Examples of HMRC related phishing emails, suspicious phone calls and texts
Updated 22 April 2024
© Crown copyright 2024
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/phishing-and-bogus-emails-hm-revenue-and-customs-examples/phishing-emails-and-bogus-contact-hm-revenue-and-customs-examples
To help our investigations report all HMRC related phishing emails, suspicious phone calls and text messages.
Even if you get the same or similar scam contacts often, report them.
Do not open attachments or click any links in an unexpected email or text message, as they may contain malicious software or direct you to a misleading website.
Delete any emails or texts once you’ve reported them.
QR codes
HMRC uses QR codes in our letters and correspondence. The QR code will usually take you to guidance on GOV.UK. We will tell you if the QR code takes you anywhere else.
You will never be taken to a page where you have to input personal information.
When you are logged into your HMRC account, we may use QR codes to redirect you. For example, to take you to your bank’s login page.
If we’re using QR codes in communications you’ll be able to see them on the genuine HMRC contacts page.
To help fight phishing scams, send any suspicious emails containing QR codes to phishing@hmrc.gov.uk then delete them.
Text messages
HMRC does send text messages to some of our customers.
In the text message we might include a link to GOV.UK information or to HMRC webchat.
HMRC will never ask for personal or financial information when we send text messages.
We advise you not to open any links or reply to a text message claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details.
To help fight phishing scams, you should send any suspicious text messages to 60599 (network charges apply) or email phishing@hmrc.gov.uk then delete them.
Image showing an example of a scam HMRC text message which is trying to get you to click on a hyperlink and enter personal details.
Coronavirus (COVID-19) scams
Text scams
‘COVID-19 refund’ SMS
Beware of various text scams offering an HMRC tax refund in connection with the COVID-19 pandemic.
Do not reply to the text and do not open any links in the message.
Tax refund and rebate scams
Emails
HMRC will never send notifications by email about tax rebates or refunds.
Do not:
- click on the links to visit a website mentioned in a ‘tax rebate’ email
- open any attachments
- disclose any personal or payment information
Fraudsters may spoof a genuine email address or change the ‘display name’ to make it appear genuine. If you are unsure, forward it to us and then delete it.
Example of a phishing email and misleading website
Image showing an example of a scam email with a hyperlink which directs you to a phishing website.
Image showing an example of a phishing website designed to trick you into disclosing personal information.
Suspicious phone calls
HMRC is aware of an automated phone call scam which will tell you HMRC is filing a lawsuit against you, and to press 1 to speak to a caseworker to make a payment. This is a scam and you should end the call immediately.
Other scam calls may refer to National Insurance number fraud or offer a tax refund and ask you to provide your bank or credit card information. If you cannot verify the identity of a caller, we recommend that you do not speak to them.
If you’ve been a victim of a scam and suffered financial loss, report it to Action Fraud.
Phishing calls use a variety of phone numbers. To help us investigate, share call details on our suspicious phone call reporting form. Include the:
- date of the call
- phone number used
- content of the call
WhatsApp messages
If you have subscribed to the UK Government channel on WhatsApp you will receive updates that might include occasional tax-related reminders. These will be single message alerts and you will not be able to reply.
HMRC will not communicate with you for any other reason using WhatsApp.
Social media scams
HMRC is aware of direct messages sent to customers through social media.
A recent scam was identified on X (formerly Twitter) offering a tax refund.
These messages are not from genuine HMRC social media accounts and are a scam. We never use social media to:
- offer a tax rebate
- request personal or financial information
If you cannot verify the identity of a social media account, send the details by email to: phishing@hmrc.gov.uk and ignore it.
Refund companies
HMRC is aware of companies that send emails or texts offering to claim tax refunds or rebates on your behalf, usually for a fee. These companies are not connected with HMRC in any way.
You should read the ‘small print’ and disclaimers before using their services.
HMRC customs duty scams
HMRC is aware of a text and email scam where the customer is told they must pay customs duty to receive a valuable parcel which does not exist.
These scams should not be confused with changes introduced on 1 January 2021, advising that some UK consumers buying goods from EU businesses might need to pay customs charges when their goods are delivered. Find out more about these new rules on GOV.UK.
If in doubt, we advise you not to reply to anything suspicious, but to email HMRC at phishing@hmrc.gov.uk straight away and read HMRC phishing and scams guidance.