Secordit Intelligence logo on a dark background beside a photo of a person holding a smartphone in front of an open laptop

Fake HMRC or Companies House message? How to check before you click or pay

Last checked: 29 October 2026

Short answer: Don't use the link, attachment or phone number in a message you're unsure about. Check it against GOV.UK instead: HMRC's list of genuine HMRC contacts, and Companies House's own scam guidance. Report it (HMRC emails to phishing@hmrc.gov.uk, HMRC texts to 60599, Companies House emails to phishing@companieshouse.gov.uk), then delete it. If you've paid or shared bank details, contact your bank straight away and report it to Report Fraud.

HMRC does send real texts and emails, and Companies House sends real emails to registered email addresses, so a fake can look familiar. This guide is for sole traders, company directors and the people who handle the post and payments in a small firm. It uses only the official GOV.UK pages, which are linked so you can check them yourself.

How can I tell if a message from HMRC is a scam?

HMRC publishes a checklist that works for calls, emails, texts and social media messages. It says a contact could be a scam if it:

  • rushes you
  • is threatening
  • is unexpected
  • asks for personal information like bank details
  • tells you to transfer money
  • offers a refund, tax rebate or grant

HMRC also sets out some things it will never do.

  • Phone calls: HMRC says it will never leave a voicemail threatening legal action, or threaten arrest.
  • Text messages: HMRC does send texts to some customers. It advises you not to open any links in, or reply to, a text claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details.
  • Social media: HMRC says it never uses social media to offer a tax rebate or to ask for personal or financial information.
  • Emails: HMRC's reporting page says it will only ever email you about a tax rebate, or ask for personal or payment information, from an address ending in hmrc.gov.uk. Another GOV.UK page says you'll never get an email from HMRC telling you about a tax rebate or penalty, so treat any rebate email with suspicion.

That last check isn't enough on its own. HMRC warns that fraudsters may spoof a genuine email address or change the "display name" to make an email look genuine. If you're unsure, it asks you to forward the email to it and then delete it.

QR codes: HMRC does use QR codes in its letters. It says a QR code will usually take you to guidance on GOV.UK, and that it will tell you if the code takes you anywhere else.

Letters: if a letter looks wrong, GOV.UK says to contact the HMRC team the letter says it's from, for example the Self Assessment team. It's sensible to find that team's contact details on GOV.UK rather than in the letter.

When you're still unsure, compare the contact with HMRC's list of genuine HMRC contacts on GOV.UK.

How can I tell if a message from Companies House is a scam?

Companies House says fake emails often include:

  • formatting and logos to make them look like they're from Companies House
  • wording copied from legitimate Companies House emails
  • false and confusing information
  • spelling or grammatical errors
  • pressure to act quickly
  • demands for payment
  • pressure to open an attachment or link, or to provide an authentication code

Its checks, even if an email seems real:

  1. Check the sender. Companies House says real emails from it come from an address ending ".gov.uk".
  2. Hover over links to see where they go. If the address looks different to what you expected, don't click.
  3. Check the web address. Companies House says a request to reset your password for its online filing service will have an address starting ewf.companieshouse.gov.uk. If a link doesn't contain ".gov.uk", it's not a Companies House page.
  4. Keep your authentication code to yourself. Companies House says it will never contact you by email or phone to find out who your officers are, or to ask for secure information such as authentication codes.

Companies House also lists scam emails it has seen, including emails telling people to "verify your identity". If a message like that arrives, check it against the Companies House scam page on GOV.UK before you do anything.

If someone phones claiming to be from Companies House and asks for this kind of information, Companies House says to try to get a return phone number and contact it on 0303 1234 500.

How do I report a fake HMRC or Companies House message?

