SiteKiln gives you plain-English information, not legal or financial advice. If you've given your bank details to a scammer, contact your bank immediately.
# Fake HMRC Texts, Emails and Calls, How to Spot Them and What to Do
If a message about tax or CIS lands out of the blue and wants you to click a link, pay now or give bank details, treat it as a scam until you've checked it yourself on GOV.UK.
1. The scams you'll actually see
For construction workers and CIS self-employed, the same HMRC scams come round every year, especially near the self-assessment deadline in January and the new tax year in April.
Fake tax refund texts
"HMRC: you are owed a tax rebate of £532.68, click here to claim."
The link goes to a page that looks like GOV.UK but steals your bank details or Government Gateway login. HMRC say they never text or email you to tell you you're due a refund.
Fake "you owe us" texts and calls
Automated voice: "This is HMRC. You owe tax and a warrant has been issued for your arrest. Press 1 to pay now."
Pure scare tactic. HMRC do not threaten arrest by text or unexpected phone call. That's not how the law works.
Fake CIS payment or refund emails
"Your CIS refund is ready, log in here to claim it."
The link isn't real GOV.UK. Often timed around January or April when you're already thinking about tax returns.
Fake Government Gateway login pages
You click a link in a text or email. It looks like GOV.UK but the address bar shows something like gov-uk-refunds.com or hmrc-gateway-login.co.uk, not gov.uk.
You type your Gateway ID and password. They now have access to your tax account.
WhatsApp and social media messages
"HMRC" messaging you on WhatsApp or Facebook Messenger, chasing tax or offering refunds.
HMRC confirm that the only legitimate WhatsApp alerts come through the UK Government WhatsApp channel and are one-way notifications only. Anything that asks you to reply, click, or provide details is fake.
Every one of these scams has the same aim: get your bank details, your Gateway login, or your money.
2. How to spot a fake vs a real HMRC message
You don't need to be an IT expert. Just use these rules.
Red flags, likely fake
Unexpected refund offers. HMRC will never text or email you to say you're due a tax rebate. If you're owed money, you'll see it in your GOV.UK tax account or receive a letter directing you there, not a random text with a link.
Links to "claim now" in texts or emails. Real HMRC messages tell you to go to GOV.UK yourself. They don't send clickable links to claim refunds.
Threats and countdowns. "Pay now or we'll arrest you." "You have 24 hours or legal action starts." HMRC and the courts do not threaten arrest by text or cold call. That's scammer theatre.
Suspicious email addresses. Scammers use addresses like hmrcrefunds@taxsecure.co or noreply@tax-uk-refund.com. Real HMRC emails come from addresses ending in @hmrc.gov.uk.
Generic greetings and poor formatting. "Dear customer" instead of your name, spelling mistakes, odd spacing. Not always present, but common.
What HMRC will actually do
HMRC will:
- Write to you by letter or via your GOV.UK tax account for important matters
- Sometimes send legitimate texts · for example, to remind you of a deadline or chase an overdue return · but they'll tell you to visit GOV.UK yourself, not ask for details in the text
- Call you about a specific matter you already know about (e.g., a compliance check you're already dealing with)
HMRC will NOT:
- Text or email you a link to claim a tax refund
- Ask for your bank details, card details, or PIN by text, email, or unexpected phone call
- Call you threatening arrest, police, or "warrants" if you don't pay immediately
- Ask for your full Government Gateway password over the phone
- Contact you via WhatsApp asking for a response
If in doubt: don't click anything. Go to www.gov.uk directly in your browser and log in the normal way.
3. What to do when a suspicious message lands
Do not click links or open attachments.
Do not reply, even texting "STOP" can confirm your number is active and invite more scams.
Do not give any details, no bank account, no National Insurance number, no date of birth, no Gateway login.
Then report it. Reporting genuinely helps shut scams down and protects other people.
How to report HMRC scam messages
Suspicious emails: Forward to phishing@hmrc.gov.uk · then delete it.
