HMRC does contact people by letter, phone, text and email, so the channel alone does not prove a scam. The warning signs HMRC itself lists are contact that rushes or threatens you, arrives unexpectedly, asks for bank details or a money transfer, or offers a refund or rebate. HMRC says it will never threaten arrest, leave a voicemail threatening legal action, ask for payment in vouchers, or offer a rebate through social media, and it publishes a list of genuine contacts you can check against.

How does HMRC actually contact taxpayers?

HMRC uses several channels, and knowing what each genuine contact looks like is the best defence.

  • Phone. HMRC may call or leave a voicemail from 0300 200 3884, a number that is not for general enquiries. It says it will never ask for personal or financial information during those calls. It also sends automated voice messages to some customers who are behind with payments, giving payment details or a helpline number.
  • Text. HMRC sends texts to some customers, which may link to GOV.UK information or HMRC webchat, for example to confirm receipt of a claim or form, or after a call to the Corporation Tax helpline. Some branded messages show HM Revenue and Customs as a verified sender with the HMRC logo.
  • Email. HMRC says it will only email about a tax rebate, or ask for personal or payment information, from an address ending in hmrc.gov.uk. Fraudsters can spoof addresses and display names, so this is a minimum check, not proof.
  • Letters and QR codes. QR codes in HMRC letters usually go to GOV.UK guidance, HMRC will say if one goes elsewhere, and it says you will never be taken to a page where you have to enter personal information.
  • WhatsApp. Subscribers to the UK Government channel may get occasional single message tax reminders they cannot reply to. HMRC says it will not use WhatsApp for anything else.
  • Social media. HMRC never uses social media to offer a tax rebate or ask for personal or financial information.

What are the warning signs of a scam?

HMRC’s checklist says a contact could be a scam if it:

  1. rushes you;
  2. is threatening;
  3. is unexpected;
  4. asks for personal information such as bank details;
  5. tells you to transfer money; or
  6. offers a refund, tax rebate or grant.

HMRC also says it will never leave a voicemail threatening legal action, threaten arrest, or ask you to pay with gift or payment vouchers. Scams HMRC has described include an automated call claiming HMRC is filing a lawsuit and telling you to press 1 to pay, calls about National Insurance number fraud, texts and emails offering refunds in return for bank details, and messages demanding Customs Duty to release a parcel that does not exist. HMRC advises that if you cannot verify a caller’s identity, you should not speak to them.

Refund companies are a separate issue. HMRC says firms that email or text offering to claim refunds for a fee are not connected with HMRC, and advises reading the small print before using them.

How can you check whether a contact is genuine?

HMRC publishes a collection of genuine contacts, split into phone calls, emails, letters, QR codes, texts and contact using more than one method, listed by subject. HMRC notes that not every communication is included, so a contact missing from the list is not automatically a scam, but a match is reassuring.

The entries are specific. For example, the email list says HMRC may email tax advisers between 5 August and 17 November 2026 about the mandatory tax adviser registration window for agent services accounts, which runs from 18 August to 18 November 2026; see tax adviser registration with HMRC. A genuine campaign like this gives fraudsters a ready made story, which is why the safest response to any link is not to use it, and to sign in to HMRC services directly instead.

How should suspicious contacts be reported?

Type of contact Where to report it
Email, including ones with QR codes Forward to phishing@hmrc.gov.uk, then delete
Text message Forward to 60599 (network charges apply), then delete
Phone call HMRC’s online suspicious phone call form, giving the date, number used and what was said
Social media account or message Email details to branddefence@hmrc.gov.uk

HMRC asks people to report scams even if they receive the same one often, not to open attachments or links, and says it may share your email address and phone number with other organisations to close scams down.

What if details have already been given or money lost?

If personal details have been disclosed, HMRC has a route to report that to its security team. Anyone who has lost money should report it to Report Fraud, the service formerly called Action Fraud, or to Police Scotland on 101 if they live in Scotland.

Scams are often aimed at taking over an HMRC online account. HMRC lists signs such as access codes arriving when you have not tried to sign in, a changed password locking you out, changes to tax records you did not make, and letters or payments you were not expecting. You can report from the security console after signing in, or by form if you cannot, and HMRC aims to phone or email within 10 working days. Agents can use the security console in their agent account if multi factor authentication is switched on, and need the client’s details and authorisation when reporting for a client.

What should agents watch for?

Agent credentials are valuable because they give access to many clients. HMRC’s security guidance for agents says to:

  • sign in to HMRC services through the web, never by following a link in an email;
  • access client records only through your own agent registration, never with a client’s sign in details;
  • check the account for unauthorised changes, such as altered email addresses or newly added software;
  • keep the list of administrators and assistants up to date, and never share sign in details, since HMRC will never ask for your password; and
  • not try to correct anything yourself if suspicious activity is found, but report it.

If HMRC thinks an agent account has been accessed without permission, it emails a temporary password that must be changed on first sign in. Wider controls are covered in cyber security for practices and the agent services account.

How might a scam reach a practice?

Illustration only. A bookkeeper receives an email styled as HMRC saying the firm’s agent services account will be suspended unless registration is completed today, with a link to sign in. The timing fits HMRC’s genuine registration campaign, but the email rushes the reader and asks them to sign in through a link. The bookkeeper does not click, checks the genuine contacts list, signs in to the agent account directly to confirm its status, forwards the email to phishing@hmrc.gov.uk and deletes it. Staff are reminded of the incident at the next team meeting.

What mistakes do people make?

  • Trusting a caller because the number or email display name looks official; both can be spoofed.
  • Calling back a number given in a suspicious message instead of a number found independently on GOV.UK.
  • Clicking a link to check whether the message is genuine.
  • Deleting a scam without reporting it.
  • Assuming any HMRC text or call is fake, and ignoring a genuine debt reminder. Check the genuine contacts list and what HMRC letters mean instead.
  • Paying an urgent demand without checking the liability in the HMRC online account first; see how to pay HMRC for the official payment routes.

If HMRC opens a check into your return, tax investigation insurance pays your accountant’s fees. Solar Protect cover pays up to £100,000 with no excess; it never pays tax, interest or penalties. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.