Understanding the Authenticity of HMRC Messages and Calls
In today’s digital world, verifying the authenticity of messages or calls from HM Revenue and Customs (HMRC) has become crucial for UK taxpayers and businesses. HMRC is a vital UK government body responsible for tax collection, national insurance, and implementing government financial policies. While it frequently contacts individuals and businesses, the rise of sophisticated scams has made it difficult to determine if a message or call is genuinely from HMRC or a potential phishing attempt. Knowing how to verify such communications is not just a precaution but a necessity to protect personal and financial information.
The Scale of HMRC Scams and Fraudulent Contacts
To appreciate the need for verification, it’s essential to understand the scope of HMRC-related scams in the UK. In recent years, phishing schemes have been on the rise, with millions of UK residents being targeted. According to data published by Action Fraud in early 2024, HMRC-related scams have grown by an estimated 20% since 2022, marking one of the most targeted areas in phishing and fraud campaigns across the country.
In 2023, HMRC reported that it responded to over 2.5 million suspicious reports, including emails, texts, and calls. It blocked around 50,000 fraudulent contact numbers and closed nearly 30,000 phishing websites. This growing prevalence of scams reinforces the need for UK taxpayers to understand how genuine HMRC contacts work and the steps to take if they are unsure about a message or call.
Key Indicators of Genuine HMRC Communications
HMRC uses multiple communication channels to reach taxpayers, including letters, emails, phone calls, and text messages. However, there are critical indicators and protocols they follow to maintain the security and authenticity of their communications:
Official Language and Content: HMRC typically uses formal and neutral language without aggressive or alarming tones. They may address tax or payment issues, but they will not use threats of immediate legal action. Scammers often employ scare tactics, threatening arrest or immediate fines, which HMRC does not do.
No Urgent Actions or Threats: HMRC never asks for immediate payments over the phone, through email, or text message. They provide clear payment options and timelines in written correspondence or online through secure portals. Messages demanding urgent payments or threatening actions should raise suspicion.
Secure Links and Domains: Genuine HMRC emails and messages include secure links directing users to the official HMRC website, ending in “gov.uk.” They do not contain shortened URLs or links to third-party sites, which are common in fraudulent emails.
Personalised Content: HMRC contacts generally include specific details such as National Insurance numbers or Unique Taxpayer References (UTR), as well as personalised references to recent tax interactions. Generic messages without specific identification information should be treated with caution.
Examples of Recent HMRC Scam Tactics
Staying informed about recent scam tactics is an essential defense against fraudulent communication. Some common types of HMRC-related scams include:
Tax Refund Scams: A message claiming you are eligible for a tax refund and asking you to “click here to claim your refund” is a frequent scam tactic. HMRC advises that they would never send such messages via SMS or email. Refunds are typically communicated through your personal account on the government’s official portal.
Threatening Legal Action: Calls that claim you owe unpaid taxes and that you will face legal consequences if you do not pay immediately are fraudulent. HMRC does not issue such demands without written correspondence or the opportunity to review or appeal any owed amounts.
Payment Method Requests: Scammers might request payment via unconventional methods, such as cryptocurrency, gift cards, or cash transfers. HMRC will only guide you to make payments through recognised UK bank accounts or official HMRC portals.
The Impact of the Autumn Budget 2024 on HMRC Communications
With the release of the UK Autumn Budget 2024, some changes impact how HMRC will approach communications, especially for taxpayers and businesses:
Enhanced Digital Communication Channels: In line with efforts to modernise, HMRC is shifting more services online. According to the 2024 Budget, an estimated 15% increase in digital communications is expected, particularly for small businesses and self-assessment taxpayers. This digital transition means taxpayers should anticipate receiving more email updates and notifications through their secure online HMRC accounts rather than paper correspondence.
Increased Funding to Combat Tax Fraud: The Autumn Budget announced a £150 million fund allocated specifically to bolster cybersecurity and fraud prevention in HMRC operations. This includes expanding HMRC’s Fraud Investigation Service and enhancing the department’s digital systems to detect fraudulent attempts earlier. Taxpayers are advised that HMRC may increase contact frequency for verification purposes as part of this initiative, but all communication will still adhere to HMRC’s verification protocols.
Introduction of Two-Factor Authentication for Online Accounts: To enhance taxpayer security, HMRC has implemented two-factor authentication for online accounts from November 2024. This means that any notifications from HMRC regarding account updates will now ask users to confirm their identities with an additional security code. Emails or messages that lack this new two-step verification process may be suspect.
Practical Steps to Verify HMRC Communications
For UK taxpayers and business owners, a proactive approach to verifying HMRC contacts can help avoid falling prey to scams. Here are some practical steps to ensure the authenticity of any messages or calls:
Use the HMRC Contact Verification Service: HMRC provides a dedicated phone line and online service for taxpayers to verify the authenticity of any contact. If unsure, taxpayers can call the HMRC fraud helpline at 0300 200 3300 to verify calls, emails, or messages.
Check HMRC’s Official Scam Alert Page: HMRC maintains an up-to-date list of known scam methods, fraud phone numbers, and fraudulent emails on its website. Taxpayers should regularly review this page to stay informed about ongoing scams.
Look for Personalised References in the Message: HMRC will generally include specific taxpayer information in their communications. If a message lacks a Unique Taxpayer Reference, National Insurance number, or other personalised identifiers, it may be fraudulent.
Avoid Responding to Suspicious Messages or Calls: HMRC advises recipients of potentially suspicious communication to avoid interacting with the message. Avoid clicking on links, providing personal details, or returning calls without first verifying the source.
Use the HMRC App: The HMRC mobile app, available on Android and iOS, provides users with a direct line to their tax information, ensuring all information received is from an official source. This app reduces the risk of phishing by centralising tax-related notifications within a secure application.