Suspicious text messages: Forward the text to 60599 (HMRC's reporting number). You can also forward to 7726 (spells "SPAM") which is your network's spam reporting number and is free on most providers.
Suspicious phone calls claiming to be HMRC: Hang up. You can report the details via HMRC's online phishing form at gov.uk, or call the Self Assessment helpline on 0300 200 3300 to check whether any real issue exists on your account.
Report fraud more widely: Report to Report Fraud (the national police fraud service, replacing Action Fraud) online at reportfraud.police.uk or by calling 0300 123 2040.
In Scotland, report to Police Scotland on 101.
4. If you've already clicked or given details
Don't beat yourself up. These scams are professionally designed to catch people. Just move quickly.
If you entered bank or card details
- Contact your bank immediately using the number on the back of your card or their official app · not any link in the scam message
- Tell them you entered your details into a fake HMRC site or gave them over the phone
- Ask them to freeze or block the card, watch for suspicious transactions, and consider issuing new account details if serious
- If money has already gone out, ask them to start their fraud recovery / chargeback process
If you entered Government Gateway details
- Go to www.gov.uk directly · not from any link · and log into your Government Gateway
- Change your password immediately
- Turn on 2-step verification (2SV) · HMRC have added this to Gateway accounts. Use it.
- Check your recent activity: tax returns submitted, personal details changed, bank account changes. If anything looks wrong, contact HMRC on 0300 200 3300
- If a tax return has been submitted that you didn't file, tell HMRC immediately · they can mark it as fraudulent
If you downloaded a file or suspect your device is infected
- Run a full antivirus scan on the device
- If it's a work phone or shared laptop, get it looked at properly
- Change your important passwords (email, banking, Gateway) from a different, clean device
- Check your email account for forwarding rules you didn't create · a sign your email has been compromised
If a payment has already gone to the scammer
Same as invoice fraud: bank first, then Report Fraud (0300 123 2040 or reportfraud.police.uk), then keep everything, screenshots, messages, reference numbers.
5. Lock down your Government Gateway
Your Gateway account is the keys to your tax. Treat it like money.
Turn on 2-step verification (2SV). Even if someone gets your password, they still need the code from your phone. This is the single most important thing you can do.
Use a strong, unique password. Not one you use for email, Facebook, Amazon, or anything else. If one of those gets breached, your Gateway stays safe.
Don't log in from random links. Always start at www.gov.uk or your saved bookmark. Never from a text or email link.
Don't share your Gateway login. Your accountant should use their own agent access · not your personal Gateway ID and password. If they're asking for your login credentials, that's a red flag about their practice, not yours.
If HMRC contact you and you're not sure it's real: tell them you'll hang up and call back on the official number from GOV.UK. If it's genuine, they won't mind.
What to do next
- Check your Government Gateway right now · is 2-step verification turned on? If not, do it today
- If you've had a suspicious text recently, forward it to 60599 and delete it
- Tell anyone you work with about the CIS refund email scam · it catches people every January
- Save the HMRC phishing email address (phishing@hmrc.gov.uk) in your contacts so you can forward quickly next time
Sources
- HMRC, Phishing and Scams Guidance · gov.uk/government/publications/phishing-and-scams
- HMRC, Recognising Genuine HMRC Contact · gov.uk/guidance/check-a-list-of-genuine-hmrc-contacts
- National Cyber Security Centre, Suspicious Emails and Texts · ncsc.gov.uk/collection/phishing-scams
- UK Finance, Half Year Fraud Report 2024 · ukfinance.org.uk
- Fraud Act 2006 · legislation.gov.uk/ukpga/2006/35
- Computer Misuse Act 1990 · legislation.gov.uk/ukpga/1990/18
Know someone who needs this?
Was this guide useful?
Didn't find what you were looking for?
Spotted something wrong or out of date? Email us at hello@kilnguides.co.uk.
In crisis? Samaritans 116 123 ·