messages page:

• Email: forward it to phishing@hmrc.gov.uk, then delete it.
• Text message: forward it to 60599 (you'll be charged at your network rate).
• WhatsApp or another app: take a screenshot and email it to phishing@hmrc.gov.uk.
• Phone call: report it using HMRC's online form for suspicious calls, linked from that page.
• Letter: contact the HMRC team the letter says it's from, using contact details from GOV.UK.
• Social media account: email the details to branddefence@hmrc.gov.uk and don't reply.

You can also forward any suspicious email to the NCSC's service at report@phishing.gov.uk, and any suspicious text to 7726, which is free. If your team uses Gmail, our guide to reporting phishing in Google Workspace shows how to flag it internally too, so colleagues are warned.

What if I've already clicked or replied?

If you've already clicked or replied, act quickly and tell someone; it happens to careful people. If you gave personal information, GOV.UK says to email brief details of what you disclosed (for example name, address, HMRC user ID or password) to phishing@hmrc.gov.uk, without including the personal details themselves. If you entered bank or card details, call your bank using the number on your card, or 159. If you've lost money, report it to Report Fraud at reportfraud.police.uk (or Police Scotland on 101 in Scotland). Our clicked-a-phishing-link checklist covers passwords and next steps.

Spotting a fake HMRC email is a habit, and habits come from practice. Lureproof gives small teams a monthly hands-on assessment, including spotting lookalike domains and fake login pages, and realistic practice emails for Google Workspace teams. If you'd like to start without signing up, our free security training has 11 short lessons anyone on your team can take.

FAQ