Real-Life Example of How Scams Play Out
Consider this scenario: Sarah, a freelance consultant, receives an unexpected call claiming to be from HMRC. The caller states that Sarah has an outstanding tax payment and must resolve it immediately to avoid legal action. They request that she provide her National Insurance number and bank details over the phone. Instead of complying, Sarah recalls that HMRC doesn’t make such requests via phone calls. She notes the caller’s phone number and calls HMRC’s official fraud helpline to report the incident. Sarah’s proactive steps help her avoid falling victim to a scam, allowing HMRC to investigate and potentially shut down the fraudulent number.
Additional Resources for UK Taxpayers
Understanding HMRC’s official communication protocols can be challenging, especially for individuals who don’t frequently interact with tax authorities. HMRC offers several resources that are invaluable for taxpayers looking to protect themselves:
HMRC Helplines: HMRC maintains dedicated helplines for various tax queries, including fraud, self-assessment, and VAT. Using these official contact numbers is the best way to reach HMRC.
The UK National Cyber Security Centre (NCSC): The NCSC offers guidance on identifying and reporting phishing attempts, helping the public understand modern scam tactics beyond just HMRC-related issues.
This background lays the foundation for effectively identifying genuine HMRC contacts, as well as offering an understanding of the scale and sophistication of recent scam attempts. In Part 2, we will examine the phone numbers HMRC typically uses and discuss how to differentiate between official numbers and those used in scams.
What Number Does HMRC Call You On?
Identifying whether a call is genuinely from HMRC or a scam attempt is essential, given the vast number of fraudulent phone calls circulating in the UK. HMRC has strict protocols for its outbound calls, and understanding these can be a powerful tool in distinguishing legitimate calls from fraudulent ones. As scam tactics evolve, they become increasingly sophisticated, making it harder for the average person to verify legitimacy. In this section, we’ll explore the official numbers HMRC uses, the types of calls it typically makes, and how you can ensure any contact you receive aligns with HMRC’s standard practices.
Recognising Official HMRC Numbers
HMRC contacts taxpayers for various reasons, including reminders about upcoming deadlines, updates on tax issues, or requests for additional information. However, there are specific, identifiable HMRC numbers often associated with these calls. Some of the primary numbers HMRC uses include:
0300 200 3300: This is one of HMRC’s main contact numbers for general tax inquiries. It is also the official fraud helpline number, which taxpayers can call if they have suspicions about a particular communication or wish to report a scam.
0300 200 3310: This number is often used for self-assessment inquiries, including information about personal tax accounts and updates regarding self-assessment deadlines.
0300 200 3600: Dedicated to VAT queries, this number is used by HMRC when contacting businesses regarding VAT issues or upcoming VAT submission deadlines.
0300 200 3810: This line typically handles employer-related inquiries, often related to PAYE (Pay As You Earn) matters or payroll tax adjustments.
HMRC will not use private or withheld numbers for initial contact and is highly unlikely to contact you through mobile numbers beginning with “07.” They will often direct you to call back on an official line if they need more detailed discussions or security checks. If you receive a call from an unknown number claiming to be HMRC, it’s worth checking against their official contact numbers, which are published on the HMRC website.
Typical HMRC Call Protocols and Expectations
HMRC calls follow specific patterns to ensure the taxpayer's security and clarity about the nature of the call. Here’s what to expect from a genuine HMRC call:
Identification Protocols: An HMRC representative will always begin by verifying your identity before discussing any tax matters. This includes asking questions only you should know the answers to, such as parts of your National Insurance number or recent transactions. Be cautious if a caller begins asking for personal or banking details outright, as this is not standard HMRC protocol.
No Immediate Payment Demands: HMRC does not demand immediate payments over the phone. If there are outstanding tax issues, they will issue written communication beforehand, detailing payment methods and deadlines. Any request for payment methods outside of bank transfers to official HMRC accounts, or through unusual means like cryptocurrency or gift cards, is likely fraudulent.
Direct Callbacks and Reference Numbers: HMRC may sometimes contact you with a query, but they will always offer the option for you to call back on a published HMRC number. Often, they will provide a reference number for your case, which you can verify by calling an official helpline. This practice allows you to confirm that the communication is legitimate and traceable.
Common Scenarios: When HMRC Might Call
Understanding when and why HMRC may initiate a call can further help you identify legitimate contacts. Here are some common scenarios in which HMRC might contact taxpayers by phone:
Self-Assessment Issues: During self-assessment season, HMRC may contact individuals regarding discrepancies in submitted returns or reminders for upcoming deadlines. For instance, if HMRC needs additional clarification on a declared income source or an allowable expense, they may contact you to discuss it. However, they will never request sensitive financial information over the phone.
Tax Credit Enquiries: Tax credit recipients may receive calls from HMRC when there are questions regarding income updates, changes in circumstances, or adjustments needed for ongoing claims. Such calls typically verify recent information submitted by the taxpayer rather than requesting new details.
Debt Management Calls: HMRC’s Debt Management department may contact taxpayers who have outstanding liabilities, such as unpaid VAT or income tax. These calls will inform the taxpayer of the amount owed and provide options for payment. However, any payment arrangements are followed up with written documentation, and the caller will not pressure you into immediate transactions.
PAYE and Employment-Related Updates: Employers or individuals handling payroll may receive calls from HMRC regarding PAYE or employment tax matters. These calls usually occur if there is an ongoing compliance issue or if HMRC needs clarification on submitted payroll details. Employers are advised to check these calls against the PAYE support line to verify legitimacy.
How HMRC Protects Your Data During Calls
The 2024 Autumn Budget emphasised increased HMRC funding towards protecting taxpayers against scams, which includes strengthened protocols on outbound communications. Part of these protocols includes better data security practices, where HMRC representatives now undergo additional checks before initiating outbound calls. Here’s what these measures mean for taxpayers:
Stricter Call Initiation Protocols: HMRC representatives now follow enhanced identity verification checks. For example, they will confirm partial details of your personal information without requesting full sensitive details like a National Insurance number or bank account number.
