HMRC phishing scams – how to spot and avoid bogus communications

Rising scam activity around HMRC

Stay alert this tax season.

As the tax return deadline approaches, HMRC warns that fake emails, calls and messages claiming to be from the tax authority tend to surge. In 2025 alone, more than 4,800 Self-assessment scams were reported, for example, in the 10 months leading up to December 2025, HMRC received over 135,500 reports of suspected scams. Scammers frequently make contact through email, text or phone pretending to be HMRC or another “official” organisation.

HMRC email and text scams

Phishing emails remain one of the most common threats. Scammers often replicate HMRC branding and email addresses so convincingly that messages appear genuine at first glance. These attacks aim to steal personal data, bank details or login credentials.

What these scams look like 

Scammers may:

• Ask you to pay tax or “check what you owe”
• Request personal or financial information
• Send convincing links
• Use urgent or threatening language to pressure you

If something feels off, above all, pause before responding. You can see examples of bogus HMRC correspondence on GOV.UK.

If you receive an unexpected email claiming to be from HMRC, do not reply, click links or open attachments. Forward suspicious emails to phishing@hmrc.gov.uk or suspicious texts to 60599 (at standard network rate) before deleting.

How to check if correspondence is genuine

Before acting on any unexpected contact:

• Be cautious with links: HMRC never asks for personal or financial information via text or email
• Check the sender’s address or number for subtle errors (for example “rnicrosoft” instead of “microsoft”)
• Ignore messages demanding immediate payment or threatening action
• Never share bank details, passwords or security codes

Other common HMRC phishing scams:

Fake tax rebate offers

A long‑running scam involves texts or emails offering a tax rebate. HMRC will never contact anyone by text or email about tax refunds. Any such message is fraudulent. Report it to HMRC and delete it.

Malicious links and fake web pages

Scammers also use social media platforms to send direct messages offering tax refunds or requesting personal information. HMRC does not use X (Twitter), Instagram, Facebook, LinkedIn or similar platforms to issue rebates or request sensitive details. Ignore and report these messages immediately.

HMRC refund companies

Some companies advertise tax refund services via email or text, offering to claim a rebate on your behalf for a fee. These businesses are not connected with HMRC. Always review their terms and conditions carefully and consider seeking advice from a qualified accountant if unsure.

HMRC customs duty scams

Post‑Brexit customs rules mean some UK consumers may still need to pay customs charges on goods purchased from EU businesses. Scammers exploit this by sending convincing emails, texts or WhatsApp messages claiming that a parcel cannot be delivered until a “customs fee” is paid. These messages often link to fake payment pages. HMRC will never ask for payments or personal information by text or email. Forward suspicious messages to phishing@hmrc.gov.uk.

Students and young workers targeted

HMRC continues to warn that university students and young people taking part‑time or seasonal work are frequently targeted, especially if they are unfamiliar with the tax system. Scammers may claim the individual owes tax, is due a refund or must provide personal details urgently. Treat any unexpected contact with caution and report suspicious messages to phishing@hmrc.gov.uk.

Protect yourself from scams

To verify your tax position, always:

• Log in directly through the official HMRC website
• Avoid clicking links in unsolicited messages
• Review HMRC’s guidance on spotting scams

HMRC’s advice

An HMRC spokesperson said:

“We see high numbers of fraudsters contacting people claiming to be from HMRC. If in doubt, our advice is – do not reply directly to anything suspicious but contact HMRC through GOV.UK straight away and search GOV.UK for ‘HMRC scams’.”

For further guidance, visit HMRC’s official page or contact your local Perrys branch.

If you’re unsure whether a message is genuine, contact Perrys. We can help check the legitimacy of the communication or point you in the right direction for verification. It’s always better to double‑check.