You might be congratulating yourself on getting your self-assessment return in well before it was needed – or be dreading the looming end-of-month deadline. Whichever camp you fall into, there's an abundance of tax scams around as fraudsters try to take advantage of the fact that people may be expecting contact from HMRC.
Around 12 million self-assessments are expected to be filed ahead of 31 January 2025. And scam attempts are growing. HMRC says it received 144,298 scam referrals between November 2023 and October 2024, up 17% on the previous 12-month period. And this figure is likely to represent just the tip of the iceberg, since not everyone will report a scam attempt.
Even if you have been filing tax returns for years, you can still be caught out – so it’s important to know the latest tricks to look out for. If you arm yourself with the right knowledge (and a healthy level of suspicion) around tax-related correspondence, it’s possible to spot a scam and stop a fraudster in their tracks.
What’s on this page?
Keep an eye out for phishing emails, which are classed as anything sent from someone pretending to be a reputable brand, in order to gain access to personal details. In this case, they might claim to be from HMRC.
These scam messages often request personal or payment information and, if you provide the details they’re requesting, criminals could get access to your bank account and steal your money. If you get an email from anyone you don’t recognise (or even if you do), always think twice, even three times, before clicking on a link.
Check that the email is from the actual sender and, if possible, independently seek out the link you're being asked to click, so you know it's safe. Also, beware of emails with attachments that could contain viruses designed to steal personal or financial information.
Again, always be wary of opening unexpected attachments and verify it’s necessary with the company in question if possible. At this time of year, scammers can use the fact people are expecting correspondence with HMRC and send emails that look very similar in order to gain trust – so use this advice first before interacting with any messages.
HMRC provides examples of common phishing emails, phone calls and texts to help you familiarise yourself with the tricks scammers use.
Another red flag: watch out for generic emails or text messages from ‘HMRC’ that start with Dear Sir / Madam or Dear Customer. Robert Salter, an associate director at accountancy firm Blick Rothenberg, says HMRC does use artificial intelligence (AI) and will sometimes send out letters addressed to ‘Dear Sir / Madam’ or ‘Dear Mr / Mrs Smith’, so it’s not unheard of for correspondence you receive in the post to begin this way. “However, we have never heard of them issuing emails or text messages with such information on them,” he adds.
Scammers may also attempt to reach you via post. Scammers’ letters often look similar to official HMRC letters. So how can you tell whether it’s a scam? They often come with vaguely threatening language and urgent deadlines for payment.
“A big red URGENT should be taken as a massive warning sign. Any demanding letter should be verified over the phone or email with HMRC before taking any other action,” warns James Bore, a cyber security specialist at security firm Bores Consultancy.
.jpg?sc=max&mw=800&h=450&la=en&h=731&w=1300&hash=26EDF2DC584C0C8E9BD33E57C1365BC2)
If you receive a phone call saying you are ‘wanted for tax evasion’ and that you'll be arrested if you don’t immediately pay a certain amount over the phone, hang up. HMRC has a section on its page detailing this scam – you'll not only get a threatening call, you may be asked to take action for payment.
The call may be threatening or urgent in tone and ask you for personal details or encourage you to pay quickly. This is not the way that HMRC collects its debts – if you receive anything like this, hang up.
If you’re still worried, head directly to the HMRC website and initiate your own contact to check whether you need to pay anything. If you have unwittingly been the victim of such a scam, contact Action Fraud immediately.
In the months after the 31 January self-assessment deadline, tax refund scams are prevalent. Watch out for a 'too good to be true' offer such as a large tax rebate. HMRC will never inform you about a tax rebate (or a penalty) over email, WhatsApp or text.
Some scammers will also target victims using social media, but again HMRC would never communicate with taxpayers in this way. If you are owed a tax rebate for any reason, you will have been informed after you have completed your tax return and your tax bill was calculated.
You may also get a letter (called a P800) letting you know that you’re due some money back from miscalculated tax. So if it’s not from one of these sources, be wary. Alternatively, if you need to pay a penalty, you should receive a penalty explanation letter from HMRC.
There’s lots of helpful information on tax penalties over on the Low Income Tax Reforms Group site if you want to find out more.
If you're searching online how to complete your tax return, it might surprise you that you need to be wary of what appears in Google search results. Instead, cybersecurity expert Bore suggests you head directly to the main government website, which contains a wealth of information to help you and has a search tool to make it easier to find what you are looking for.
“It's safer than searching through Google or another search engine as fraudsters have ways to poison search results, at least temporarily,” he adds. This can take the form of paying for spots that might look like the main website, but just take you to a very similar-looking ‘spoof’ site, which can then be used to nab your details. We explain here the tools that can help you with your tax return, if needed.
If you’ve left filing your self-assessment return until the last minute, you could find yourself more vulnerable than you might think to scammers. When in a hurry, you might not have the same judgement and hesitation as you would at a less time-pressured part of the year, says Martin Coulson, tax director at accountancy firm Mercer & Hole.
When you’re rushing through and expecting to possibly hear something from HMRC, you’ll become more likely to drop your defences while distracted. “Be wary of unsolicited messages and always verify communication sources, avoid clicking on links or sharing sensitive information without confirmation,” he adds.
HMRC will contact you via email from time to time (if you've signed up for the service), reminding you to fill in or complete a tax return, or alerting you to changes to your tax code.
Tap, click or hover over the ‘from’ address to check if the account appears genuine. Check the government's or HMRC’s correct contact information on the official gov.uk website before deciding to trust the content.
If you are unsure about an email with an attachment, do not open it or forward it. Delete it immediately. Alternatively, you can download the HMRC app to your phone or tablet – this offers you a secure login from a PIN, fingerprint or facial scan, and gives you easy access to any legitimate correspondence from the tax body.
There are some companies that claim to be able to secure tax refunds or rebates on your behalf. Whether or not these claims are valid is debatable, but whatever the case, they will charge a fee for their service. HMRC has also stated that it does not have any link with these businesses.
If you are genuinely owed a refund or rebate, you’ll be able to claim it free of charge from HMRC, so you can tell anyone contacting you to offer their services that you’re happy to take matters into your own hands – and end the conversation.
If you receive an email asking for personal information, such as your username, password or bank details, report it immediately. Forward suspect emails to phishing@hmrc.gov.uk. You can also report suspicious emails, text messages and phone calls to HMRC directly.
“Being vigilant helps you spot potential scams. And reporting anything suspicious helps us stop criminal activity and to protect you and others who could have received similar bogus communication,” says Kelly Paterson, Chief Security Officer at HMRC.
If you think you have been a victim of fraud, report it to Action Fraud by calling (0300) 123 2040 or go to the Action Fraud website.
Scammers will exploit the HMRC self-assessment deadline to attempt to get personal information or money from unsuspecting victims. The simplest way to protect yourself is to avoid sending over any personal or bank account details.
Contact HMRC directly (you can find HMRC's contact details here) if you have received suspicious-looking communication information and want to check it’s genuine.