Increased Use of Security Codes: The introduction of two-factor authentication for digital interactions means that if HMRC needs you to log in during a call, you’ll now need a security code sent to a separate device. They will never request this code verbally or ask for personal information beyond the basic identification questions.
Follow-up Communication: HMRC now confirms call details via email or letter following any complex or lengthy discussions. If you have spoken to an HMRC representative and arranged specific actions, expect a follow-up confirmation through your registered HMRC account or by post, ensuring there is a documented trace of the conversation.
Verifying the Legitimacy of HMRC Calls
With fraudsters becoming more adept at spoofing official numbers, simply seeing a familiar caller ID is no longer enough to confirm legitimacy. Here are the main steps you should follow to verify an HMRC call:
Cross-Check with Published Numbers: If you receive a call from HMRC, cross-check the number with the official numbers listed on the HMRC website. Be aware of current scams that may involve similar-looking numbers, and remember that HMRC does not use mobile numbers (beginning with “07”) for contact.
Request a Callback: If uncertain, politely inform the caller that you will call them back on HMRC’s main number. This action verifies the legitimacy of the inquiry and prevents you from falling into phishing traps. HMRC representatives understand this precaution and will provide a case or reference number to facilitate the callback.
Report Suspicious Calls: HMRC encourages reporting any suspicious calls. Use their fraud helpline (0300 200 3300) to report fraudulent calls and suspicious numbers or contact them from the HMRC website. This action not only protects you but helps HMRC prevent other taxpayers from falling victim.
Recent Scam Trends and Red Flags to Watch For
Scammers are continually adapting, and there are specific tactics they now use to appear more convincing. Here’s a look at common scam strategies:
Spoofed Caller IDs: Scammers now often manipulate caller IDs to make it appear as though the call originates from an HMRC number. Seeing an official number on your phone is not a guarantee of legitimacy. Always verify through independent means, such as the HMRC website or helpline.
Aggressive Tone and Threats: If the caller uses threats of immediate action, such as penalties, fines, or arrest, this is a significant red flag. HMRC does not threaten immediate action without prior written notice. Scammers use these tactics to create panic and rush victims into compliance.
Requests for Sensitive Information: HMRC never asks for complete personal information over the phone, such as your full National Insurance number or bank details. Any call requesting such details, especially without prior written notice, is likely fraudulent.
Real-Life Example of a Spoofed Call
Consider the case of John, a small business owner. He receives a call claiming to be from HMRC’s Debt Management team, stating he has overdue VAT payments and must settle the balance immediately. The caller ID matches a genuine HMRC number, but the tone is unusually aggressive. Sensing something amiss, John tells the caller he will call back and reaches out to HMRC’s VAT helpline. By verifying directly, he discovers there was no outstanding issue with his account, and the call was an attempt to steal his information.
Additional Resources and Tools for Verifying HMRC Calls
As taxpayers adapt to these evolving scams, HMRC and the UK government have developed resources to help individuals protect themselves. Some valuable tools and resources include:
HMRC’s Online Contact Verification Tool: This tool allows you to verify any contact you receive from HMRC, covering phone calls, emails, and letters. It’s a useful way to cross-check communication details if you’re unsure about the legitimacy of a call.
The UK Government’s ‘Report a Phishing Scam’ Service: This service, accessible through the GOV.UK website, allows individuals to report suspicious calls, emails, or text messages. By flagging scams, the government can take down fraudulent numbers faster and warn others about ongoing threats.
How to Identify Genuine Emails and Text Messages from HMRC
Emails and text messages are popular methods of communication for HM Revenue and Customs (HMRC), especially as the department shifts more services online. However, these channels are also highly targeted by scammers who impersonate HMRC to trick taxpayers into revealing personal or financial information. Recognizing genuine messages from HMRC can be challenging, particularly with the sophisticated tactics used by fraudsters. This part of the guide will explain the characteristics of legitimate HMRC emails and texts, how to verify them, and how to handle suspicious messages.
Key Characteristics of Genuine HMRC Emails
HMRC sends various types of emails, including reminders, updates, and tax return confirmations. However, all official emails from HMRC share specific characteristics aimed at ensuring the security of taxpayers:
Official Email Domains: Genuine HMRC emails always come from addresses ending in @hmrc.gov.uk. Scammers may attempt to mimic this by using similar-looking domains, such as “@hmrc-gov.uk” or “@tax-refund-hmrc.com.” Any message from an email address not ending in “gov.uk” should be treated with suspicion.
No Demands for Personal or Financial Information: HMRC will never ask for sensitive details, such as full bank account numbers, credit card details, or your entire National Insurance number, via email. Instead, they may direct you to log into your secure HMRC account to manage or update such information.
No Direct Payment Requests: HMRC does not request payments via email links or demand immediate payment. If a tax payment is due, they will provide detailed instructions on how to pay, including deadlines, in your online HMRC account or through official letters. Messages containing payment links are often signs of phishing attempts.
Specificity in Content: A legitimate email from HMRC will reference details specific to your tax account, such as your Unique Taxpayer Reference (UTR) or recent interactions. Generic greetings like “Dear Customer” instead of using your name or specific account details can indicate a scam.
Clear and Formal Language: HMRC’s emails maintain a formal tone and are typically free from grammatical errors. Scammers, on the other hand, often include grammatical errors, awkward phrasing, or unnatural language due to automated translations or poor writing.
Common Types of HMRC Emails and Examples
Understanding the typical types of emails HMRC sends can further help you differentiate legitimate messages from fraudulent ones. Here are some of the most common categories:
Tax Return Reminders: As the self-assessment deadline approaches, HMRC often sends reminders to self-employed individuals and other taxpayers, encouraging them to submit their returns on time. These reminders might provide general advice on submitting returns but will not contain direct links to forms or payment portals outside your official HMRC account.
Tax Code Notices: HMRC may email you if there are changes to your tax code, explaining the reason and directing you to view the full details in your online account. Again, they will not request immediate responses or contain external links to log into your account.
