It is 8:40 on a Tuesday morning, and Sarah from Leeds is half-awake, coffee in hand, when her phone buzzes. The message says it is from HMRC: she has overpaid tax and is owed a refund of £486.20. All she has to do is tap the link and confirm her bank details before the claim expires. She almost does it. The amount looks oddly specific, the sender name reads “HMRC,” and she did file a tax return earlier in the year, so a refund does not sound crazy. This is exactly how an hmrc tax refund scam works: it catches you in a half-awake moment, with a believable number and a deadline that leaves no room to think.
Sarah pauses. Something feels off. She has never heard of HMRC sending a refund by text, and the link address looks strange when she holds her finger over it. She deletes the message, opens her HMRC Personal Tax Account by typing gov.uk into her browser herself, and finds no refund waiting. Nothing. That ten-second pause saved her bank details, because the message was never from HMRC at all.
The short answer: if you get a text, email, or call out of the blue telling you that you are owed a tax refund and asking you to click a link or share bank details, it is a scam. HMRC never contacts customers by email, text, or phone to tell them about a refund or to ask them to claim one. A genuine refund reaches you by post letter, shows up in your Personal Tax Account, or is paid to bank details HMRC already holds. Any message asking you to “claim” a refund by clicking through is fake, no matter how official it looks.
How the HMRC Tax Refund Scam Works, Step by Step
The con usually starts with a message that lands at a moment when tax is already on your mind: just after the Self Assessment deadline, or while genuine refunds are being processed. Fraudsters know that timing does half their work for them. HMRC itself has warned that scammers strike when people are most likely to expect real correspondence from the tax authority.
First comes the bait. You get a text, an email, or sometimes a voicemail claiming you overpaid tax. The amount is often precise to the penny — £342.78, £486.20 — because a made-up exact figure feels more real than a round number. The message creates urgency: claim within 24 or 48 hours, or the refund “expires” and goes back to the Treasury. Real tax refunds do not work like that, but urgency is the whole point. It is designed to push you past the pause Sarah took.
Next comes the trap. The link leads to a website dressed up to look like GOV.UK or HMRC, complete with the crown logo, official-looking colors, and a form asking for your name, address, National Insurance number, and bank or card details. Some versions ask you to “verify” your identity by entering your online banking login. Others go further: once you type in card details, a second page asks for a “small processing fee” or a one-time code from your bank. Every field you fill in goes straight to the criminals.
Finally comes the damage. With your bank details and personal information, the scammers can drain an account, set up direct debits, or build a full identity profile to use against you later. Some victims only realize what happened when their bank calls about unusual transactions, or when a genuine refund they were actually owed never arrives because their details were changed. The phone versions follow the same script: a caller claiming to be from HMRC threatens arrest or a court summons unless you pay an outstanding bill, or promises a refund if you hand over details on the spot. HMRC will never leave voicemails threatening legal action or arrest. That is a scam, full stop.
The 30-Second Check That Settles It
You do not need to be a fraud expert to settle this. Run this check before you touch any link or reply to any message:
- Ignore the message itself. Do not tap the link, do not reply, and do not call any number printed in it. A link can take you to a fake site, and a reply tells the scammers your number is live.
- Check your HMRC Personal Tax Account directly. Open your browser, type gov.uk yourself, and sign in to your Personal Tax Account or the HMRC app. If a refund is genuinely due, it will show there. If it does not, there is no refund, whatever the message claimed.
- Compare the message against HMRC’s published scam examples. HMRC publishes examples of genuine and fake contact on GOV.UK, including the exact wording of real text messages. If your message asks for personal or financial details, or includes a link to claim a refund, it fails the test. Genuine HMRC texts never ask for your bank details and never link to a refund claim form.
This check works because it cuts the scammers out of the loop entirely. You are not judging whether the message looks convincing — some of them look very convincing — you are checking the one source the scammers cannot fake: your own account, reached by an address you typed yourself.
Real HMRC Contact vs. Scam Contact
The table below is the fastest way to tell the two apart. If a message matches the right-hand column on even one row, treat it as a scam.
| What happens | Genuine HMRC contact | Scam contact |
|---|---|---|
| How a refund is announced | By post letter (for example, a P800 tax calculation), or shown in your Personal Tax Account | By text, email, or phone call telling you to click a link and claim it |
| Bank details | HMRC pays refunds to bank details it already holds; it never asks for them by text or email | The message asks you to enter bank or card details on a linked website |
| Links | Links in genuine texts go to GOV.UK information or HMRC webchat, never to a refund claim form | A link leads to a lookalike site asking for personal and financial details |
| Threats | HMRC never threatens arrest, legal action, or a court summons by voicemail or text | Callers or messages threaten arrest, bailiffs, or prosecution unless you pay immediately |
| Deadlines | Real tax correspondence gives you proper notice and time to respond | Fake urgency: “claim within 24 hours or lose your refund” |
| Sender address | Genuine HMRC emails come from an address ending in @hmrc.gov.uk | Sender addresses use lookalike domains, free email services, or spoofed names |
One row deserves a special mention, because it trips people up: HMRC does send some genuine text messages, for example to confirm a Self Assessment refund you already requested is being processed, or to follow up a P800 letter you have not answered. This is the single biggest tell to remember — a genuine HMRC text will never ask you for personal or financial information and will never include a link to claim a refund. If the text asks for anything, it is fake, even if the sender name says HMRC. Caller ID and sender names can be spoofed with ease.
