HMRC Scam Texts, Calls and Emails: How to Spot a Fake

If a text, call or email says HMRC owes you a refund and asks you to click a link or hand over your bank or card details, it is a scam. Genuine tax refunds are set out in a P800 calculation or a Simple Assessment, and you claim them through your own HMRC account or receive a cheque — never by replying to a message. The same goes the other way: HMRC does not ring people out of the blue threatening arrest, and it never asks to be paid in gift cards, vouchers or cryptocurrency.

• HMRC will never text, email or call to tell you about a refund and ask for your bank or card details.
• HMRC does send some genuine texts and emails, but they do not ask for personal or financial information.
• A real P800 arrives as a letter (or in your HMRC online account) and shows the full arithmetic — income, allowances, tax paid, tax due.
• Report scam emails to phishing@hmrc.gov.uk and scam texts by forwarding them to 60599.
• If you clicked and entered details, contact your bank first, then change your Government Gateway password.

What HMRC never does

Almost every HMRC scam falls apart against this list. HMRC does contact taxpayers by post, phone, text and email, so "it came by text" does not automatically mean fake. What matters is what the message asks you to do.

HMRC does not:

• Notify you of a tax refund by text, email, WhatsApp or social media message. Repayments follow a P800, a Simple Assessment or a Self Assessment return.
• Ask for your bank details, card number, full address or date of birth in a text or email, or ask you to confirm them by clicking a link.
• Ask for your Government Gateway user ID, password or access code. Nobody legitimate needs these, including anyone claiming to be from HMRC.
• Demand immediate payment to avoid arrest, a court summons or deportation, or leave automated voicemails telling you to "press 1 to speak to an officer".
• Accept payment in gift cards, vouchers, bank transfers to a personal account, or crypto. Genuine payment details are published on GOV.UK and are HMRC's own accounts.
• Pressure you to stay on the line while you move money to a "safe account". No such thing exists.
• Use WhatsApp to contact you about your tax affairs.

HMRC publishes a running list of the texts, emails and calls it genuinely sends, including the numbers and sender IDs it uses, at check a list of genuine HMRC contacts. If a message is not on that list and it asks for money or data, treat it as fake.

The HMRC scams doing the rounds

The refund text

The most common HMRC scam text claims you are owed a specific, believable amount — something like £312.48 or £847.90 — and gives a short link to "claim before the deadline". Odd amounts feel more authentic than round numbers, which is exactly why scammers use them. The link leads to a clone of the GOV.UK design that asks for your name, address, date of birth, National Insurance number and card details. That combination is enough to attempt identity fraud as well as to take money.

The P800 refund email

The P800 refund text scam and its email twin borrow real HMRC vocabulary: "tax calculation", "P800", "repayment reference". Genuine P800 emails and texts exist only as prompts telling you to log in and check your account — they do not contain a claim form. Look at the sender domain rather than the display name: HMRC emails come from addresses ending @hmrc.gov.uk or another gov.uk domain, not hmrc-refunds.com, gov-uk-tax.net or a Gmail address.

The threatening call

An HMRC scam call usually claims you owe unpaid tax and that a warrant, a court case or a bailiff visit is imminent unless you pay today. Caller ID can be spoofed, so the number on your screen may look like a real HMRC 0300 line. HMRC's debt management team does phone people about genuine arrears, but it will not refuse to let you hang up and call back, and it will not insist on unusual payment methods. If in doubt, end the call and ring HMRC on the number published on GOV.UK.

Deadline and sign-up scams

Scam volumes spike around the 31 January Self Assessment deadline and again in the weeks after 5 April, when real refund letters are going out. Expect a new wave around Making Tax Digital for Income Tax, which starts from April 2026 for sole traders and landlords with gross income over £50,000 — messages offering to "register you for MTD" or warning of penalties for not signing up are a growing theme.