General Updates: Sometimes, HMRC emails taxpayers with updates on policy changes or tax benefits. For instance, emails related to new allowances or adjustments from the Autumn Budget 2024 may be sent to inform taxpayers of eligibility. These are typically informational only, with links leading to pages on HMRC’s official website (gov.uk) for further reading.
Characteristics of Genuine Text Messages from HMRC
In addition to emails, HMRC sometimes communicates with taxpayers via text messages, especially regarding quick notifications and reminders. While texts can be convenient, they are also a common target for fraud. Here’s how to recognize legitimate HMRC text messages:
No Hyperlinks for Personal Information: Authentic HMRC texts will not include hyperlinks that request your personal details or payment information. Any text requesting that you enter personal details on a third-party website is almost certainly a scam.
Clear Reference to Online Accounts or Letters: When sending reminders or notifications, HMRC texts generally encourage you to log in to your official account or check a recent letter for details. They do not require immediate responses via text.
Short, Informational Content: Genuine HMRC texts are typically brief and straightforward, containing no unnecessary details. For example, they may read, “Reminder: Your self-assessment deadline is approaching. Log into your account on gov.uk for details.”
Official Number Formats: HMRC uses specific, recognisable sender IDs, often formatted as “HMRC” instead of a random mobile number. Messages from ordinary-looking numbers, especially UK mobile numbers beginning with “07,” should be scrutinized closely.
Examples of HMRC Text Scams and Red Flags
Staying aware of recent text scams can prevent you from falling victim to them. Here are some examples of fraudulent text schemes to watch out for:
Refund Notifications: Scammers frequently send messages claiming you are due a tax refund and instruct you to click a link to “claim” it. These links lead to fake HMRC pages designed to capture your personal details.
Threatening Language for Payment: Texts threatening legal action or fines for unpaid taxes are a red flag. HMRC will not send such messages without prior written correspondence. Messages saying, “Immediate action required to avoid penalties” are often intended to create panic.
Payment Confirmation Requests: Texts requesting that you confirm a recent payment or review your “transaction history” through a non-HMRC link should be treated as suspicious.
New Security Measures for Emails and Texts from the 2024 Autumn Budget
The 2024 Autumn Budget introduced additional security enhancements to protect taxpayers from phishing and other types of fraud. These changes reflect HMRC’s commitment to bolstering digital security in response to rising fraud attempts. Here’s what to expect:
Improved Verification for Sensitive Updates: If you receive any sensitive update, such as one regarding a tax refund or overpayment, HMRC now requires a two-factor authentication (2FA) process for email confirmation. This additional layer involves sending a verification code to your registered phone number, which must be entered to access sensitive details. Messages not requesting such verification may be suspect.
Dedicated Email Phishing Alerts: HMRC now sends periodic phishing alerts directly to taxpayers registered in their online system. These emails inform users of the latest phishing tactics and encourage them to stay vigilant. Taxpayers can subscribe to these alerts through their online accounts, receiving updates on common scams to watch for.
New Tax Code Confirmation Process: Any change to your tax code will be followed by an email with a secure link directing you to the official gov.uk website. Scammers have previously exploited tax code changes to phish for data, but with this new process, you are encouraged to verify updates only through the secure HMRC website.
How to Report Suspicious Emails and Texts to HMRC
If you receive an email or text that appears to be from HMRC but raises suspicions, HMRC encourages taxpayers to report it directly to them. Here’s how to do it:
Forward Suspicious Emails: Forward any questionable emails to phishing@hmrc.gov.uk. This allows HMRC to investigate and, if necessary, take action to prevent further attempts. Do not click any links within the email before forwarding it.
Forward Suspicious Texts: Forward any suspicious texts to 60599 (standard message rates apply). This service enables HMRC to assess the content and take steps to disable fraudulent numbers.
Use HMRC’s Reporting Tool: The HMRC website offers an online tool for reporting phishing and scam messages, which is especially useful for identifying new or unique scam tactics. Reports help HMRC maintain an up-to-date database of fraudulent activity and issue warnings to the public as needed.
Example of How to Handle a Suspicious HMRC Email
Let’s imagine that Jane, a self-employed graphic designer, receives an email claiming she is due a tax refund. The email includes a link and asks her to input her bank details to “receive her refund quickly.” However, Jane notices a few red flags: the email address is slightly different from the official “@hmrc.gov.uk” domain, and the language feels slightly off, with several grammatical errors. Instead of clicking the link, Jane forwards the email to phishing@hmrc.gov.uk, deletes the message, and logs into her HMRC account directly. This simple action prevents her from falling victim to a phishing scam.
Tools and Resources to Identify Genuine HMRC Messages
In addition to reporting, there are tools and resources that can help UK taxpayers protect themselves from phishing scams:
HMRC’s Email Verification Guide: Available on the official HMRC website, this guide provides examples of legitimate emails and outlines specific red flags. Taxpayers can reference this guide to familiarise themselves with genuine HMRC communication formats.
UK National Cyber Security Centre (NCSC) Guidance: The NCSC offers guidance on identifying phishing attempts, which includes typical scam markers and tips on handling suspicious emails and texts. Their online tools help individuals and businesses secure their digital communications, which can be particularly helpful for taxpayers who receive frequent emails from various sources.
Regularly Updated Scam Alerts: HMRC’s Scam Alerts page on the GOV.UK website is updated with information on known scams, fake numbers, and new fraud tactics. This resource enables taxpayers to stay informed about current threats and spot unusual activity faster.
Understanding the ins and outs of HMRC’s email and text protocols can significantly reduce the likelihood of falling victim to phishing. In Part 4, we’ll shift focus to HMRC’s approach to letters and official postal communication, discussing how to recognise genuine postal letters and how these fit into HMRC’s broader communication strategy.
