Request a
call back
Every year, HMRC scam season follows the same rough pattern. Fraudsters ramp up in January, ride the Self Assessment deadline, then… most people assume it calms down.
It doesn’t.
Since early 2025, HMRC has received over 135,500 reports of suspicious contact and has been forced to shut down 25,000 phishing websites and phone numbers in under ten months. The criminals are not taking a break. They’re adapting.
This year, that adaptation looks different. The fake refund email is still doing the rounds, but alongside it, scammers are now running WhatsApp impersonation campaigns, using AI-generated voice calls that sound convincingly official, and sending fake letters with QR codes that lead nowhere good. As a firm that works with HMRC on behalf of our clients every day, we’ve seen the confusion these cause and we want to make sure you know exactly what to look for.
This is the updated HMRC scam warning 2026 covering every threat type that’s active right now, and what to do if you encounter one.
HMRC scam warning
Classic Scam That's Still Working Fake Tax Refund Emails and Texts
Fraudsters keep running this one because it keeps working. You receive an email or text claiming HMRC has calculated a refund for you often a specific figure like £342 or £517 (enough to feel plausible, not so much it triggers disbelief). There’s a link. The link looks like a government page. It’s not.
Clicking it takes you to a cloned website that asks for your Government Gateway login, passport details, or bank credentials. Once you’ve entered those, the scammers have what they need.
The cost-of-living pressure of the last few years has made this scam more effective, not less. A refund offer is tempting when money is tight. That’s exactly why it persists.
What to watch for: Any unsolicited email or text promising a refund and asking you to click a link. HMRC will never send you a link to log in and claim a refund. If you’re owed money, you’ll see it when you log into your Government Gateway account directly.
HMRC WhatsApp Scams
This is the one catching most people off guard right now.
HMRC does have a WhatsApp channel but it’s a one-way broadcast subscription for general government updates. HMRC will never send you a direct WhatsApp message about your tax account, a penalty, or a refund. Full stop.
The scam works like this: a message arrives from a number with a convincing display name and sometimes an HMRC-branded profile picture. It claims you owe a penalty, or you’re due a refund, and includes either a link or a phone number to call. The language feels official. It isn’t.
What to do: Don’t reply and don’t click anything. Take a screenshot of the message and email it to phishing@hmrc.gov.uk, then delete it. You can also report it directly to GOV.UK using the HMRC suspicious contact reporting form.
AI Deepfake Phone Calls
This one is harder to spot because it sounds real.
Fraudsters now use AI voice-cloning tools to generate phone calls that mimic the cadence and authority of a professional HMRC officer. The script is usually familiar — unpaid tax, a suspended National Insurance number, or an imminent lawsuit — and a recorded voice asks you to press 1 to speak to a caseworker.
The technology behind these calls has improved significantly. They no longer sound robotic. Some people are pressing 1 before they’ve thought twice.
HMRC will never threaten arrest or legal action by phone. If a call pressures you to make an immediate payment or threatens to send the police, it is a scam. Hang up.
For video calls that appear to involve HMRC officials, check for deepfake signs: lips slightly out of sync with speech, unnatural blinking, flickering or soft edges around the face or hair. Real HMRC video appointments are pre-arranged and you’ll receive written confirmation first.
What to do: Hang up immediately. Report the call using the HMRC suspicious phone call form on GOV.UK. If the call involved a financial threat or you made a payment, report it to Action Fraud on 0300 123 2040.
QR Code Scams in Fake Letters
HMRC does use QR codes in genuine letters — but only to direct you to guidance on GOV.UK, and it will always tell you where the code leads. You will never be taken to a page that asks for your login details or payment information via a QR code from HMRC.
Scammers have started producing physical letters that look convincingly like HMRC correspondence, complete with fake QR codes that lead to credential-harvesting sites. The letters are well-printed. The HMRC logo and formatting are close enough to pass a quick glance.
What to check: HMRC maintains a list on GOV.UK of all currently active QR codes in its correspondence. If the code in your letter doesn’t appear there, don’t scan it. If you’ve already scanned it and been asked to log in anywhere, close the browser and change your Government Gateway password immediately.
Fake HMRC Accounts on Social Media
GOV.UK has confirmed a pattern of fake HMRC accounts on X (formerly Twitter), Facebook, and Instagram sending direct messages to users. The messages typically offer a tax refund and include a link.
HMRC will never use social media to offer a rebate or ask for personal or payment information. The official HMRC accounts are verified on each platform. If there’s no verification badge, or the handle is slightly off (e.g., @HM_Revenue instead of @HMRCgovuk), it’s fake.
