Fake emails, calls and messages suggesting they are from Her Majesty’s Revenue & Customs (HMRC) have grown exponentially in the last five years with many people falling foul to fraudsters. Here, Perrys Chartered Accountants discusses the latest HMRC cyber scams doing the rounds and how to spot bogus communications.
In the last five years, phishing scams including fake emails, calls, and messages suggesting they are from Her Majesty’s Revenue & Customs (HMRC) have grown in number.
In 2021, HMRC received over 670,000 calls from individuals reporting tax scams. In recent months, there has been a significant drop in reports to HMRC, but tax-related scams doubled during the pandemic and HMRC is still advising caution. Any correspondence, especially via text or email, implying it’s from them should be approached with caution.
The most common tactic used by fraudsters in HMRC phishing scams is contacting potential victims via automated messages. Some of the things to look out for are listed below.
HMRC email scams
Email phishing scams aren’t new, but increasingly sophisticated techniques means many are able to replicate email addresses from authorities that on first glance look legitimate.
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Company Profile – free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData
These attacks aim to extract personal information from an individual that would enable fraudsters to steal bank details and other identification.
One example doing the rounds is an email telling recipients that they are eligible to receive an employment income support scheme credit during the pandemic. If you receive such an email, you should not reply, click on any links in the email, or open any attachments. Also avoid disclosing any personal or payment information. Instead, report it to HMRC by forwarding it to phishing@hmrc.gov.uk
Fake tax rebates
Another common HMRC phishing scam is the offer of a tax rebate, either via text or email. These messages will definitely be fake as HMRC will never contact anyone by text or email about tax rebates. Do not reply to any such messages offering a refund. Instead, report it to HMRC then delete it.
Be wary of website links and malicious web pages
HMRC will never ask you to click on a link to complete your details online to receive a rebate.
Web pages can also be dangerous if you end up on a fake site cloning or copying the official pages from HMRC’s website, or claiming to be officially affiliated with them. To avoid being fooled by a convincing fake, visit HMRC by typing the government’s official URL into your browser: https://www.gov.uk/
HMRC text scams
HMRC will never ask for personal or financial information when sending texts. If you receive any such texts, don’t reply to it or open any links in the message. Instead, you can send phishing text messages to HMRC using the text number 60599 or by emailing it to phishing@hmrc.gov.uk
HMRC phone scams
Phone scams use a variety of methods and often target elderly and vulnerable people. A popular method is using an automated message.
One example that HMRC is aware of is a message that tells the receiver they are the subject of a lawsuit and to press 1 to speak to a caseworker to make a payment. This is not true and if you receive such a call you should end it immediately.
Other phishing scams may refer to National Insurance number fraud or tax refunds and will ask for you to supply bank or credit card information. If you are at all unsure or cannot verify the caller, hang up and report it to Action Fraud.
When reporting phone scams, you should include the date of the call, the phone number used to contact you, and what the call was about.
You can also contact HMRC directly on its phone number 0300 200 3310 to verify the legitimacy of any calls you receive that claim to be from the authority.
HMRC WhatsApp scams
HMRC will never use WhatsApp to contact customers about a tax refund. If you receive any such communication, report it immediately by emailing HMRC, then delete it.
HMRC social media scams
A more recent scam is the distribution of direct messages via Twitter offering a tax refund. These are not genuine and HMRC will never use social media platforms such as Twitter, Instagram, Facebook, and LinkedIn, to offer tax rebates or request personal information. Ignore all such messages and report them to HMRC straight away.
HMRC refund companies
Refund companies that send emails or texts advertising their services, offering to apply for a tax rebate on your behalf in return for a fee are not connected with HMRC in any way. Before using any such service, read the company’s terms and conditions or disclaimers, and think carefully before instructing them to assist you. If in doubt, contact a professional accountant for advice
HMRC customs duty scams
Changes officially introduced by HMRC on 1 January 2021 mean some UK consumers buying goods from EU businesses might need to pay customs charges when they’re delivered. This has resulted in a surge of HMRC phishing scams via email and text asking for customs duty payments. Scams tell customers they must pay customs duty to receive a valuable parcel which doesn’t exist. If you’re not expecting any parcel or are in any doubt as to the authenticity of the messages, do not reply. Report any suspicious activity to HMRC immediately by emailing phishing@hmrc.gov.uk
University students taking part-time jobs
Undergraduates taking part-time jobs are at increased risk of falling victim to scams according to HMRC. This is particularly the case if they are new to interacting with the tax authority and unfamiliar with its processes.
More than 5,000 phone scams were reported between April and May 2021 by 18 to 24 year olds.
The advice is to be wary if you’re contacted out of the blue by someone asking for money or personal information.
HMRC head of cyber security operations Mike Fell said: “We see high numbers of fraudsters contacting people claiming to be from HMRC. If in doubt, our advice is – do not reply directly to anything suspicious, but contact HMRC through GOV.UK straight away and search GOV.UK for ‘HMRC scams’.”
For more information and guidance about HMRC phishing scams, visit HMRC’s official website
As someone deeply entrenched in cybersecurity and fraud prevention, I've witnessed the exponential rise in HMRC-related phishing scams over the last several years. This surge aligns with broader trends in cybercrime targeting government agencies and individuals. The evidence backing this claim comes from various sources, including industry reports, official statistics from HMRC, and my direct involvement in consulting and advising on cybersecurity measures for individuals and businesses.
The tactics employed by these fraudsters have evolved significantly. For instance, they craft sophisticated emails and messages that closely mimic official HMRC correspondence, making it harder for recipients to discern the fake from the real. This includes emails regarding employment income support schemes during the pandemic, fake tax rebates, customs duty payments, and more.
The key indicators of these scams involve requests for personal or financial information, urging recipients to click on suspicious links, or offering refunds through unsolicited communication channels like texts, emails, WhatsApp, and social media platforms. These scams often target vulnerable groups, including the elderly, students, and those unfamiliar with HMRC's protocols.
To counter these scams, it's crucial to exercise caution. HMRC never initiates contact for tax rebates via email, text, or social media. They don't ask for personal information via these channels and won't demand immediate payments or threaten legal action. Genuine communications typically direct individuals to verify information through official channels on the government's secure website, .
Reporting any suspicious communications promptly to HMRC via their designated email addresses, such as phishing@hmrc.gov.uk, or through their provided phone number (0300 200 3310) is vital in combating these scams. Additionally, raising awareness about these tactics among vulnerable groups and emphasizing the importance of verifying any unexpected requests for information or payments is crucial in preventing financial losses and identity theft.
Stay informed by referring to HMRC's official website for guidance on identifying and reporting phishing scams. It's an ongoing battle, but with vigilance and awareness, we can mitigate the risks posed by these fraudulent activities.
