How to avoid HMRC scam emails and phone calls

Individuals are frequently the target of HMRC scam email and phishing campaigns, which attempt to obtain taxpayers’ personal and banking details by masquerading as official HMRC documentation, offering tax rebates and refunds. However, email is not the only channel through which scams can occur – text messages, telephone and social media are all ways in which scammers will try to extract financial detail.

So, how can you identify a scam email as opposed to official HMRC correspondence? And, what should you do if in receipt of bogus communication? Here’s a guide to what to watch out for, and best practices to follow while conducting your tax affairs on and offline.

The number one rule

The number one rule when protecting your personal information is to never disclose private information in response to communication that you’re not sure is genuine.

How to identify an HMRC scam email

With regard to tax matters, HMRC has said that it will never use emails (or text messages) to notify taxpayers of tax rebates or penalties, or to request personal or payment information.

According to HMRC, the email addresses below are scam emails, and therefore taxpayers should neither visit the website within the email nor disclose personal information of the following:

• HM-Revenue-&-Customs@ztoro.com
• rebate@hmrc.gov.uk
• alert@hmrc.gov.uk
• refund-help@hmrc.gov.uk
• refunds@hmrc.gov.uk
• secure@hmrc.co.uk
• service.refund@hmrc.gov
• taxrefund@hmrc.gov.uk
• taxrefund-notice@hmrc.gov.uk

Scam emails will often take taxpayers to an online form, asking for personal information, such as name, address, date of birth, account number, sort code, card number, card expiry date and card security code. They may even generate a false tax refund number. While designed to look like genuine HMRC communication, never disclose personal information in an online form to which you have been directed from a supposed HMRC email.

HMRC scams emails may contain a downloadable attachment in PDF format, which taxpayers are encouraged to access in pursuit of a tax refund. Again, taxpayers should neither download the attachment nor respond to the email.

Individuals may also receive emails relating to customs, requesting payment before goods are released. Goods referred to in these emails include lottery winnings or other prize money, seized goods, certificates or bonds and inheritance payments. These emails frequently use the name of a genuine HMRC employee to sign off the email.

How to identify an HMRC text message scam

HMRC does issue text messages from time to time, yet messages will never ask for personal details or financial information. If you receive a message asking for such details, never respond, and do not open message links, including those claiming to direct you to a form to process your tax refund.

How to identify an HMRC phone call scam

HMRC phone call scams often target the vulnerable and elderly, with taxpayers being requested to provide bank details under the threat of police involvement if they refuse. If you are unsure of the identity of the individual, do not engage with the call, and never disclose your personal details.

How to identify a social media scam

Requests for information are never sent by HMRC via social media. If in receipt of a message on social media asking for information, it will have been sent from a fake HMRC account, therefore you should not respond in any way.

Responding to HMRC scams

HMRC guidance asks taxpayers to forward any suspected scam emails, text messages or social media messages to phishing@hmrc.gsi.gov.uk and then delete the original email. Text message scams can also be forwarded to 60599 (these messages are subject to network charges).

If a scam has resulted in financial loss, individuals can report the incident to Action Fraud.

HMRC has asked that all emails and communication suspected of being a scam are forwarded to HMRC, even if the same communication is received multiple times. If you are in doubt as to the validity of any correspondence, the HMRC phishing team will be able to determine whether the communication is genuine. A list of official government websites and phone numbers can be found here.

If you believe that you may have disclosed personal details, contact the HMRC security team at security.custcon@hmrc.gsi.gov.uk with a brief description of the type of information revealed, but do not provide personal details in the email.

Protecting yourself against HMRC scams

There are several measures that taxpayers can take to reduce the risk of becoming a victim of an HMRC scam:

• Taxpayers can review the email address of the sender, as addresses often closely follow genuine HMRC email addresses, but with slight differences
• If the communication has asked for “urgent action” or similar, taxpayers should be wary
• Do not open any attachments or click on any links in the body of the email
• Scam emails frequently use a generic email greeting, such as “Dear Customer”. Legitimate communication from HMRC will most likely use your name, and details on how to report phishing emails to HMRC

The critical point to remember is the number one rule: if an email doesn’t seem right, or you’re unsure as to the identity of the sender or caller, do not engage or respond, but notify HMRC at the relevant contact address.