Recognising Genuine Letters and Postal Communication from HMRC
While digital communication is becoming more common, HMRC still relies heavily on postal mail for important matters, particularly for sensitive or official notices. Letters from HMRC might cover a range of issues, from tax returns to audit notifications or payment reminders. Understanding what an authentic HMRC letter looks like—and how to spot red flags in fraudulent letters—can help UK taxpayers and business owners ensure they’re responding appropriately to legitimate requests.
The Role of Letters in HMRC’s Communication Strategy
Postal letters from HMRC carry a level of formality and security that digital messages sometimes cannot. HMRC uses letters in particular situations, often when the communication requires a high level of security or documentation. Common examples include:
Tax Statements and Payment Notices: HMRC sends annual or quarterly tax statements via post, detailing your income tax, VAT, or corporation tax dues. These letters will include specific payment options and deadlines, guiding you on making payments through secure channels.
Official Notices for Audits or Investigations: If HMRC has flagged your account for an audit or investigation, you will receive a formal letter detailing the reasons, documentation required, and timelines for submitting information. Such letters are typically written in a formal tone, laying out your responsibilities clearly.
Confirmation of Account Changes: Any significant changes to your tax account, such as adjustments to tax credits or tax code changes, will often be confirmed by letter. This is especially true if the changes affect your tax liability or refund status.
Tax Refund and Overpayment Notices: Although you may receive an email to check for tax refunds, the formal confirmation and details about the refund will generally arrive by post. This is because physical letters ensure a paper trail for record-keeping.
Key Characteristics of Authentic HMRC Letters
Recognising the distinguishing features of a legitimate HMRC letter is crucial. Here are the primary characteristics:
Official Branding and Headers: All genuine HMRC letters are printed on official letterhead that includes the HMRC logo and the “Crown” emblem. The text will often start with “Her Majesty’s Revenue and Customs” or, following recent updates, may begin with the new branding reflective of the “His Majesty’s Revenue and Customs” if a rebranding occurs in line with royal succession. Scam letters typically lack these details or use poorly replicated logos.
Specific Reference Numbers and Personalised Information: HMRC letters include specific identifiers, such as your Unique Taxpayer Reference (UTR) or National Insurance number. This information is generally printed prominently at the top of the letter. Letters lacking these references or containing incorrect information should be viewed skeptically.
Detailed Contact Information: A legitimate HMRC letter will provide detailed contact information, including a direct phone number, an address for correspondence, and often a list of accepted HMRC payment methods. Scammers, on the other hand, often omit official contact details or provide incorrect ones.
Professional and Consistent Language: HMRC’s letters are written with a high level of formality and precision, with no spelling or grammatical errors. Letters with informal language, spelling mistakes, or unprofessional formatting are often signs of scams.
Instructions for Secure Payments: If the letter mentions outstanding payments, it will provide secure, recognised payment methods. HMRC letters never request cash payments, gift cards, or cryptocurrency.
Types of Official HMRC Letters and Their Functions
HMRC issues various types of letters, each serving a specific purpose. Familiarity with these can help you quickly assess the legitimacy of correspondence.
Self-Assessment and Tax Return Acknowledgments: After submitting your self-assessment tax return, you may receive a letter confirming receipt or alerting you to any discrepancies. This confirmation is often followed by details on any payments due or refunds, with instructions on accessing your account.
Penalty or Interest Charge Notices: If you have outstanding taxes, HMRC may issue a penalty notice explaining the amount owed and the reason for the penalty. Such letters include a breakdown of charges, applicable interest, and instructions on how to dispute or appeal the charges.
Tax Code Change Notifications: Tax code changes are communicated by post if they impact your tax status or require action on your part. The letter will clarify the reason for the change, such as an adjustment based on income level, and provide instructions if further action is needed.
Debt Collection Letters: In cases of unresolved tax debt, HMRC may send debt collection letters. These letters outline the debt amount, payment terms, and, in some cases, options for setting up a payment plan. Debt letters are serious and formal in tone, with clear details about how to address the owed amount.
Red Flags in Fraudulent Letters
Fraudsters may attempt to replicate HMRC letters to extract information or payments from unsuspecting recipients. Here are key red flags to watch for:
Unusual Payment Instructions: Genuine HMRC letters never direct you to make payments through unconventional methods. If a letter requests payment via bank transfer to an unknown account or uses non-HMRC methods, it is likely fraudulent.
Lack of Specific Details: Letters without personal identifiers, like your UTR or National Insurance number, should be treated cautiously. Generic letters addressing “Dear Customer” or “Taxpayer” without specifics are common in scams.
Threatening Language and Urgent Tone: HMRC does not use aggressive language in its official letters. A letter that demands immediate payment or threatens legal consequences if you don’t comply within a short timeframe is likely fraudulent.
Incorrect Logos or Formatting: Carefully examine any letter claiming to be from HMRC. Scammers often use fake or low-quality logos and incorrect formatting. Genuine letters maintain a consistent format and feature high-quality printing.
New Protocols for Letters and Notifications from the 2024 Autumn Budget
The 2024 Autumn Budget introduced new measures to enhance the security and authenticity of HMRC’s postal communications. These changes address the rise in postal scams by introducing improved verification methods:
QR Codes for Quick Verification: From November 2024, HMRC letters include unique QR codes that recipients can scan to confirm the letter’s authenticity. Scanning the code will direct recipients to the official HMRC website, allowing them to verify the letter’s contents securely.
Centralised Verification Database: HMRC has developed a centralised verification system, accessible online, allowing taxpayers to enter reference numbers provided in official letters. This system cross-checks the reference against HMRC’s database, confirming if the correspondence is genuine. Any letters with unverified reference numbers should be reported immediately.
Enhanced Fraud Reporting Procedures: HMRC encourages taxpayers to report suspicious letters more easily via their website or dedicated fraud helpline. Reports from the public help HMRC maintain an updated profile of new scams and initiate action against fraudsters.
How to Respond to Suspicious Letters
If you receive a letter that appears to be from HMRC but raises doubts, follow these steps:
Contact HMRC Directly: Call HMRC using official phone numbers listed on the gov.uk website, not the contact information on the letter. The representative can help verify if the letter is authentic.
