HMRC Scam: How to Spot Fake HMRC Calls, Texts and Emails

An HMRC scam is a call, text, email, letter or social media message from criminals pretending to be HM Revenue and Customs, usually promising a tax refund or threatening arrest over unpaid tax. HMRC won’t threaten you with immediate arrest, demand payment by gift card or crypto, or send a text link to “claim” a refund. If a message does any of that, don’t reply or click: forward texts to 7726, emails to report@phishing.gov.uk, and check your tax position by signing in to your HMRC account through GOV.UK yourself.

These scams work because tax feels official and a little frightening, and because a refund sounds like good news. The scammer may know your name, your employer or your address. None of that proves anything. Being targeted doesn’t mean you did something wrong, and falling for one doesn’t make you foolish: HMRC impersonation is run by organized groups who send the same messages to huge numbers of people.

How the real HMRC contacts people

GOV.UK has a dedicated page on recognizing genuine HMRC contact. It lists the phone calls, texts, emails and letters HMRC actually sends, and it’s worth checking whenever you’re unsure, because the list changes over time. In general terms, HMRC’s published guidance says:

• Refunds aren’t announced by text or email with a link. If you’re due money back, it shows up in your HMRC online account or through the normal Self Assessment or PAYE process.
• It doesn’t ask for personal or payment details by text or email. Genuine messages that do arrive generally point you to GOV.UK rather than to a link that asks you to log in.
• It doesn’t threaten immediate arrest or say the police are on their way.
• It doesn’t demand payment by gift card, voucher, crypto or transfer to a personal account. Real tax is paid through the payment routes listed on GOV.UK.

HMRC does sometimes phone, write and send texts, for example about a Self Assessment return, tax credits or a debt you already know about. That’s why the safest habit isn’t “HMRC never calls” but “I’ll check this myself”. Hang up or ignore the message, then sign in to your HMRC online account or the official HMRC app, or contact HMRC using details you find on GOV.UK.

Common versions of the HMRC scam

The wording changes all the time, but most HMRC scams follow a handful of patterns.

Version	How it usually looks
Tax refund text or email	A message says you’re owed a rebate and links to a copy of a GOV.UK page that asks for your bank or card details, or your HMRC login.
Arrest threat call	A recorded message or caller says there’s a warrant or legal case against you for unpaid tax, and you must press a key or pay today to stop it.
National Insurance number “suspended”	A call claims your National Insurance number has been used in a crime and will be blocked unless you “verify” details or move money.
Self Assessment deadline pressure	Emails around the filing deadline warn of penalties and link to a fake payment or login page.
WhatsApp or social media messages	An account using HMRC branding offers help with a refund or a problem with your tax code, then asks for details or payment.
Fake refund “agents”	A company offers to claim a refund for you, then takes a large fee or asks for your login so it can change where the money goes.

Scams that pose as other government bodies work in the same way. If you’ve had a message about a vehicle tax refund or a driving licence problem, our guide to DVLA scams covers that version. Fake TV Licensing refund and “your licence has expired” messages follow the same pattern, as our TV Licence scam guide explains.

Warning signs of an HMRC scam

• Urgency and threats. Arrest, court, frozen bank accounts or a blocked National Insurance number, all “today”.
• A refund you weren’t expecting that you can “claim” by tapping a link.
• Requests for card details, bank logins or one-time codes. HMRC doesn’t need your card number to pay you a refund.
• Unusual payment methods. Gift cards, vouchers, crypto or transfers to a “safe account”.
• Instructions to stay on the line or not to tell your bank what the payment is for.
• Caller ID that shows a real-looking number. Numbers can be spoofed, so caller ID proves nothing. Our guide to vishing explains how phone impersonation works.
• Small errors in the web address. A page can copy GOV.UK’s look exactly while sitting on a different domain.

What to do right now

1. Stop contact. Hang up, don’t reply to the text or email, and don’t open attachments or links.
2. Check your real tax position. Type GOV.UK into your browser yourself, sign in to your HMRC online account or open the official HMRC app, and look for any genuine messages, balances or refunds. If nothing matches what you were told, you have your answer.
3. If you paid or shared card or bank details, call your bank straight away using the number on your card or in your banking app. Say you’ve been the victim of fraud and ask it to stop or recall the payment and block your card.
4. If you entered your HMRC login, change that password, turn on or review your two-step verification, and contact HMRC through GOV.UK so it can check your account for misuse.
5. If you shared your National Insurance number, date of birth or ID, watch for signs of identity misuse. Our guide on identity theft in the UK covers credit reference agency checks and other protective steps.
6. If you gave someone remote access to your computer or phone, disconnect it from the internet, change passwords from a different device and get the device checked.
7. Save the evidence. Screenshot the message, the sender’s number or address, any web page and payment receipts before you delete anything.

Where to report an HMRC scam

Reporting helps block scam numbers and websites, and it gives police a record. You can use several of these routes; they do different jobs.