What to do: Report the account to the platform directly. Then email the details to branddefence@hmrc.gov.uk. Do not engage with the account.
What a Genuine HMRC Email Actually Looks Like
Most guidance focuses on what’s fake. Here’s what’s real because spotting the difference starts with knowing what to expect.
Every legitimate email from HMRC comes from an address ending in @hmrc.gov.uk. Nothing else. Not @hmrc.com, not @gov-hmrc.uk, not a free email domain.
HMRC will not include a direct link asking you to log in or claim a refund. It will tell you to visit GOV.UK yourself and sign in from there. HMRC also publishes a full list of its genuine email contacts on GOV.UK. If you’re unsure about a message, check the address against that list before you do anything else.
If you’re a client of IBISS & CO, any genuine communication from HMRC about your tax affairs will either come through us directly, or you can call our office and we’ll verify it against your account in minutes. That’s a practical advantage of using a firm that deals with HMRC daily; you’re never making that call alone.
How to Report an HMRC Scam: The Full 2026 Guide
Here’s every reporting channel, in one place:
| What you received | Where to report |
|---|---|
| Suspicious email | Forward to phishing@hmrc.gov.uk |
| Suspicious text | Forward to 60599 (network charges apply) |
| WhatsApp message | Screenshot, then email phishing@hmrc.gov.uk |
| Fake social media account | Email branddefence@hmrc.gov.uk |
| Suspicious phone call | GOV.UK suspicious call reporting form |
| Financial loss | Action Fraud 0300 123 2040 |
| You gave personal information | Email HMRC security team with brief details (don't include personal data in the email itself) |
One thing to also know: if you’ve shared any bank details with a scammer, call your bank immediately using the number on the back of your card. Don’t wait for a formal report to go through. Banks can act fast to block transactions if you contact them quickly.
The HMRC Will Never Checklist Updated for 2026
These rules haven’t changed, but it’s worth having them in one place alongside the new threats:
HMRC will never:
- Demand urgent payment via gift cards, cryptocurrency, or untraceable vouchers
- Threaten arrest or police action by voicemail or automated call
- Ask for your PIN, bank password, or full financial details by email or text
- Send a direct link via text or email and ask you to log in to claim a refund
- Contact you directly via WhatsApp with a personal message
- Use a QR code to take you to a page requesting login or payment details
- Offer a tax rebate via social media
Filing Early Still the Simplest Scam Protection
This advice stays the same year after year because it works.
If you file your Self Assessment return in the summer or autumn, you already know your tax position before scam season peaks. That means when a penalty warning or surprise refund lands in your inbox in January or February, you can dismiss it immediately because you already know the numbers don’t add up.
The team at IBISS & CO handles Self Assessment returns for clients throughout the year. We file early wherever possible, keep clients informed of their actual tax position, and act as the first point of contact if something unexpected arrives that looks like it might be from HMRC. If you’re not sure whether a letter, email, or call is genuine, ring us before you respond to it. We can check your account status and tell you whether HMRC is actually expecting anything from you.
Frequently Asked Questions
What does a genuine HMRC email look like?
All genuine HMRC emails come from an address ending in @hmrc.gov.uk. The email won’t include a direct link asking you to log in or claim a refund. It will tell you to visit GOV.UK yourself. HMRC also publishes a list of all genuine email addresses on its website. If the sender address doesn’t match that list, treat it as suspicious and forward it to phishing@hmrc.gov.uk before doing anything else.
How do I report an HMRC scam?
Forward suspicious emails to phishing@hmrc.gov.uk. Forward suspicious texts to 60599. For fake social media accounts, email branddefence@hmrc.gov.uk. Report suspicious phone calls via HMRC’s online reporting form on GOV.UK. If you’ve lost money, report it to Action Fraud on 0300 123 2040. And if you disclosed personal information in response to a scam, contact the HMRC security team by email straight away, include a brief description of what you shared, but don’t put personal details in the email itself.
Will HMRC ever contact me on WhatsApp?
No. HMRC runs one broadcast subscription channel on WhatsApp for general government updates, but it will never send a direct message about your tax account, a penalty, or a refund. Any direct WhatsApp message claiming to be from HMRC is a scam. Take a screenshot, email it to phishing@hmrc.gov.uk, and delete the message.
What should I do if I already clicked a fake HMRC link?
Stop immediately, don’t enter any further information. If you typed in your Government Gateway password, change it now at gov.uk/log-in-register-hmrc-online-services. If you share bank details, call your bank straight away using the number on the back of your card. Banks can freeze cards and block transactions within hours, but only if you call them first. Then report what happened to HMRC’s security team by email, and to Action Fraud on 0300 123 2040.
