How to tell if an HMRC text, email or call is genuine

HMRC does send real text messages, and it does call people about tax. That is exactly what makes fake ones work. The reliable test is not the sender name on your screen, which can be faked, but what the message asks you to do. HMRC says it will never ask for personal or financial information when it sends a text message¹.

So a text offering a tax refund in exchange for your details is not from HMRC, however official it looks. HMRC's own advice is blunt: do not open any links or reply to a text claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details¹. The same rule covers emails and calls. Genuine banks and HMRC will not ask you to reveal your PIN or banking password in full².

If you have already replied, clicked or paid, act now rather than later. Contact your bank immediately and report the scam to Action Fraud³. The faster a payment is reported, the better the chance of recalling it.

How HMRC scam texts, emails and calls reach you

Impersonation scams work by pretending to be someone you already trust. Take Five, the national anti-fraud campaign, lists the identities scammers use most: your bank, the police, HMRC, or even a friend or family member⁷. HMRC is a favourite because almost everyone has some contact with it, whether through PAYE, Self Assessment or Child Benefit.

The approaches come in three main forms. Ulster Bank and NatWest both describe the same pattern: fake emails and texts that look like they are from HMRC and ask for your personal details, fake phone calls, and fake websites⁸. The fake website matters as much as the message, because a link in a convincing email can take you to a page built to look like the official HMRC site so it can steal your information⁸.

Volume is high. HMRC received 57,579 reports of SMS fraud in 2019, up from 36,950 in 2018⁶. Those are reports, not losses, and they show how widely these messages are sent.

The timing is not random. HMRC has issued warnings around Self Assessment deadlines, when people are expecting contact and are more likely to respond¹⁰. It has also warned about gift card scams, where a caller claiming to be from HMRC asks for payment in iTunes vouchers¹¹. HMRC says it works with law enforcement agencies, Apple and campaign groups to make sure the public know how to spot these approaches¹¹.

Warning signs that a message is not from HMRC

The strongest signal is a request for information or money. HMRC will never ask for personal details, like your bank information, through email or text⁸. Independent Age puts it the same way: HMRC will never ask for your personal or financial information via email, or email you a link to a log-in page asking for this information¹².

Genuine HMRC texts have a recognisable shape. They show HM Revenue and Customs as the sender and contain the verified sender's information¹. If your device cannot receive a Rich Communication Services (RCS) message, the branded message will appear as a standard text message instead¹, so a plain-looking text is not automatically fake.

Watch the wording. NatWest's guidance points to bad grammar, spelling mistakes, or greetings like "Dear Customer", noting that official messages are usually personalised with your details⁹. Which? found the same in a scam email example: the greeting addresses the recipient as a "customer", there are grammatical errors such as random capitalised words and full stops, and the website address differs from the official HMRC one¹³.

A familiar number or name proves nothing: how spoofing works

Your phone's caller ID is not evidence. Scammers use identity masking technology to change the name displayed as the sender, known as number spoofing¹⁴. Which? notes that scammers sometimes use number spoofing to make your phone display "HMRC" as the sender, instead of a phone number⁴.

The same trick works on calls. Monzo's guidance is direct: ignore the display name, because scammers can spoof phone numbers to make it look like they are calling from HMRC or Monzo, so do not always trust your caller ID¹⁵. The Insolvency Service has described the same technique in investment scams, where the caller ID and telephone number seen by an investor is not the scammer's details but legitimate phone numbers used by the Insolvency Service or other organisations¹⁶.

Spoofing can be reduced but not eliminated. HMRC reported a 94 per cent reduction of phone scams spoofing its 0300 helpline numbers after action against the practice⁶. That is a fall in one specific type of spoofing, not a guarantee that any call showing an HMRC number is real.

How to check with HMRC directly

Go to HMRC yourself rather than following the message. Skipton Building Society's guidance is to check what you owe directly with HMRC on the GOV.UK website before paying, and to seek clarity from HMRC directly to confirm a contact is genuine¹⁷. Monzo adds that real officials will never pressure you to pay over the phone, and that you can check HMRC online services if you have an account, to see if your tax is up to date¹⁵.

There is plenty you can check without calling anyone. You can use the PAYE section of HMRC online services or the HMRC app to check your employers, estimated income and tax codes¹⁸. If your details are wrong or missing, the same services let you update employer details, add a missing employer, tell HMRC when an employment ended, or update estimated income¹⁸. The HMRC app is free to download¹⁹.

Your tax code is a useful cross-check. You can check it online on GOV.UK or on the HMRC app, and let HMRC know if it still does not look right²⁰.

If you owe money, GOV.UK sets out what to do, covering payment, disagreement with a decision or penalty, and what happens if you cannot pay on time²¹. If HMRC is checking your tax affairs, its compliance guidance explains the process and how to ask for the check to stop²². Simple Assessment uses information from employers, pension providers, banks and building societies²³, so a genuine query about your tax position will usually trace back to a document you have already received.

No genuine organisation asks you to move money or share a PIN

This is the rule that survives every disguise. HSBC states that genuine banks will never ask you to transfer funds or share PINs or passwords²⁴. Its fuller list covers telling anyone the card's 4-digit PIN, sharing a QR code or one-time passcode, transferring money anywhere including to a "safe" account, or sending the card, cheque book or cash²⁵. Experian's guidance is the same: no bank or any other genuine organisation will ask you to reveal your PIN or banking password in full².

HMRC applies the same standard to itself. NatWest's guidance records that HMRC will never ask for personal details, like your bank information, through email or text⁹. HMRC's own text message guidance says the same, and adds that genuine texts will not ask for personal or financial information or link directly to websites in the cases it lists¹.

The "safe account" request deserves its own warning. A caller who says your money is at risk and must be moved to a protected account is running a scam, and the account is the fraudster's. If you are unsure whether a bank is really contacting you, hang up and call back on a number you have looked up yourself.

If you have already replied, clicked or paid

Speed matters more than anything else now. Contact your bank immediately and report the scam to Action Fraud³. If you gave away card details, your bank can block the card. If you gave away enough information to allow identity theft, Experian's guidance covers what to do after a data breach².

If you authorised a bank transfer to a scammer, your refund depends on the bank transfer reimbursement rules, which have their own limits and conditions. There is a maximum refund for authorised push payment fraud, and an excess applies to claims. If a bank refuses a claim, the Financial Ombudsman Service can look at it. Free, impartial help is available from MoneyHelper.

Report the message itself as well. HMRC asks customers to report suspicious activity at phishing@hmrc.gov.uk, by sending a text to 60599, or by reporting phone scams online on GOV.UK¹⁰. Which? gives the same two routes: forward suspicious emails claiming to be from HMRC to phishing@hmrc.gov.uk and texts to 60599⁴. Text messages sent to 60599 are charged at your network rate⁴. Forwarding suspicious texts to 7726 is a free alternative⁴.

There is a second wave to watch for. Recovery room schemes target people who have already lost money, offering to get it back. The Insolvency Service has warned that in these schemes the caller ID and telephone number seen by an investor is not the scammer's details but legitimate phone numbers used by the Insolvency Service or other organisations¹⁶. Anyone who contacts you out of the blue offering to recover lost funds, for a fee, is worth treating with the same suspicion as the original scam.