Do Not Provide Personal Information: Avoid sharing personal information, especially over the phone or through email, in response to a suspicious letter. HMRC representatives will not ask for sensitive details without identity verification and a legitimate reason.
Report the Letter to HMRC: Send a copy of the suspicious letter to HMRC’s fraud investigation team, either by post or using their online reporting tool. This helps HMRC track fraudulent activity and protect other taxpayers from similar scams.
Real-Life Example of a Suspicious HMRC Letter
Consider this scenario: Alan, a small business owner, receives a letter claiming he has missed a VAT payment and must pay the outstanding amount immediately to avoid legal action. The letter includes a bank account number for the payment and urges him to respond within 24 hours. Suspicious of the threatening tone, Alan checks the letter’s QR code, which fails to redirect to HMRC’s website. He contacts HMRC using the official VAT helpline and learns that there are no outstanding issues with his VAT account. By reporting the fraudulent letter, Alan helps HMRC prevent future scams of a similar nature.
Additional Resources for Confirming Authenticity
Several resources and tools are available to UK taxpayers for verifying HMRC’s postal communication:
HMRC’s Official Communication Guidelines: Available on the HMRC website, these guidelines outline the types of letters HMRC typically sends and the official methods for handling them. Taxpayers can use these guidelines as a reference to differentiate between real and fake letters.
The UK’s Financial Conduct Authority (FCA) Warnings: The FCA offers alerts on financial scams, many of which include letters from fraudsters posing as government bodies. These alerts provide examples of recent scams and instructions on how to report them.
Royal Mail Scam Alerts: Royal Mail also maintains scam alerts that detail current fraudulent activity involving letters. These alerts are particularly useful, as scammers sometimes disguise fraudulent letters as Royal Mail-delivered HMRC notices.
Recognising genuine letters is essential in an era of rising postal fraud. In the next section, we will explore steps to take when you suspect fraud or have encountered a potential scam, detailing immediate actions to protect your information and resources available to UK taxpayers for ongoing support.
Steps to Take When You Suspect HMRC Fraud or Encounter a Potential Scam
Navigating potential fraud can be daunting, especially when it involves complex matters like taxes. However, if you suspect that you’ve encountered a fraudulent HMRC communication—whether it’s a call, email, text, or letter—taking immediate, informed actions can prevent data theft and protect your financial security. In this final part, we’ll cover the essential steps to take if you encounter a suspicious communication, resources available to UK taxpayers, and practical tips to maintain your security against potential HMRC-related scams.
Immediate Steps to Take if You Receive a Suspicious Message or Call
When you encounter a message or call that seems suspicious, it’s essential to act promptly without panicking. Here are the immediate steps to take:
Do Not Respond or Interact: Avoid replying to the message, clicking on any links, or following any instructions. Scammers often use tactics that encourage quick responses to catch you off guard. Take time to assess the situation before responding to any prompts or requests.
Gather Information: Take note of details, such as the phone number, email address, or content of the communication. For text messages or emails, you may want to take a screenshot, while for calls, write down any information you were given by the caller. This information can be helpful if you report the communication to HMRC or authorities.
Cross-Check with HMRC’s Official Resources: HMRC maintains resources specifically for verifying communications. Check if the phone number, email address, or other contact details match HMRC’s official information, which is published on the gov.uk website. Remember, HMRC does not use mobile numbers or email domains outside “@hmrc.gov.uk.”
Report to HMRC Immediately: Reporting the suspected fraud to HMRC is a key step in protecting not only yourself but also other taxpayers who might be targeted by similar scams. HMRC’s reporting options are outlined below and offer quick, easy ways to alert them to potential fraud.
Change Your Account Details if Necessary: If you accidentally provided any personal information, such as your National Insurance number or banking details, take steps to protect your accounts. Contact your bank or financial institution to monitor for suspicious activity, and update passwords for any affected accounts.
How to Report Suspicious Communications to HMRC
HMRC has established several methods for reporting suspicious activity. By reporting potential scams, you assist HMRC in identifying fraud trends, disabling fake numbers, and alerting others about recent tactics. Here are the main reporting options:
Report Phishing Emails: Forward suspicious emails directly to phishing@hmrc.gov.uk without clicking on any links. This email address is monitored by HMRC’s fraud investigation team, who will review and investigate reported cases.
Forward Suspicious Text Messages to 60599: Any suspicious text message can be forwarded to 60599 (standard text message rates apply). HMRC’s fraud team reviews these reports, tracks fraudulent phone numbers, and may take action against them.
Report Fraudulent Calls: Call HMRC’s fraud helpline at 0300 200 3300 if you receive a suspicious call. HMRC’s team can verify if the call was legitimate and, if not, log it as part of their ongoing fraud prevention efforts.
Submit Details Online: The HMRC website offers an online tool to report suspected fraud. This tool is helpful for sharing details such as phone numbers, email addresses, or URLs associated with potential scams. It’s particularly useful if you encounter scams outside regular working hours.
Report Scams to Action Fraud: Action Fraud, the UK’s national reporting centre for fraud, also accepts reports of HMRC scams. They maintain records of reported scams, which contribute to national fraud prevention efforts. You can report fraud through their website (actionfraud.police.uk) or by calling 0300 123 2040.
Using Digital Tools and Security Best Practices to Prevent HMRC Fraud
In addition to being vigilant, adopting security best practices is essential for protecting yourself from HMRC-related fraud. Here are some tips for maintaining a high level of security:
Enable Two-Factor Authentication (2FA): Most financial and government platforms, including your HMRC online account, now offer two-factor authentication. Enabling this feature adds an extra layer of protection, as it requires an additional verification code for account access. This means even if scammers obtain your login credentials, they won’t be able to access your account without the secondary code.
Regularly Monitor Your Accounts: Regularly reviewing your financial accounts, tax records, and HMRC correspondence helps you spot potential irregularities early. If you notice any unexpected transactions or tax adjustments, contact HMRC immediately.