What you got Where to report it
Email claiming to be HMRC Forward it to phishing@hmrc.gov.uk, then delete it.
Text claiming to be HMRC Forward it to 60599 (charged at your network rate).
Message in an app such as WhatsApp, claiming to be HMRC Take a screenshot and email it to phishing@hmrc.gov.uk.
Phone call claiming to be HMRC Use GOV.UK's "Report a suspicious HMRC phone call" online service.
Social media account claiming to be HMRC Email the account name and platform to branddefence@hmrc.gov.uk.
Email claiming to be Companies House Forward it to phishing@companieshouse.gov.uk, then delete it from all mailboxes, including deleted items.
Letter, invoice or phone call claiming to be Companies House Contact Companies House on 0303 1234 500.
Any other scam email or text Emails: forward to report@phishing.gov.uk (NCSC). Texts: forward to 7726, free.

What should I do if I've already clicked, replied or paid?

  • If you've paid, or shared bank details: contact your bank straight away. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, report it to Police Scotland on 101.
  • If you replied to a fake HMRC email or text with personal information: contact the HMRC security team at phishing@hmrc.gov.uk. GOV.UK asks you to include brief details of what you disclosed (for example your name, address, HMRC User ID or password), but not to put your personal details in the email.
  • If you typed a password into a page the link took you to: change that password, and the password on any other account that uses the same one.
  • If you think your company's details have been used without your consent: Companies House says to report it to Report Fraud or call 0300 123 2040.

If a fake message has led to a scam or hack on a personal account, our printable After a Scam: What to Do First checklist puts the steps in a clear order.

Where our Account Lockdown Kit fits

Ad – our own product. If a fake message has led to a password being typed into the wrong page, our Account Lockdown Kit (£19) takes you through locking down your email and other key accounts, with a "Hacked? The first 30 minutes" card. It doesn't cover HMRC or Companies House accounts. Account Lockdown Kit

For the other everyday basics in a small firm, see our Small Business Cyber Starter Checklist.

Printable checklist: a message that says it's from HMRC or Companies House

  • ☐ Don't click links or open attachments yet.
  • ☐ Does it rush you, threaten you, ask for bank details, ask you to transfer money, or offer a refund, rebate or grant?
  • ☐ HMRC email: is the sender address ending hmrc.gov.uk? Remember it can be spoofed.
  • ☐ Companies House email: does the sender end ".gov.uk", and does every link contain ".gov.uk"?
  • ☐ Is anyone asking for your Companies House authentication code? Companies House says it never will by email or phone.
  • ☐ Check the contact against HMRC's list of genuine contacts or the Companies House scam page.
  • ☐ Report it: phishing@hmrc.gov.uk, 60599, or phishing@companieshouse.gov.uk. Then delete it.
  • ☐ Paid or shared bank details? Contact your bank, then Report Fraud on 0300 123 2040 (Scotland: 101).

FAQ

Does HMRC ever send text messages?

Yes. HMRC says it sends texts to some customers, and they might include a link to GOV.UK information or HMRC webchat. HMRC advises you not to open any links in, or reply to, a text claiming to be from HMRC that offers you a tax refund in exchange for personal or financial details.

Will Companies House ever ask for my authentication code?

Companies House says it will never contact you by email or phone to ask for secure information such as authentication codes.

The email came from an hmrc.gov.uk address. Is it real?

Not necessarily. HMRC warns that fraudsters may spoof a genuine email address or change the display name. If you're unsure, forward it to phishing@hmrc.gov.uk and delete it.

Does it cost anything to report a scam text?

Forwarding a scam text to 7726 is free, according to the NCSC. HMRC says texts forwarded to 60599 are charged at your network rate.

Who do I report a fake HMRC or Companies House message to if I've lost money?

Your bank first, then Report Fraud on 0300 123 2040, or Police Scotland on 101 if you're in Scotland.

This guide is general information based on the official GOV.UK and NCSC pages linked above, checked on 29 October 2026. It isn't legal, tax or financial advice. Secordit Intelligence isn't affiliated with HMRC or Companies House.

Back to blog