Guide
How to identify a fake HMRC tax refund message
URLVIS Security Team · Last updated: August 29, 2026
A text or email offering an HMRC tax rebate through a link is a scam by definition: HMRC states plainly that it never notifies refunds by text or email, and never asks for card or bank details to pay one. A genuine rebate is handled inside your own tax account or by letter. Refund bait is the dominant HMRC impersonation theme in the UK because it inverts the usual fraud psychology — instead of threatening you, it offers you money, which lowers suspicion and makes people volunteer exactly the details a scammer wants. The typical flow starts with a message quoting a plausible amount, often a few hundred pounds, and a deadline. The link leads to a page styled like GOV.UK that asks for name, address, date of birth, National Insurance number, and finally full card details "so the refund can be transferred". Money then leaves the card instead of arriving. Campaigns cluster around the self-assessment deadline in January, the end of the tax year in April, and any budget announcement that puts tax in the headlines — the moments when an unexpected message about your tax feels most believable. A threatening variant exists too: an automated call or text claiming unpaid tax and immediate legal action. The same rule applies in both directions — HMRC opens formal matters by letter, and its debt processes never run through gift cards, vouchers, or transfers to personal accounts. Verification is free and takes a minute: sign in to your personal tax account by typing gov.uk yourself. Any refund you are genuinely owed is visible there and can be claimed there, without entering card details anywhere.
How to Identify
- Treat every refund notification that arrives by text or email as fake. HMRC does not announce rebates that way — a real refund appears in your personal tax account or arrives by letter.
- Check the domain carefully. Genuine UK government services live on gov.uk; hyphenated lookalikes, other endings, and shortened links are hostile pages regardless of how the page looks.
- A refund that requires your card number, CVV, or online-banking login is a contradiction — money is received into an account HMRC already has or by cheque, never by you typing card details into a form.
- Be suspicious of deadlines on free money: "claim within 24 hours or forfeit". Real overpayment claims remain open for years; urgency exists only to stop you from checking.
- Requests for your National Insurance number, passport details, or date of birth to "confirm identity" are identity theft in progress, not verification.
- An exact amount — £248.32 rather than a round figure — is a credibility trick, not evidence. Scammers generate precise numbers because they look computed.
- Automated calls threatening arrest for unpaid tax are always fraudulent. HMRC pursues debts through documented processes and never demands payment in vouchers or gift cards.
- Sender details prove nothing: SMS sender names and email addresses are easily forged to display official-looking labels. Judge the request, not the header.
- When in doubt, close the message and sign in to your personal tax account by typing the address yourself. A claim that exists only in a message and not in your account does not exist.
Real-World Examples
The examples below are illustrative only. They do not refer to any real person, brand, or organization and exist solely to show the scam pattern.
Fabricated rebate text
Fictional example — Tax Office Alert: You are due a rebate of £276.44 for the last tax year. Claim within 24 hours at rebate-claims.example to avoid forfeiture.
Fabricated verification page prompt
Fictional example — Revenue Services Portal: To transfer your refund, confirm your card number, expiry date, and security code. Transfers are processed within 3 working days.
Fabricated enforcement voicemail
Fictional example — "This is the Tax Enforcement Bureau. A case has been filed against your National Insurance number. Press 1 to speak to an officer and avoid court action today."
Sources
Reporting Channels
- HMRC text scam reporting: Forward suspicious tax-themed texts to 60599 (network charges may apply).
- HMRC phishing email reporting: Forward suspicious emails to [email protected], then delete them.
- National Cyber Security Centre: Forward scam emails to [email protected] and texts to 7726.
- Action Fraud: Report fraud with financial loss in England, Wales, or Northern Ireland.
FAQ
Does HMRC ever contact people by text message?
HMRC does send some administrative texts, but they never include links to claim refunds and never ask for personal or payment information. Any tax text with a rebate link is fraudulent.
I think I might genuinely be owed a refund. How do I check?
Sign in to your personal tax account on gov.uk, typing the address yourself, or use the official HMRC app. Genuine overpayments are shown and claimed there directly — the process never involves entering card details to receive money.
What should I do if I entered my card details on a fake rebate page?
Call your bank or card issuer immediately using the number on the back of the card, report the card as compromised, and dispute any charges. Then report the incident to Action Fraud and forward the original message to HMRC.
What if I gave my National Insurance number?
Watch for signs of identity misuse — unexpected mail, credit applications, or tax records you do not recognise. Consider a protective registration with Cifas, check your credit reports, and keep the scam message as evidence.
The message addressed me by name. Does that make it genuine?
No. Names, addresses, and phone numbers circulate together in leaked datasets, and scammers merge them into messages precisely to look personalised. HMRC communications you can trust are the ones visible inside your own tax account.
Related Risks
How This Guide Was Prepared
This guide was compiled from publicly available fraud-reporting sources and URLVIS's own multilingual risk taxonomy; an AI-assisted draft was reviewed before publication. It is for general information only and is not legal or financial advice. Spotted an error or outdated detail? Report it to [email protected].