• Scam texts: forward the message to 7726, which is free on most UK networks and reports it to your mobile provider.
• Scam emails: forward them to report@phishing.gov.uk, the National Cyber Security Centre’s reporting address, which can take down scam websites.
• HMRC itself: GOV.UK explains how to forward suspicious HMRC-themed emails and texts to HMRC’s own phishing team and how to report calls. Follow the current instructions on GOV.UK rather than any details in the scam message.
• Report Fraud: if you lost money or shared details, report it to Report Fraud (formerly Action Fraud), the national fraud reporting service for England, Wales and Northern Ireland, online at reportfraud.police.uk or on 0300 123 2040. Our guide on how to report to Report Fraud walks through what to include. In Scotland, report to Police Scotland on 101.
• Social media: report fake HMRC accounts to the platform using its built-in reporting tool.

For every reporting route in one place, including other countries, see our guide on how to report a scammer.

Can you get your money back?

It depends on how you paid and how quickly you tell your bank.

• Bank transfer: UK rules brought in during 2024 require most banks and payment firms to reimburse many victims of authorized push payment scams made by Faster Payments, with some exceptions. Report it to your bank as soon as you can.
• Debit or credit card: your card provider may be able to block or dispute the payment, especially if you act quickly.
• If your bank says no: you can make a complaint to the bank, and if you’re still unhappy, take it to the Financial Ombudsman Service, which is free.
• Gift cards and crypto: contact the card issuer or exchange immediately, but these payments are often hard or impossible to reverse.

Be wary of anyone who contacts you afterward offering to recover your money for a fee, including people claiming to work for HMRC, the police or a “fraud recovery” firm. These are recovery scams, and they target people who’ve already been hit once.

A worked example

This is an illustrative scenario, not a real case. Priya, a freelance designer, gets a text in late January saying she’s due a tax refund and has 24 hours to claim it. The link opens a page that looks exactly like GOV.UK and asks for her card number “to process the refund”.

1. Priya starts typing, then pauses: she files Self Assessment and doesn’t expect a refund. Why would HMRC need her card to pay her?
2. She closes the page, types GOV.UK into her browser and signs in to her HMRC account. There’s no refund and no message.
3. She forwards the text to 7726 and checks GOV.UK’s page on genuine HMRC contact, which confirms refund texts with links aren’t how HMRC works. She follows its instructions for reporting the message to HMRC too.
4. Because she had typed part of her card number, she calls her bank on the number on the back of her card. The bank notes it and sends her a new card as a precaution.

Priya lost nothing because she stopped to check. If she had submitted the details and seen a payment go out, calling the bank first and then reporting to Report Fraud would have been the right order.

How to protect yourself next time

• Use your HMRC online account or the official HMRC app as your single source of truth for what you owe or are owed.
• Bookmark GOV.UK and reach HMRC through it, never through a link in a message.
• Turn on strong two-step verification for your government login and email.
• Be extra careful around deadlines, such as the Self Assessment filing season, when scam volumes tend to rise.
• Use a regulated accountant if you want help with a refund, rather than a firm that finds you through a cold call or text.
• Talk to family members, especially older relatives and people new to the UK tax system, who are often targeted with arrest threats.

Scammers sometimes copy the names of real accountants or tax advisers to look credible. If your practice is being impersonated and complaints are starting to appear when people search your name, our personal reputation management team can help you see what’s showing up and what can be corrected.

Common mistakes to avoid

• Calling back the number in a voicemail or text. It usually goes straight to the scammer. Use contact details from GOV.UK.
• Trusting caller ID or a real-looking web page. Both are easy to fake.
• Ignoring genuine HMRC letters out of fear. Real letters matter. Verify them through your HMRC account or GOV.UK, then respond.
• Deleting the message before reporting it. Forward and screenshot it first.
• Waiting before calling your bank. The faster the bank knows, the better the chance of stopping a payment.

Frequently asked questions

Does HMRC send texts about tax refunds?

HMRC’s guidance says it doesn’t send texts or emails telling you about a refund and asking you to click a link to claim it. Refunds show up in your HMRC online account. Treat a refund text with a link as a scam and forward it to 7726.

Will HMRC ever call me?

Yes, HMRC does sometimes phone people, but it won’t threaten immediate arrest or demand payment by gift card, voucher or crypto. If you’re unsure, hang up and contact HMRC using details you find on GOV.UK yourself.

How do I check if HMRC contact is genuine?

GOV.UK has a page describing the calls, texts, emails and letters HMRC actually sends. Compare what you received with that list, and check your HMRC online account or the official HMRC app for matching messages.

What should I do if I gave my bank details to an HMRC scammer?

Call your bank immediately using the number on your card, say you’ve been the victim of fraud, and ask it to block the card and stop any payments. Then report the scam to Report Fraud, or Police Scotland if you live in Scotland.

Is an HMRC scam call about my National Insurance number real?

A call saying your National Insurance number has been suspended or linked to a crime, and asking you to verify details or move money, is a common scam pattern. Hang up and don’t give any information.