What is an HMRC scam?

An HMRC scam is a fake call, message or letter that pretends to come from the tax authority. Criminals may offer a tax repayment or threaten you over an invented debt to obtain money or information. HMRC does make genuine contact, so check suspicious requests against its published guidance. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A criminal copies HMRC’s identity or sends a threatening message. 12
  2. The message asks for a payment, personal information or a link visit. 12
  3. Your response supplies information or money to the criminal. 12

Real UK example

HMRC's August 2025 Self Assessment warning described reported attempts offering false tax repayments or demanding urgent payments. Its later guidance, updated in October 2026, confirms that genuine HMRC texts exist. It specifically warns against texts offering tax repayments in exchange for personal or financial details. 21

Warning signs

  • Threats of arrest or a voicemail threatening legal action. 12
  • A tax repayment offer asking for sensitive details. 1234
  • Pressure to pay by gift or payment vouchers. 1234
  • A contact you cannot match to HMRC’s genuine-contact guidance. 12

What to do now

  1. Open GOV.UK yourself and use HMRC’s guidance to check the contact. 12
  2. Forward suspicious HMRC emails to [email protected]. 12
  3. Forward suspicious HMRC texts to 60599; network charges apply. General scam texts can also go to 7726. 1256

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 347
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 48
  • If someone is in danger, call 999. 8

How to protect yourself

  • Keep access codes and passwords private. 1291011
  • Check an unexpected demand before replying or paying. 12
  • Find HMRC contact details through GOV.UK, not the suspicious message. 12

Frequently asked questions

Does HMRC send text messages?

Yes. HMRC says some texts may link to GOV.UK information or webchat. A text offering money in exchange for details needs checking. 1

Will HMRC threaten arrest?

HMRC says it will never threaten arrest or leave a voicemail threatening legal action. 1

How do I report an HMRC scam phone call?

Use the reporting route on HMRC’s GOV.UK page. If you paid or shared banking details, contact your bank as well. 122

Read the longer guide

Matching kit

After a Scam: What to Do First · £7 · Digital download.

A printable UK checklist for the money, account and reporting steps. It is general information, not a recovery service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. GOV.UK / HMRC, Identify tax scams by phone, text, email or social media - GOV.UK. Accessed 7 November 2026 (Europe/London).
  2. GOV.UK / HMRC, Scams warning as Self Assessment customers targeted - GOV.UK. Accessed 7 November 2026 (Europe/London).
  3. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  5. GOV.UK, Avoid and report internet scams and phishing: Report internet scams and phishing - GOV.UK. Accessed 7 November 2026 (Europe/London).
  6. Report Fraud, How to report suspicious messages, calls and websites - Report Fraud. Accessed 7 November 2026 (Europe/London).
  7. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  8. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).
  9. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  10. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  11. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  12. GOV.UK / HMRC, Report suspicious HMRC emails, texts, social media accounts and phone calls - GOV.UK. Accessed 7 November 2026 (Europe/London).