National Insurance and Child Benefit scams

Variants include calls saying your National Insurance number has been "compromised in a fraud investigation", and messages about Child Benefit being suspended. With the High Income Child Benefit Charge biting between £60,000 and £80,000 of adjusted net income, plenty of households genuinely do hear from HMRC about Child Benefit — which is what makes the fake version effective.

Refund agents that are legal but costly

Not every unwanted approach is criminal. Some firms cold-call or advertise online offering to reclaim your tax for a percentage, sometimes with a deed of assignment that sends your whole refund to them first. That is not fraud, but you can claim most reliefs yourself for nothing. Before signing anything, check whether the relief is one you could claim directly through your HMRC account.

Real vs fake: checking a P800

A P800 tax calculation is issued after the tax year ends when HMRC's records show you paid too much or too little PAYE tax. It is a letter, and it always shows the workings.

Worked example: what a real refund looks like

Refunds normally exist because a tax code was wrong. Take an employee in England on £32,000 with no other income for 2026/27.

• With the correct code, the Personal Allowance of £12,570 applies: £32,000 − £12,570 = £19,430 taxable, all in the basic-rate band (the first £37,700 above the allowance), so tax is £19,430 × 20% = £3,886.
• Suppose their code had given only £10,000 of allowances all year. Tax deducted would be (£32,000 − £10,000) × 20% = £4,400.
• Overpayment: £4,400 − £3,886 = £514.

A genuine P800 would show those figures line by line and arrive at £514. A scam message just asserts a number. If you can't reconcile the amount to your own income and tax paid, that is your answer. Scottish taxpayers should note that non-savings income is taxed using the Scottish bands, so the arithmetic on a genuine Scottish P800 uses rates from 19% to 48% rather than 20%.

You can also settle the question without touching the message at all: log in to your HMRC account from a browser you opened yourself and look at your tax overpayments and underpayments. If there is no repayment shown there, there is no repayment.

How to report an HMRC scam

Reporting takes under a minute and helps HMRC get fake sites taken down. Do not reply, click, or call any number given in the message.

• Emails: forward to phishing@hmrc.gov.uk, then delete.
• Texts: forward the message to 60599 (charged at your network rate), then delete. You can also forward any spam text free to 7726.
• Phone calls: use the reporting form on GOV.UK's report suspicious emails, texts and calls page, which covers HMRC-branded calls, social media accounts and websites.
• Non-HMRC phishing emails: send to report@phishing.gov.uk, the National Cyber Security Centre's reporting service.
• If you have lost money: contact your bank immediately, then report to Action Fraud on 0300 123 2040 or online. In Scotland, report to Police Scotland on 101.

Include as much as you can — the sender number or address, the time it arrived and the link text — but never forward your own personal or banking details.

If you already clicked

Clicking a link is not the same as losing money. Work through this in order.

1. If you entered card or bank details: ring your bank or use its app's freeze function straight away, and ask about a fraud marker on the account.
2. If you entered Government Gateway credentials: change that password immediately, and change it anywhere else you reused it. Check the access-code method on the account is still your own phone.
3. Check your HMRC account details: look at the bank account held for repayments, your address, and any agent authorisations you did not set up.
4. If you gave away your National Insurance number and date of birth: watch for credit applications you did not make. A protective registration with a fraud-prevention service can flag your details to lenders.
5. If you paid a "fee" for a refund: treat it as a payment card dispute with your bank as well as an Action Fraud report.
6. Keep the evidence. Screenshot the message before deleting it, then report as above.

One more reassurance: HMRC cannot empty your bank account because you opened a text, and no HMRC officer will ever arrive at your door on the day of a phone call. The pressure is the scam.

What to do next

If what actually landed was a letter rather than a text, work out what it is before you act on it. Run the reference through the HMRC letter decoder to see what a P800, a P2 tax code notice, a Simple Assessment or a penalty notice means and what the deadline is. If the letter shows a calculation you want to test, rebuild the figures yourself with the income tax calculator and compare the tax due with the tax deducted on your payslips or P60.