Use Strong and Unique Passwords: For your HMRC account and other financial platforms, ensure you use strong, unique passwords that combine letters, numbers, and special characters. Avoid reusing passwords across multiple accounts to minimise risk if one account is compromised.
Verify Links Before Clicking: Scammers often use fake links that look similar to HMRC’s official website. Before clicking, hover over links to check the URL and ensure it begins with “gov.uk” for HMRC-related content. This simple step can help you avoid phishing sites designed to capture your personal information.
Stay Updated on Fraud Alerts: HMRC’s Scam Alerts page and the UK National Cyber Security Centre (NCSC) regularly update information on recent scams. Staying informed about the latest fraud tactics helps you quickly recognise new scams that may target HMRC taxpayers.
Resources and Support for Taxpayers Facing Fraud-Related Issues
For UK taxpayers who have been impacted by fraud, or simply wish to better protect themselves, several resources offer valuable support:
HMRC’s Support for Identity Theft: If your personal information has been compromised, HMRC offers guidance on handling identity theft and updating sensitive details. They may assist in flagging your account to monitor unusual activity.
Action Fraud’s Resources for Victims of Fraud: Action Fraud provides resources, including support for individuals who have fallen victim to fraud. They can help you report the fraud, guide you through the recovery process, and offer assistance on how to protect yourself moving forward.
UK Financial Institutions’ Fraud Protection Services: Many UK banks and financial institutions have dedicated fraud departments that can monitor your accounts and assist with fraud prevention. Contact your bank if you suspect any account issues related to HMRC scams.
The NCSC’s Online Security Advice: The National Cyber Security Centre offers in-depth advice on online security, including guidance on phishing, secure passwords, and safeguarding personal information. They also provide easy-to-follow tips that help individuals and businesses protect themselves from cyber threats.
The UK Information Commissioner’s Office (ICO): If your data has been misused or you believe your privacy rights have been violated, the ICO provides advice and support. They offer resources to help you understand your rights regarding data privacy and how to seek assistance if necessary.
Real-Life Example of Fraud Prevention in Action
Let’s look at a scenario where fraud prevention measures helped avert a scam. Tom, a small business owner, received an email claiming to be from HMRC, stating he was due a significant tax refund. The email requested that he click a link and enter his bank account details. Suspicious of the unusual request, Tom hovered over the link and noticed the URL was not part of the official “gov.uk” domain. Instead, he forwarded the email to phishing@hmrc.gov.uk and deleted it. He then logged directly into his HMRC online account, confirming there was no mention of a refund. By staying vigilant and using verification steps, Tom avoided what could have been a costly phishing scam.
What to Do if You Become a Victim of HMRC Fraud
Despite best efforts, it’s possible to fall victim to HMRC-related fraud. If you find yourself in this situation, here are steps to take:
Report the Fraud: Immediately report the fraud to Action Fraud, as well as to your bank if financial information was compromised. They can help you secure your accounts and initiate an investigation.
Notify HMRC: Inform HMRC about the fraud, especially if your HMRC account or taxpayer information was used in the scam. HMRC may add extra security measures to your account and help you understand next steps.
Monitor Your Credit Report: Scammers may use stolen information to apply for credit in your name. Monitoring your credit report for unusual activity is an effective way to detect and address identity theft.
Consider ID Theft Protection Services: Some financial institutions offer identity theft protection services that monitor your data and alert you to any unusual activity. These services can provide an added layer of security.
Seek Legal Advice if Necessary: In cases of significant financial or data loss, legal advice may be beneficial. A lawyer familiar with fraud cases can help you recover losses and advise on further protective measures.
Final Words: Building a Habit of Vigilance
HMRC-related scams are a serious issue in the UK, affecting individuals and businesses alike. By staying informed, using the available tools and resources, and practicing vigilance, taxpayers can protect themselves from falling victim to these scams. While HMRC continually updates its protocols to enhance security, your active participation in verifying and reporting suspicious activity is key to maintaining a safe financial environment. Staying proactive in fraud prevention will help you navigate HMRC communications confidently and securely, ensuring that your interactions with the tax authority are safe and protected.
FAQs
Q: Can you request a callback from HMRC to verify a contact?A: Yes, if you receive a call from HMRC and are uncertain about its legitimacy, you can request a callback on one of HMRC's official contact numbers published on their website.
Q: Will HMRC leave a voicemail if you miss their call?A: HMRC may leave a voicemail stating it attempted to contact you, but it will not leave sensitive information or request any action without providing a callback number for verification.
Q: Does HMRC use WhatsApp or social media messaging to contact taxpayers?A: No, HMRC does not use WhatsApp or other social media platforms to contact taxpayers. Any such messages should be considered fraudulent.
Q: Can you verify an HMRC agent’s identity if they call you?A: Yes, HMRC representatives will provide identification information. You can ask for their name and office location and verify by calling HMRC directly.
Q: Are HMRC emails encrypted for security?A: HMRC emails sent from “@hmrc.gov.uk” are encrypted. However, HMRC will not send sensitive personal information through email.
Q: Will HMRC contact you if you are due a refund without submitting a claim?A: No, HMRC will not initiate contact for tax refunds without prior claims or inquiries from you. Genuine refunds are typically processed through your online HMRC account.
Q: Can you report HMRC scams anonymously?A: Yes, you can report suspected HMRC scams anonymously through HMRC's fraud reporting tool or by calling Action Fraud.
Q: What should you do if a scammer accessed your HMRC account?A: If you believe a scammer accessed your HMRC account, contact HMRC immediately, update your security settings, and monitor for unusual account activity.
Q: Can you block scam numbers pretending to be HMRC on your phone?A: Yes, you can block numbers suspected of impersonating HMRC. However, it’s also essential to report these numbers to HMRC for tracking purposes.
