By clicking a retailer link you consent to third party cookies that track your onward journey. If you make a purchase, Which? will receive an affiliate commission which supports our mission to be the UK's consumer champion.

24 Jan 2024

Tax scams: watch out for fake HMRC calls, texts and emails

Reports of scammers impersonating the tax office are rising

Tali Ramsey

If you're putting the final touches to your tax return ahead of next week's deadline, you'll need to be on your guard against scammers impersonating HM Revenue and Customs (HMRC).

The tax office is regularly targeted by fraudsters sending out dodgy emails, texts and letters, and making scam calls to unsuspecting taxpayers.

In the year to November 2023, HMRC received more than 200,000 reports of scams from members of the public, up 9% year-on-year.

Read on for the lowdown on the latest tactics used by scammers impersonating HMRC.

Sign up for scam alerts

Our emails will alert you to scams doing the rounds, and provide practical advice to keep you one step ahead of fraudsters.

Scam calls

Automated calls are among the most common types of tax scam.

In 2023, HMRC worked with Ofcom to remove 324 phone numbers that were being used for tax office impersonation scams.

Dodgy calls commonly come from withheld numbers or mobile numbers, and contain an 'urgent' pre-recorded message for the recipient.

One example involves an automated message stating: ‘An important letter was sent to you from HM Revenue and Customs that requires immediate attention, please press 1'.

We've also received reports of calls stating the recipient has underpaid tax, is subject to legal action, or that an important document has been returned to HMRC.

If you receive a scam call, don't press anything and hang up. If you do follow the automated prompt, you'll be put through to a scammer who will request your personal and financial details.

Find out more: how to get your money back after a scam

Impersonation emails

Scammers are also sending out dodgy emails claiming you need to log into your tax account or are due a tax refund.

Most recently, we've seen examples of scam emails around P800s, an annual tax calculation that HMRC sends via post. These emails come from the fake address noreply@hmc.co.uk – note the missing 'r' in HMRC.

The emails contain an attachment to download a document. If you do so, a virus may be installed on your device.

Delete the email and follow the steps outlined below to report it.

Dodgy texts

HMRC says a third of reports of 'suspicious contact' it received in the year to November 2023 related to messages about bogus tax rebates.

Fake HMRC texts have long been in circulation. One recent example states the recipient has 'an outstanding tax refund' and includes a link to 'follow instructions to claim your money'.

This link leads to a phishing website that will request your personal and financial information.

HMRC told Which? that anyone who receives an unexpected message claiming to be from the tax office shouldn't respond immediately.

Fraudsters often try to rush victims into action, so it advices that recipients take their time to check if the message is a scam. HMRC provides advice on common types of scam.

Reporting HMRC scams

You can help protect others by reporting scam attempts.

Text messages: report scam text messages by sending them to 60599. You can also forward them to the National Cyber Security Centre on 7726. You can report scam WhatsApp messages by pressing and holding the message before selecting ‘report’.
Emails: forward scam emails to phishing@hmrc.gov.uk with a subject line describing the email. You can also select ‘report spam’ on Gmail, ‘report phishing’ on Hotmail or send scam emails to abuse@yahoo.com if you’re using a Yahoo account.
Letters: report scam HMRC letters by contacting the HMRC team the letter says it’s from – eg. debt management. You can also report scam letters to Royal Mail.
Calls: you can report scam calls received on your mobile to 7726. You can also share them with HMRC online. You'll be asked to sign in using your Government Gateway User ID or your email address.
Websites: suspicious websites should be reported to the NCSC.