Guidance

Examples of HMRC related phishing emails, suspicious phone calls and texts

Updated 31 January 2024

To help our investigations report all HMRC related phishing emails, suspicious phone calls and text messages.

Even if you get the same or similar scam contacts often, report them.

Do not open attachments or click any links in an unexpected email or text message, as they may contain malicious software or direct you to a misleading website.

Delete any emails or texts once you’ve reported them.

QR codes

HMRC uses QR codes in 2 different ways:

  • in our letters and correspondence we sometimes use QR codes but only to take you to guidance on GOV.UK — we will not take you to a page where you have to input personal information

  • when you are logged into your HMRC account we might use QR codes to redirect you, for example to your bank login page

If we’re using QR codes in communications you’ll be able to see them on the genuine HMRC contacts page.

To help fight phishing scams, send any suspicious emails containing QR codes to phishing@hmrc.gov.uk then delete them.

Text messages

HMRC does send text messages to some of our customers.

In the text message we might include a link to GOV.UK information or to HMRC webchat.

HMRC will never ask for personal or financial information when we send text messages.

We advise you not to open any links or reply to a text message claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details.

To help fight phishing scams, you should send any suspicious text messages to 60599 (network charges apply) or email phishing@hmrc.gov.uk then delete them.

Image showing an example of a scam HMRC text message which is trying to get you to click on a hyperlink and enter personal details.

Coronavirus (COVID-19) scams

Text scams

‘COVID-19 refund’ SMS

Beware of various text scams offering an HMRC tax refund in connection with the COVID-19 pandemic.

Do not reply to the text and do not open any links in the message.

Tax refund and rebate scams

Emails

HMRC will never send notifications by email about tax rebates or refunds.

Do not:

  • click on the links to visit a website mentioned in a ‘tax rebate’ email
  • open any attachments
  • disclose any personal or payment information

Fraudsters may spoof a genuine email address or change the ‘display name’ to make it appear genuine. If you are unsure, forward it to us and then delete it.

Example of a phishing email and misleading website


Image showing an example of a scam email with a hyperlink which directs you to a phishing website.


Image showing an example of a phishing website designed to trick you into disclosing personal information.

Suspicious phone calls

HMRC is aware of an automated phone call scam which will tell you HMRC is filing a lawsuit against you, and to press 1 to speak to a caseworker to make a payment. This is a scam and you should end the call immediately.

Other scam calls may refer to National Insurance number fraud or offer a tax refund and ask you to provide your bank or credit card information. If you cannot verify the identity of a caller, we recommend that you do not speak to them.

If you’ve been a victim of a scam and suffered financial loss, report it to Action Fraud.

Phishing calls use a variety of phone numbers. To help us investigate, share call details on our suspicious phone call reporting form. Include the:

  • date of the call
  • phone number used
  • content of the call

WhatsApp messages

If you have subscribed to the UK Government channel on WhatsApp you will receive updates that might include occasional tax-related reminders. These will be single message alerts and you will not be able to reply.

HMRC will not communicate with you for any other reason using WhatsApp.

Social media scams

HMRC is aware of direct messages sent to customers through social media.

A recent scam was identified on X (formerly Twitter) offering a tax refund.

These messages are not from genuine HMRC social media accounts and are a scam. We never use social media to:

  • offer a tax rebate
  • request personal or financial information

If you cannot verify the identity of a social media account, send the details by email to: phishing@hmrc.gov.uk and ignore it.

Refund companies

HMRC is aware of companies that send emails or texts offering to claim tax refunds or rebates on your behalf, usually for a fee. These companies are not connected with HMRC in any way.

You should read the ‘small print’ and disclaimers before using their services.

HMRC customs duty scams

HMRC is aware of a text and email scam where the customer is told they must pay customs duty to receive a valuable parcel which does not exist.

These scams should not be confused with changes introduced on 1 January 2021, advising that some UK consumers buying goods from EU businesses might need to pay customs charges when their goods are delivered. Find out more about these new rules on GOV.UK.

If in doubt, we advise you not to reply to anything suspicious, but to email HMRC at phishing@hmrc.gov.uk straight away and read HMRC phishing and scams guidance.