How to protect yourself and your business from HMRC tax scams in the UK

UK tax scams are becoming increasingly sophisticated, especially around the Self-Assessment Tax return deadline. Fraudsters often try to impersonate HMRC to trick individuals and business owners into revealing personal or financial information. Whilst HMRC have reported a 12% drop in scam referral between August 2024 and July 2025, scams still very much exist, and it’s important to be on your guard. 

In this blog we explain how to spot a fake HMRC message, how to avoid phishing and refund scams, and protect both you and your business from financial fraud. 

• Learn how to identify fake HMRC calls, emails and texts. 

• Protect your business from phishing scams and refund fraud. 

• Know what action to take if you receive a suspicious message. 

• Know how to report tax scams to HMRC and Action Fraud. 

How HMRC tax scams work 

Criminals will pose as HMRC using emails, texts, phone calls, or social media messages to steal personal data and money. In the 12 months to July 2025, HMRC received over 170,000 scam reports, including 47,000 fake tax refund offers. 

These scams have been known to: 

• Promise a tax rebate or a refund that you weren’t expecting. 

• Request personal details from you, including bank details. 

• Threaten lawsuits, fines or arrest if you don’t comply and respond immediately. 

Scam artists will usually use urgency as a catalyst to create panic, whereas genuine HMRC messages will never apply the same pressures, requesting you to act quickly.  

The following red flags should help you identify fake HMRC communication, and whether a message is genuine: 

• The sender’s email address: genuine HMRC emails always end with @hmrc.gov.uk. 

• Spelling mistakes: whilst we’re all human and small mistakes can occur, poor grammar or unusual wording can often signal a scam. 

• QR codes: only trust codes that direct you straight to the gov.uk website.  

• Text messages: HMRC will never request personal or financial details by text. 

• WhatsApp: HMRC will never use WhatsApp for tax refunds or rebates. 

• Social media: HMRC never contacts taxpayers through private messages. 

• Phone calls: HMRC would never threaten legal action or arrest. Ensure to hang up immediately if a call is heading that way. 

Don’t click on suspicious links 

• Always hover over links before clicking, to check where it leads. 

• Avoid any URL that doesn’t direct to gov.uk 

Never open unknown attachments 

• HMRC rarely send attachments via email. 

• Always ensure to verify QR codes on the official HMRC website. 

Never respond directly 

Instead of replying to a suspicious message, get in touch with HMRC through its official phone number or website. 

Protect your bank and card details 

• Don’t ever share your payment information through text or email. 

• Genuine HMRC refunds are paid automatically into your registered account. 

Don’t succumb to pressure 

Scammers will often use urgency to make you act quickly. Take the time to verify any message before responding. 

Question unexpected contact 

If their contact is out of the blue, it’s better to hang up and contact HMRC directly. 

Consult with your Client Director 

If you’re still unsure whether the communication was genuine, run it past your Client Director to verify. 

File your tax return early 

By filing early, it reduces the pressure during peak scam seasons and helps you remain alert. 

Check HMRCs known scams list 

Visit gov.uk for the latest examples of tax scam messages and fake emails. 

Report any suspicious activity 

Finally, if you believe you’ve been the recipient of suspicious activity, report it to phishing@hmrc.gov.uk, text 60599, or contact Action Fraud. 

You should act immediately, to ensure your details are protected: 

• Change your passwords and contact your bank. 

• Forward phishing emails to phishing@hmrc.gov.uk. 

• Text scam messages to 60599. 

• Report online fraud to Action Fraud (03001232040). 

You’re also able to visit the Government’s ‘Stop! Think Fraud’ campaign, and the National Cyber Security Centre’s business toolkit for guidance on protecting your data and staff. 

Tax scams can affect anyone and everyone, from individual taxpayers to small business owners. Staying informed, verifying every message, and acting cautiously can protect you from financial loss and identity theft.  

If you’re unsure about a tax message or need help managing your HMRC correspondence safely, contact your Client Director for expert, trusted tax support.