HMRC Scams 2026: How to Spot and Report Fake Texts, Emails and Calls
How to tell a genuine HMRC message from a scam - what HMRC will never ask, the common tax refund and arrest-threat cons, and exactly how to report them (text 60599, [email protected]).
Tax scams are one of the most common frauds in the UK, and they spike around the Self Assessment deadline in January. Criminals impersonate HMRC by text, email, phone and social media to steal money and personal details. The good news: HMRC follows clear rules about how it contacts you, so most scams are easy to spot once you know the tells.
What HMRC will never do
If a message does any of these, it is a scam:
- tell you about a tax refund, or ask you to claim one, by text, email or phone - HMRC never does this;
- ask for personal or financial information (bank details, passwords, PINs) by text or email;
- leave a voicemail threatening legal action or arrest;
- ask you to pay with gift cards or payment vouchers;
- use social media to offer a rebate or request your details.
Genuine HMRC emails always come from an address ending hmrc.gov.uk, and a real refund appears in your Personal Tax Account or by cheque - never through a link in a text.
Common HMRC scams
- "Tax refund" text or email. A message says you are owed a refund and links to a fake HMRC page that harvests your card and bank details. HMRC never notifies refunds this way.
- Threatening phone call. An automated or live call claims you owe tax and will be arrested unless you pay immediately, often demanding vouchers or a bank transfer.
- Fake repayment email. A convincing email with HMRC branding asks you to "verify" your details to release a payment.
- Social media and WhatsApp. Accounts posing as HMRC offer rebates or "support" and ask for personal information.
How to report an HMRC scam
Reporting takes seconds and helps HMRC shut the scam down:
| Type | How to report |
|---|---|
| Suspicious text | Forward to 60599 (network charges apply), then delete |
| Suspicious email | Forward to [email protected], then delete |
| Suspicious phone call | Use HMRC's online "report a suspicious HMRC phone call" service |
| Fake social media account | Email [email protected] |
Do not open attachments or click links in an unexpected message - they can install malware or lead to a fake site.
If you have already responded
If you clicked a link, paid, or shared details:
- contact your bank immediately if you gave card or bank details;
- change any passwords you entered on the fake site;
- report it to Action Fraud (or Police Scotland on 101 in Scotland);
- report the scam to HMRC using the channels above so the fake site or number can be taken down;
- monitor your accounts for unusual activity.
Related guides
Knowing how HMRC really contacts you is the best defence. See the Personal Tax Account guide for where genuine refunds and messages actually appear, and the Self Assessment deadlines and penalties guide for the January period when tax scams peak.
Frequently asked questions
How do I know if a text or email from HMRC is a scam?
If it tells you about a tax refund, asks you to claim one, or asks for personal or financial details, it is a scam - HMRC never does any of these by text or email. Genuine HMRC emails come from an address ending hmrc.gov.uk, and real refunds show up in your Personal Tax Account, never through a link in a text message.
How do I report an HMRC scam?
Forward suspicious text messages to 60599 (network charges apply) and suspicious emails to [email protected], then delete them. Report suspicious phone calls using HMRC's online 'report a suspicious HMRC phone call' service, and report fake HMRC social media accounts to [email protected].
Will HMRC ever call and threaten me with arrest?
No. HMRC will never leave a voicemail threatening legal action or immediate arrest, and never demands payment in gift cards or payment vouchers. Automated calls claiming a warrant is out for your arrest over unpaid tax are a well-known scam - hang up and report it.
What should I do if I clicked a link or gave details to an HMRC scam?
Do not panic, but act quickly. Contact your bank if you shared card or bank details, change any passwords you entered, and report it to Action Fraud (or Police Scotland on 101). Report the scam message to HMRC so they can take the fake site or number down, and watch your accounts for unusual activity.