If you think you’ve received an HM Revenue and Customs (HMRC) related phishing or bogus email or text message, you can check it against the examples below (which is obviously not a full and conclusive list as the fraudsters are always a step ahead).
It will help HMRC’s investigations if you report all ‘HMRC related’ phishing emails and bogus text messages to us. Even if you get the same or similar phishing email or text message on multiple occasions, please forward it to email firstname.lastname@example.org and then delete it.
Don’t open any attachments or click on any links within the email or text message, as they may contain malicious software or direct you to a bogus website.
HMRC will never send notifications by email for:
- tax rebates
- personal or payment information
Don’t visit the website within the email or disclose any personal or payment information.
Phishing HMRC emails – how to spot scams
As well as spelling mistakes and poor grammar, there are a number of things you can look out for to help you recognise a ‘phishing’ or bogus email, says HM Revenue & Customs (HMRC) in its latest guide on scams.
Thousands of taxpayers are targeted by criminals every year with bogus emails, texts, and even social media messages that can seem genuine, but on closer inspection provide clues to their falsity.
Here are the five things you should look out for if you receive correspondence purporting to be from the taxman.
- Fake email addresses
Fraudsters typically own email addresses with names associated with HMRC, like Revenue, HMRC or gov. Here’s an example of fake email addresses: email@example.com; firstname.lastname@example.org; email@example.com; firstname.lastname@example.org; email@example.com, etc.
Be aware that fraudsters can spoof the “from” address to look legitimate. If you’re unsure whether the message is real, don’t open it. Instead, forward suspicious emails to HMRC ’s phishing team at firstname.lastname@example.org, and wait for their guidance.
- Offering a tax rebate or payment
Emails from HMRC will never offer you a repayment, notify you of a tax rebate, ask you to disclose personal information such as an address or bank details, or provide a non-HMRC personal email address to send a response to.
- Demanding urgent action
Be wary of messages containing phrases like “you only have three days to reply” or “urgent action required”.
- Bogus links to websites and dodgy attachments
If the email includes a link to a webpage or an attachment, be on your guard. Fraudsters often include web links that lead to pages that look like the homepage of the Revenue’s website. This is to trick recipients into disclosing personal or confidential information.
Sometimes they’ll even include links to actual HMRC webpages in their emails, to try and make them appear genuine.
Attachments could contain viruses designed to steal your personal information.
- Common greeting
If an email claiming to be from the taxman begins with a general greeting, such as “Dear Sir/Madam”, “Dear customer” or “Hello”, rather than your name, it’s highly likely to be fake.
Emails from HMRC will usually start with the recipient’s name and will include information on how to report phishing scams further down the page.
BE WARY – DON’T BE SCAMMED.