Q: Does HMRC contact employers about employees’ tax matters directly?A: Generally, HMRC contacts employers only for tax issues directly related to payroll, not for individual employees' personal tax issues.
Q: Can you verify HMRC emails using an email verification service?A: HMRC advises against using third-party email verification services. Instead, forward suspicious emails to HMRC’s official phishing report address.
Q: Will HMRC ever ask you to contact them through a link in a text message?A: No, HMRC does not provide clickable links in text messages for contacting them. They only provide links to their official website.
Q: Can a fraudulent HMRC letter look identical to a genuine one?A: Yes, scammers can replicate letterhead and layout, so always verify by cross-referencing with official contact information on the HMRC website.
Q: Can HMRC contact you about overdue tax debts via private debt collection agencies?A: Yes, HMRC sometimes works with private debt collection agencies, but official agencies will provide verified HMRC reference numbers and legitimate payment options.
Q: Does HMRC use international phone numbers for calls?A: No, HMRC will not use international numbers to contact UK taxpayers. Calls from non-UK numbers claiming to be HMRC should be considered scams.
Q: Can you add HMRC’s official contact numbers to your phone for easy verification?A: Yes, adding HMRC’s official contact numbers to your phone contacts can help you verify legitimate calls quickly.
Q: Is it safe to use online forums to discuss HMRC contacts and possible scams?A: While online forums can provide community support, avoid sharing personal information. Always verify information directly with HMRC.
Q: Will HMRC ever contact you regarding overdue National Insurance contributions?A: Yes, HMRC may contact you by letter or phone regarding overdue National Insurance contributions but will not demand immediate payment by unconventional methods.
Q: Can HMRC’s automated calls be considered genuine?A: HMRC uses automated calls only for certain reminders or information updates. Any automated calls requesting personal details should be considered suspicious.
Q: Does HMRC provide payment plan options directly over the phone?A: HMRC representatives may discuss payment plan options but will follow up with written confirmation. Avoid setting up payment plans over a single phone call.
Q: Can you confirm the authenticity of HMRC phone calls via the HMRC app?A: No, the HMRC app does not currently verify calls. You should verify calls by calling HMRC directly on their official helpline.
Q: Does HMRC contact taxpayers about tax credits via text message?A: HMRC may send informational text messages about tax credits but will not request any personal details or immediate action through text.
Q: Is HMRC involved in doorstep visits for tax-related matters?A: In rare cases, HMRC officers may make in-person visits, but they will always provide identification and prior notice. Verify any doorstep visits by contacting HMRC.
Q: Can HMRC take legal action without sending a prior notification letter?A: No, HMRC must issue formal written notice before initiating any legal action. Claims of immediate legal consequences without prior letters are likely fraudulent.
Q: Will HMRC ever contact you with an email attachment?A: HMRC rarely uses attachments due to security concerns. They will direct you to their website instead of attaching sensitive documents.
Q: Can HMRC's genuine numbers sometimes appear as private on caller ID?A: While rare, genuine HMRC calls can appear as private, but HMRC will not hesitate if you ask to verify their identity by calling back.
Q: Is it common for HMRC to use third-party companies for verifying tax information?A: HMRC occasionally partners with authorised third-party verification companies, but they will always provide official identification and verification means.
Q: Can you report HMRC-related scams on social media?A: While you can report scams on social media platforms, HMRC recommends using their official reporting channels for effective follow-up.
Q: Are there specific signs to recognize fake HMRC websites?A: Yes, fake HMRC websites often use misspellings, unofficial domains, and request personal information prematurely. Always check for “gov.uk” in the domain.
Q: Does HMRC ask businesses to update VAT information through text messages?A: HMRC will not request sensitive VAT updates via text messages. Official requests for VAT updates will be sent through secure online accounts.
Q: Can HMRC contact you about overdue payments through email only?A: No, HMRC will issue letters for overdue payments before sending email reminders. They will not rely solely on email for payment requests.
Q: Will HMRC offer a callback option for all types of enquiries?A: HMRC does offer callback options for many types of inquiries but may not provide immediate callbacks during peak periods or for general inquiries.
Q: Can you use an official HMRC helpline to verify payment deadlines?A: Yes, HMRC helplines can confirm deadlines and payment options. Avoid relying on information from unsolicited emails or texts for this purpose.
Q: Are there circumstances where HMRC may request personal details in a letter?A: HMRC may request specific details by letter, but they will not ask for sensitive financial information like full bank details or credit card numbers.
Q: Can you verify if a debt collection agency contacting you on behalf of HMRC is genuine?A: Yes, you can confirm the agency's legitimacy by contacting HMRC directly and verifying the debt and agency reference.
Q: Will HMRC ever offer special discounts on tax debt payments?A: No, HMRC does not offer discounts or incentives for immediate debt payment. Such offers are common in fraudulent schemes.
Q: Can you call HMRC directly to report a lost National Insurance card?A: Yes, HMRC handles lost National Insurance card queries, and you can contact their helpline for guidance on replacements.
Q: Does HMRC contact people regarding tax issues after business hours?A: HMRC typically operates within standard business hours. Calls outside these hours should be verified for legitimacy.
Q: Can you receive updates on your tax account via a non-HMRC email address?A: No, only messages from “@hmrc.gov.uk” are genuine. Updates from other email domains are not from HMRC.
Q: Does HMRC contact new business owners for verification?A: HMRC may contact new businesses to confirm registration details but will only do so through official channels, with reference numbers for verification.
Disclaimer:
The information provided in our articles is for general informational purposes only and is not intended as professional advice. While we strive to keep the information up-to-date and correct, Pro Tax Accountant makes no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, products, services, or related graphics contained in the articles for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
We encourage all readers to consult with a qualified professional before making any decisions based on the information provided. The tax and accounting rules in the UK are subject to change and can vary depending on individual circumstances. Therefore, Pro Tax Accountant cannot be held liable for any errors, omissions, or inaccuracies published. The firm is not responsible for any losses, injuries, or damages arising from the display or use of this information.