Red Flags That Give the Scam Away
- An unsolicited refund offer. You did not ask for a refund, yet one has supposedly appeared. HMRC does not hand out surprise rebates by text or email.
- A link or attachment you were not expecting. Real refund correspondence does not arrive as a clickable claim form.
- Pressure and countdown language: “expires today,” “final notice,” “immediate action required.” Scammers rush you because a calm person checks.
- Requests for sensitive details: National Insurance number, bank login, card numbers, or one-time passcodes. No genuine HMRC message asks for these by text or email.
- Generic greetings like “Dear customer” instead of your name, or sloppy spelling and odd phrasing in a message pretending to be official.
- A sender address that is not @hmrc.gov.uk, or a link address that does not lead to gov.uk when you hover over it without tapping.
- Threats of arrest, police involvement, or court action for an unpaid tax bill. HMRC does not operate that way.
- A phone caller who refuses to let you hang up and call back on an official number, or who demands payment by gift card, crypto, or bank transfer to an unfamiliar account.
If you want a broader grounding in reading suspicious messages, our guide on how to check if an email is legit walks through sender checks and link checks in detail, and our smishing guide covers the text-message version of this trick across many brands, not just HMRC.
Clicked the Link or Shared Your Details? Do This Now
Do not panic, and do not feel embarrassed. These messages fool careful people every day — HMRC received more than 170,000 reports of suspicious contact in the 12 months to 31 July 2025, and more than 45,000 of those related to fake tax refund claims. You are one of tens of thousands, not an exception. Speed matters more than shame here.
Call your bank immediately and tell them what happened. Ask them to freeze or monitor the affected account, block any cards you entered, and watch for direct debits you did not authorize. If money has already left your account, report it as fraud to your bank right away and ask about their fraud recovery process. Change the passwords on your email and any financial accounts that share credentials with what you entered, and turn on two-factor authentication where it is offered. If you entered login details on the fake site, assume the scammers have them and act accordingly.
Run a security scan on your phone or computer, in case the link downloaded anything. Then report the message using the steps in the next section — your report helps HMRC shut down the fake site or number, and it may protect the next person who gets the same message. Keep the original message, screenshots, and any phone numbers or web addresses; investigators and your bank may ask for them.
How to Report an HMRC Tax Refund Scam
Reporting takes two minutes and genuinely helps: HMRC uses these reports to take down fake websites and phone numbers. In one recent ten-month stretch it closed down nearly 25,000 of them.
For a suspicious email, forward the whole message to phishing@hmrc.gov.uk, then delete it. For a suspicious text, forward it to 60599 (network charges may apply) and delete it. For a suspicious phone call, report it through the scam-reporting form on GOV.UK — search “report a tax scam phone call” on GOV.UK to find it. If you lost money, report it to Action Fraud on 0300 123 2040 or through its online fraud reporting tool, and tell your bank as well. In Scotland, you can contact the police on 101.
Readers outside the UK should use their own country’s reporting routes: in the United States, report to the FTC at ReportFraud.ftc.gov and the FBI’s Internet Crime Complaint Center at ic3.gov. Tax-agency impersonation is not a British-only problem. Canada’s version, the CRA scam, follows a strikingly similar script, and our guide to IRS and government impersonation scams shows how the same trick is adapted for American taxpayers.
Why This Scam Keeps Working
Three things keep this con alive. First, tax is confusing, and most people are not sure whether they overpaid or not, so a refund claim sounds plausible. Second, the messages arrive when tax is genuinely in the news — around filing deadlines and refund season — so they blend into real correspondence. Third, the fakes keep getting better: spoofed sender names, cloned GOV.UK pages, and amounts calculated to look like a real tax calculation. HMRC’s own figures show the scale: 29,000 fake tax refund claims were reported in one recent ten-month period alone, and the Self Assessment deadline brings a fresh wave each year.
The defense has not changed, and that is good news, because it is simple. A refund you were not expecting, announced by text or email, with a link to claim it, is a scam. Check your own account, through an address you typed yourself, and the question answers itself. Tell friends and family the same rule, especially older relatives, who are often targeted with the threatening phone-call version. One forwarded report to HMRC might be the report that gets a fake site taken down before it reaches someone else.
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.
Sources
- Check if a text message you’ve received from HMRC is genuine — GOV.UK
- 4,800 Self Assessment scams reported — GOV.UK
- Beware scams pretending to be HMRC — Fensom Business Solutions (HMRC figures, Sep 2025)
- How to spot an HMRC scam: your 2026 guide to protection — Simply Business
- ReportFraud.ftc.gov — Federal Trade Commission
- Internet Crime Complaint Center (IC3) — FBI