A text lands on your phone: “HMRC: You have a pending tax refund of £248.50. Submit your claim at [link] before it expires.” It looks official — the HMRC logo, a reference number, a sense of urgency. Or maybe it’s a phone call: “This is HMRC. There’s a warrant out for your arrest for unpaid tax. Pay £2,000 now or you’ll be taken into custody within the hour.”
Both are scams. And both catch thousands of people every year — especially around Self Assessment deadlines, the end of the tax year, and any moment HMRC is in the news.
The tricky part is that HMRC does send genuine emails, texts, and calls. “HMRC never texts you” used to be safe advice — it isn’t anymore. HMRC now texts taxpayers to confirm refunds, follow up letters, and summarise helpline calls. So the question isn’t “did HMRC contact me?” but “is this contact genuine?” Here’s how to tell, what HMRC will and won’t do, and what to do if you’ve already engaged with a scam.
The 6-Second Test: What HMRC Will Never Do
Before you even check the specific message, run it past this list. If the contact does any of these, it’s a scam — no exceptions:
- Asks for your bank details, card details, or passwords by text, email, or phone. HMRC will never ask for these in an SMS reply or via a link in a message.
- Offers a tax refund, rebate, or grant with a link to claim it. Genuine refunds are paid automatically or claimed through your Personal Tax Account — never by clicking a link in an unsolicited message.
- Threatens arrest, deportation, court action, or police for an unpaid tax bill. HMRC does not threaten immediate arrest over the phone. Ever.
- Demands payment by gift card, cryptocurrency, bank transfer, or wire transfer. HMRC never asks for these payment methods. Legitimate payment goes through gov.uk or your Business Tax Account.
- Rushes you. “Pay within the hour or you’ll be arrested” is the defining feature of a scam. Genuine HMRC contact gives you time and a written record.
- Uses WhatsApp, social media, or personal email addresses. HMRC does not contact taxpayers about tax via WhatsApp, Facebook, X, or any social media platform.
If the message passes all six of those tests, it might be genuine — but you still shouldn’t trust the message itself. Verify it independently (next section).
How to Verify a Genuine HMRC Contact
Don’t click any link in the message. Don’t call any number in the message. Instead, verify independently:
- Log into your Personal Tax Account at gov.uk/personal-tax-account (for individuals) or your Business Tax Account at gov.uk (for self-employed/business). If HMRC has genuinely contacted you about a refund, penalty, or tax code change, the same information will appear there.
- Check HMRC’s list of genuine contacts. HMRC publishes every current email, text, letter, and call campaign at Check a list of genuine HMRC contacts. There are separate pages for emails, texts, letters, and phone calls. If the contact isn’t listed, treat it as suspicious.
- Call HMRC directly on a number you got from gov.uk — not from the message. The Self Assessment helpline is 0300 200 3310 (find current numbers at gov.uk/find-hmrc-contacts). Tell them you received a suspicious contact and want to check whether it’s genuine.
The principle is simple: don’t trust the message, trust gov.uk. A genuine HMRC contact will hold up when you check it independently. A scam won’t.
The Most Common HMRC Scams in 2026
Scam patterns shift, but these are the ones HMRC sees most often right now.
1. The fake refund text or email
This is the highest-volume HMRC scam. The message claims you’re owed a tax refund — often a specific amount like £248.50 or £312 — and includes a link to “claim” it. The link goes to a convincing look-alike website (e.g., hmrc-refund.com, gov-uk-refund.org, or a shortened URL) that asks for your bank details, card number, or Government Gateway login.
Red flags: any refund offered by text or email with a link to claim it. Real HMRC refunds are paid automatically to your bank account, or you claim them through your Personal Tax Account — never by clicking a link in an unsolicited message.
2. The “you’re under investigation” or arrest-threat call
An automated or live caller claims to be from HMRC, says there’s a warrant for your arrest, and demands immediate payment to “stop the action.” Sometimes they threaten deportation or court action. They may quote a fake case number or National Insurance number to sound credible.
Red flags: any threat of arrest, deportation, or police action. HMRC does not threaten arrest over the phone. Genuine debt collection is by letter first, then a calm phone call referencing your specific case — never a threat.
3. The fake penalty or overdue-tax demand
A text or email claims you’ve missed a Self Assessment deadline and owe an immediate penalty, with a link to “pay now.” It often arrives around 31 January or 31 July — the real Self Assessment deadlines — to exploit the panic of people who genuinely are late.
Red flags: demands for immediate payment by link, gift card, or bank transfer. If you genuinely owe HMRC, you can check and pay at gov.uk/pay-self-assessment-tax-bill — not by clicking a link in a message.
4. The “confirm your details” phishing email
An email that looks like HMRC asking you to “confirm” or “update” your bank details, address, or National Insurance number — often claiming your refund can’t be paid until you do. The link goes to a fake page that harvests your details.
Red flags: HMRC does not ask you to confirm bank details by email. If HMRC genuinely needs updated bank details, you do it through your Personal Tax Account or Business Tax Account — not by clicking an email link.
5. The refund-company impersonation
A company emails or texts offering to claim a tax refund on your behalf “for a fee.” They’re not connected to HMRC — they’re refund agents who take a cut of any genuine refund, or outright scammers harvesting your details. HMRC explicitly warns about these.
Red flags: unsolicited offers to “claim your refund for you.” If you’re genuinely owed a refund, you can claim it yourself for free through your Personal Tax Account.
What HMRC Will (and Won’t) Do by Channel
Because HMRC now uses every channel legitimately, “HMRC never contacts you by X” is no longer reliable. Here’s what HMRC will and won’t do through each one.
Text messages
HMRC will text you to:
- Confirm a Self Assessment refund is being processed and when to expect it
- Follow up a P800 refund letter you haven’t responded to
- Confirm a complaint has been received
- Summarise a helpline call you made
- Direct you to GOV.UK guidance or webchat
HMRC will not text you to:
- Ask for bank details, card details, or passwords
- Offer a refund with a link to claim it
- Threaten arrest or legal action
- Demand payment
Emails
HMRC will email you to:
- Tell you your Annual Tax Summary is ready
- Notify you about a tax code change
- Confirm a complaint
- Contact you about online marketplace obligations if you sell through them
HMRC will not email you to:
- Ask for bank details, passwords, or payment
- Offer a refund with a link to claim it (only from
@hmrc.gov.uk, and even then, never via a link asking for details) - Threaten arrest
- Demand payment by gift card, crypto, or wire transfer
Phone calls
HMRC will call you to:
- Discuss a tax return or enquiry you’ve already engaged with them about
- Follow up a letter
- Conduct research (often via third-party agencies like IFF Research or Verian — listed on the genuine contacts page)
HMRC will not call you to:
- Threaten arrest, deportation, or police action
- Demand immediate payment
- Ask for bank details out of the blue
- Demand payment by gift card, crypto, or wire transfer
Letters
HMRC letters are the hardest to fake well, but scam letters do exist — usually demanding payment to a non-HMRC bank account or including a fake QR code. Check any letter at Check if a letter you’ve received from HMRC is genuine, and verify the payment details at gov.uk/pay-self-assessment-tax-bill rather than the bank details on the letter.
What to Do If You’ve Already Engaged With a Scam
Don’t panic — act fast.
If you clicked a link but didn’t enter anything
- Run a full malware or antivirus scan on your device
- Change passwords for any accounts that share a password with one you may have entered
- Clear your browser cache and cookies
- Report the message (see below) and delete it
If you entered bank or card details
- Contact your bank immediately — tell them you’ve been scammed and ask them to freeze the card and reverse any unauthorised transaction
- Report to Action Fraud at actionfraud.police.uk or on 0300 123 2040 (101 in Scotland)
- Report to HMRC at phishing@hmrc.gov.uk so they’re aware
If you paid by bank transfer
- Call your bank’s fraud team immediately — they may be able to recall the transfer under the APP (Authorised Push Payment) code if you act quickly
- Report to Action Fraud as above
If you disclosed HMRC-specific details (UTR, Government Gateway login, NI number)
- Report it to HMRC’s security team using the report suspicious activity in an HMRC online account form so they can secure your tax account
- Change your Government Gateway password at gov.uk immediately
- Check your Personal Tax Account for any unauthorised changes
How to Report a Suspicious HMRC Contact
Reporting helps HMRC shut down scams and warn other taxpayers. It takes under a minute.
| Channel | How to report |
|---|---|
| Suspicious email | Forward to phishing@hmrc.gov.uk, then delete |
| Suspicious text | Forward to 60599 (network charges apply), or email to phishing@hmrc.gov.uk, then delete |
| Suspicious phone call | Use HMRC’s Report a suspicious HMRC phone call online service |
| Suspicious letter | Email details to phishing@hmrc.gov.uk |
| Any scam (financial loss) | Report to Action Fraud or call 0300 123 2040 (101 in Scotland) |
You can also see real examples of current HMRC-related phishing emails, calls, and texts at HMRC’s examples page — useful if you want to compare a message you’ve received against known scams.
The Bottom Line
- HMRC does send genuine emails, texts, and calls — “HMRC never texts you” is outdated advice. The question is whether this specific contact is genuine.
- The six red flags are definitive — if the message asks for bank details, offers a refund with a link, threatens arrest, demands gift cards or crypto, rushes you, or uses WhatsApp/social media, it’s a scam.
- Don’t trust the message — trust gov.uk. Log into your Personal Tax Account or check HMRC’s list of genuine contacts. A genuine contact will hold up; a scam won’t.
- Never click links in unsolicited HMRC messages. Go to gov.uk yourself.
- If you’ve paid or shared details, act fast — call your bank, report to Action Fraud, and tell HMRC’s security team so they can secure your tax account.
- Report every scam to phishing@hmrc.gov.uk — it takes a minute and helps shut them down.
For the full list of HMRC contact types, investigations, and what to do when HMRC contacts you, see our HMRC contacted me hub.
If you’ve received a genuine HMRC letter about an enquiry or compliance check, see our HMRC investigation guide for what to do. If you’ve received a genuine penalty notice and want to appeal, see our Self Assessment penalties guide. If you can’t access your Government Gateway account to verify a contact, see our locked out of Government Gateway guide.