TL;DR
HMRC tax refund scams send texts or emails offering a refund and asking the recipient to click a link. The link leads to a fake HMRC site that harvests bank details. HMRC issues refunds through the personal tax account or by cheque, not by SMS or email links.
HMRC tax refund scams remain one of the most common impersonation attacks in the UK, with criminals sending texts or emails offering a refund and asking the recipient to click a link. The link leads to a fake HMRC site that harvests bank details. HMRC issues genuine refunds through the personal tax account or by cheque, never by SMS or email link.
How the scam works
Text messages typically read along the lines of 'HMRC: you are due a tax refund of £XYZ. Confirm your bank details to receive payment.' The included link takes the recipient to a webpage styled to look like the gov.uk HMRC site.
Email versions follow the same pattern with a HMRC logo and gov.uk-style design. Some recent campaigns have used PDF attachments to bypass anti-phishing filters, with the attachment containing the malicious link.
How HMRC actually issues refunds
Genuine HMRC refunds appear in the customer's personal tax account on gov.uk. The customer can request the refund be paid into their bank account by Faster Payment or by cheque to the registered address.
HMRC never asks for bank details through SMS, email or social media. The agency confirmed the policy in its 2024 scam prevention guidance, which is published on gov.uk under the contact and avoid scams pages.
Red flags to spot
Urgent language, particularly threats that the refund will expire if not claimed within a short period, is a clear scam indicator. HMRC does not impose deadlines on refund claims.
Generic greetings such as 'Dear taxpayer' instead of the personalised greeting genuine HMRC correspondence uses. Spelling and grammar errors, although increasingly less common as scammers use AI tools, also remain a warning sign.
How to report
Forward scam HMRC emails to phishing@hmrc.gov.uk. Forward scam texts to 60599. HMRC reviews the reports and works with mobile networks and hosting providers to take down identified scam infrastructure.
Report wider fraud and cybercrime to Action Fraud at actionfraud.police.uk or by phone on 0300 123 2040. The Citizens Advice consumer scams helpline on 0808 223 1133 offers guidance for affected individuals.
If you have already provided details
Contact your bank immediately. The Stop Scams UK helpline on 159 connects directly to the bank's fraud team and works with most major UK banks. Cancel any cards that may have been compromised.
Change passwords on any accounts that may have been affected, starting with email and banking. Sign up to credit monitoring with Experian, Equifax or TransUnion to detect unauthorised credit applications.
Key facts
- HMRC never asks for bank details by SMS or email link.
- Genuine refunds appear in the personal tax account.
- Report scam emails to phishing@hmrc.gov.uk.
- Report scam texts to 60599.
- Stop Scams UK helpline is 159.
FAQ
Does HMRC send refund offers by text?
No. Genuine HMRC refunds appear in the customer's personal tax account on gov.uk. The agency never asks for bank details through SMS, email or social media.
How do I report a fake HMRC text?
Forward the text to 60599. HMRC reviews the reports and works with mobile networks to take down identified scam senders.
What if I have already given my bank details?
Contact your bank immediately. The Stop Scams UK helpline on 159 connects to your bank's fraud team. Cancel any potentially compromised cards and change passwords on affected accounts.
Where can I check if I am due a refund?
In your personal tax account on gov.uk. Genuine refunds appear there alongside the option to receive payment by Faster Payment or by cheque to the registered address.
