Last checked 19 October 2026
Quick answer
HMRC says contact could be a scam if it rushes you, threatens you, is unexpected, asks for personal information such as bank details, tells you to transfer money, or offers a refund, tax rebate or grant. If in doubt, don’t click, reply or call back on a number in the message. Check HMRC’s list of genuine contacts, then report anything suspicious: texts to 60599 and emails to phishing@hmrc.gov.uk.
This is general information, not tax advice. Check GOV.UK or speak to an accountant about your situation. Why we say this.
When you work for yourself, HMRC is one of the few organisations you can’t ignore, and scammers know it. A message saying you’re owed a refund, or that you’ll be in trouble unless you pay today, is designed to make you act before you think.
HMRC publishes a checklist, a list of the contact it genuinely sends, and ways to report fakes. This guide pulls them together.
HMRC’s six warning signs
HMRC’s guide to identifying tax scams says you can use the same checklist for phone calls, emails, texts and social media messages. It says contact could be a scam if it:
- rushes you
- is threatening
- is unexpected
- asks for personal information like bank details
- tells you to transfer money
- offers a refund, tax rebate or grant
One sign on its own doesn’t prove a message is fake, and a convincing scam might only tick one box. Treat any of them as a reason to stop and check before you do anything.
What HMRC says it will never do
GOV.UK’s Avoid and report internet scams and phishing guide says you’ll never get an email, text message, message in an app such as WhatsApp, or a phone call from HMRC that tells you about a tax rebate or penalty, or that asks for your personal or payment information.
HMRC’s scam guidance adds a few more “nevers”. It says HMRC will never:
- leave a voicemail threatening legal action
- threaten arrest
- use social media to offer a tax rebate or ask for personal or financial information
- ask you to pay with gift or payment vouchers
If a message breaks any of those, you can be confident it isn’t HMRC.
Texts: genuine ones exist, so check carefully
HMRC does text some customers. Its page on checking whether a text from HMRC is genuine says a text might include a link to GOV.UK information or to HMRC webchat, and that HMRC will never ask for personal or financial information when it sends a text.
The same page lists the texts HMRC currently sends, with dates for time-limited campaigns. For example, it says HMRC may text to confirm it has received a claim or form, or to follow up on a Self Assessment refund you’ve asked for. Some of those texts, it says, won’t include any links at all.
HMRC also says it may send branded messages that show HM Revenue and Customs as the sender, include the HMRC logo and contain verified sender information. On a phone that can’t receive that type of message, it appears as a standard text.
The practical habit: if a text mentions money, a refund or a penalty, don’t tap the link. Sign in to your HMRC account the way you normally do, starting from GOV.UK, and look there instead.
Emails, letters and QR codes
Fake emails often copy HMRC’s branding, so the logo tells you very little. Check the content against the six warning signs, and look up the contact on HMRC’s list of genuine HMRC contacts, which covers emails, letters, texts and calls.
Letters can be checked too. HMRC has a separate page for checking whether a letter is genuine. If you’re still not sure, GOV.UK says to contact the HMRC team the letter says it’s from. Its Contact HMRC page lists the official numbers.
QR codes are now common in HMRC post. HMRC says the codes in its letters will usually take you to guidance on GOV.UK, that it will tell you if a code goes anywhere else, and that a code will never take you to a page where you have to enter personal information. It says you can send suspicious emails containing QR codes to phishing@hmrc.gov.uk.
WhatsApp and social media
HMRC’s guidance says that if you’ve subscribed to the UK Government Channel on WhatsApp, you may get occasional tax-related reminders as single alerts you can’t reply to. Beyond that, it says HMRC won’t contact you through WhatsApp.
On social media, HMRC says that if you can’t verify an account claiming to be HMRC, don’t reply or share any information. Email the account name and platform to branddefence@hmrc.gov.uk and ignore it.
Where to report a suspicious message
GOV.UK sets out where each type of suspicious contact should go:
| What you received | Where to report it |
|---|---|
| A text claiming to be from HMRC | Forward it to 60599 (network charges apply) |
| An email claiming to be from HMRC | Forward it to phishing@hmrc.gov.uk |
| A message in an app, such as WhatsApp | Take a screenshot and email it to phishing@hmrc.gov.uk |
| A phone call asking for personal information or threatening a lawsuit | Use HMRC’s online form for reporting a suspicious call |
| A letter | Contact the HMRC team the letter says it’s from |
| A social media account you can’t verify | Email details to branddefence@hmrc.gov.uk |
For scams that aren’t about HMRC, GOV.UK says you can forward suspicious emails to report@phishing.gov.uk, which the National Cyber Security Centre investigates, and forward suspicious texts to 7726 for free, which reports them to your mobile provider.
If you’ve already replied or paid
It happens to careful people. Acting quickly helps.
- If you shared personal details: GOV.UK says to contact the HMRC security team at phishing@hmrc.gov.uk. Include brief details of what you disclosed, for example your name, address, HMRC user ID or password, but don’t put the details themselves in the email.
- If you lost money: GOV.UK says to report it to Report Fraud if you’re in England or Wales, online or by calling 0300 123 2040. In Scotland, it says to report it to Police Scotland, and HMRC’s guidance gives 101 as the number.
- Your bank: if you’ve paid or shared card or bank details, contact your bank straight away using the number on its official website or your card.
- Your HMRC sign-in: if you think someone has your HMRC user ID and password, change your password. GOV.UK has a dedicated technical support with HMRC online services page for sign-in problems.
Habits that keep you safer
- Go direct. Reach HMRC through GOV.UK, never through a link or number in a message you weren’t expecting.
- Know your dates. If you know when returns and payments are due, a “pay now or else” message stands out. Our MTD quarterly deadlines guide lists the dates for the first Making Tax Digital year.
- Pause before paying. A genuine tax bill will still be in your account after ten minutes of checking.
Making Tax Digital brings new deadlines from April 2027. Our Making Tax Digital hub explains the real process, so a message that doesn’t match it is quicker to spot.
Frequently asked questions
Does HMRC ever text about tax refunds?
HMRC says it may text you about a P800 refund if it has already written to you and not had a response, and that the text won’t ask for personal or financial information or include links to websites. A text offering a refund in exchange for your details is not genuine.
Can HMRC phone me?
Yes, HMRC does make calls. It says it will never leave a voicemail threatening legal action or threaten arrest. If a call asks for personal information or threatens a lawsuit, GOV.UK says you can report it using HMRC’s online form.
Is a message with the HMRC logo always genuine?
No. Logos can be copied. HMRC’s branded texts show verified sender information, but the safest check is to sign in to your HMRC account directly and look there.
Sources
All checked on 19 October 2026.
- Identify tax scams by phone, text, email or social media (GOV.UK, HMRC)
- Avoid and report internet scams and phishing (GOV.UK)
- Check if a text message you’ve received from HMRC is genuine (GOV.UK, HMRC)
- Check if a letter you’ve received from HMRC is genuine (GOV.UK, HMRC)
- Check a list of genuine HMRC contacts (GOV.UK, HMRC)
Where to check
What changed. : . 20 October 2026: First published.
