HMRC warns of fake tax refund email scam

Fraudsters are sending fake "tax refund" emails that purport to come from HMRC, the consumer body Which? reported on 28 February 2023. HMRC has issued a warning about the scam¹.

The emails use HMRC branding to appear legitimate and include a link inviting the recipient to claim a tax refund. Clicking the link takes the recipient to a website where they are asked to enter personal details¹. The message states: "After the last annual calculations of your fiscal activity, we have determined that you are eligible to receive a tax refund." It then tells the recipient the amount of money they are due and includes an expiration date to urge them to act quickly, with a "Claim Now" button underneath¹.

Which? said HMRC is regularly targeted by scammers phishing for personal data, and that it had recently reported on text, email and phone scams where fraudsters impersonated the tax office¹. The report gives no figure for how many of these emails have been sent, how many people have received them, or how much money has been lost, and no such figures have been reported¹.

Why it matters for households

Anyone with an email address can be targeted, and the emails are designed to look like official HMRC correspondence. The practical risk is that a recipient who clicks the link and enters personal details on the linked site may have those details used for fraud. Which? states that HMRC will never send specific tax information, such as how much is owed or any rebates due, by email, so a message containing that information can be treated as a scam¹.

For anyone who has already acted on the email, Which? says to contact your bank immediately and report the crime to Action Fraud¹. Complaints about how a bank handled a scam can be taken further, and our guide to complaining to your bank about a scam refund sets out the process.

The report also sets out how to report the messages themselves. Scam emails should be forwarded to report@phishing.gov.uk. Recipients can also select "Report Spam" on Gmail, "Report phishing" on Hotmail, or forward emails to abuse@yahoo.com from a Yahoo account¹. Which? advises avoiding clicking links in any unsolicited emails. A suspicious website can be reported to the National Cyber Security Centre¹.

Our guides to phishing, vishing and smishing and to fake HMRC calls, texts and emails explain how these approaches typically work, and how to tell if an HMRC text, email or call is genuine covers the checks that apply to tax office messages.

What happens next

No further steps have been announced. HMRC's warning about the scam was issued on Twitter, and the report gives no date for when the emails began circulating or when any related action will be taken¹.