What are the red flags of this scam?

HMRC never notifies you of a tax refund by text, email, WhatsApp, or phone call — they only write letters or contact you through your Government Gateway account • The link points to a domain that is not gov.uk (often 'hmrc-refund.co.uk', 'gov-refund-uk.com', or a shortened URL that hides the real destination) • You are asked for full bank card details, sort code, account number, Government Gateway password, or National Insurance number — HMRC has this information already and never asks you to confirm it • The message creates urgency: 'claim within 24 hours or the refund will be returned to the Treasury' • The sender ID says 'HMRC' but hovering over it or checking the raw sender reveals a personal mobile number or a suspicious email domain

What should I do if this happened to me?

Do not click the link. Forward the text to 60599 (HMRC's phishing text reporting number), or the email to phishing@hmrc.gov.uk, then delete it • Check whether you actually have a refund due only by logging in directly at https://www.gov.uk/personal-tax-account — type the URL yourself, never use a link from a message • If you already entered bank details or your Government Gateway password on the fake site, log into gov.uk from a clean device and change your Government Gateway password immediately, then call your bank to freeze the card • If money has already been taken, call your bank on the number printed on your card and ask for the transaction to be recalled — some faster payments can be reversed within hours • Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

HIGH tax Last reported: 24 Oct 2026 Share

A text or email says HMRC owes you a tax refund — click the link to claim

Q: Is this a scam?

Yes. This is a documented scam pattern. A text, email, or WhatsApp claiming to be from HMRC says you are owed a tax refund and asks you to click a link and enter your bank details, National Insurance number, and Government Gateway password. HMRC never texts, emails, or WhatsApps about refunds — you check your tax account at gov.uk instead.

A text, email, or WhatsApp claiming to be from HMRC says you are owed a tax refund and asks you to click a link and enter your bank details, National Insurance number, and Government Gateway password. HMRC never texts, emails, or WhatsApps about refunds — you check your tax account at gov.uk instead.

Also known as: HMRC tax refund text scam, fake HMRC rebate email, Gov.uk phishing text, HMRC self-assessment refund scam

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Do not click the link. Forward the text to 60599 (HMRC's phishing text reporting number), or the email to [email protected], then delete it
2 Check whether you actually have a refund due only by logging in directly at https://www.gov.uk/personal-tax-account — type the URL yourself, never use a link from a message
3 If you already entered bank details or your Government Gateway password on the fake site, log into gov.uk from a clean device and change your Government Gateway password immediately, then call your bank to freeze the card
4 If money has already been taken, call your bank on the number printed on your card and ask for the transaction to be recalled — some faster payments can be reversed within hours
5 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

Red flags

⚠ HMRC never notifies you of a tax refund by text, email, WhatsApp, or phone call — they only write letters or contact you through your Government Gateway account
⚠ The link points to a domain that is not gov.uk (often 'hmrc-refund.co.uk', 'gov-refund-uk.com', or a shortened URL that hides the real destination)
⚠ You are asked for full bank card details, sort code, account number, Government Gateway password, or National Insurance number — HMRC has this information already and never asks you to confirm it
⚠ The message creates urgency: 'claim within 24 hours or the refund will be returned to the Treasury'
⚠ The sender ID says 'HMRC' but hovering over it or checking the raw sender reveals a personal mobile number or a suspicious email domain

Known variants

QR-code letter variant: a professionally printed letter with HMRC letterhead and a fake reference number contains a QR code. Scanning the code opens a cloned Government Gateway login page. HMRC only uses QR codes in genuine letters to link to informational guidance on GOV.UK — never to a login or payment page.

Last seen: 9/19/2026
Robocall / deepfake voice variant: automated call claims HMRC is filing a lawsuit and instructs the recipient to press 1. A newer deepfake variant uses an AI-generated voice that addresses the victim by name, claiming to be an HMRC case officer, sourcing personal details from data breaches. HMRC confirmed these automated calls are always fraudulent.

Last seen: 9/19/2026
Social media credential theft: TikTok/Instagram posts offer rewards for sharing Government Gateway logins. Fraudsters file bogus refund claims; HMRC blocked ~£153m, arrested two men. Victims face unexpected debt letters. HMRC never contacts you via social media or offers rewards for login details.

Last seen: 10/12/2026
Winter Fuel Payment scam: texts/emails claim pensioners must repay Winter Fuel Payment now; fake GOV.UK form collects NI, DOB, bank details. HMRC never contacts by text or email — repayment is automatic via PAYE. 25,000+ referrals in 12 months to April 2026.

Last seen: 10/24/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources