Received a Suspicious HMRC Message? Here's What to Do
Scammers impersonating HMRC are one of the most common types of fraud in the UK. Whether you've received a suspicious phone call, text message, email, or WhatsApp message claiming to be from HMRC, this guide tells you exactly what to do — and what not to do.
How to Tell If an HMRC Contact Is a Scam
HMRC will never:
- Call you to demand immediate payment under threat of arrest
- Send you a text with a link to claim a tax refund
- Ask you to pay using iTunes gift cards, wire transfer, or cryptocurrency
- Leave automated voicemails threatening court action or police
If any of these happened, it is a scam. HMRC will contact you by post if there is a genuine issue with your tax account. Legitimate HMRC emails and texts do exist — but they will never ask you to click a link and enter your personal or banking details.
What to Do Right Now
Do not pay and do not click any links.
If you've already paid or entered details, skip to the next section.
Screenshot or note the details.
Record the phone number, email address, or SMS sender before you delete anything. This helps with reporting.
Report the scam.
- Suspicious email: Forward to report@phishing.gov.uk (NCSC)
- Suspicious text: Forward to 7726 (free on all networks)
- HMRC-specific: Forward to phishing@hmrc.gov.uk
- If you've lost money or given personal details: Report to Action Fraud at actionfraud.police.uk or call 0300 123 2040
Block the number or sender.
Do not engage further.
If You've Already Clicked a Link or Paid
If you clicked a link and entered personal or banking details:
- 1Change your passwords immediately — start with your email account, then any accounts that use the same password
- 2Contact your bank immediately if you entered payment details or made a transfer — call the number on the back of your card and explain it was fraud
- 3Check your HMRC online account at gov.uk/personal-tax-account for any changes you didn’t make
- 4Report to Action Fraud — get a crime reference number
- 5Run a malware scan if you downloaded anything
Check your security in 10 minutes
Get a personalised Security Score and checklist — free, no credit card required.
Get your free Security ScoreHMRC Scams Are Getting More Convincing
Modern HMRC scams use spoofed phone numbers that appear to show the genuine HMRC helpline (0300 200 3300). They also use your name and partial National Insurance number — often bought from previous data breaches — to sound legitimate. If you're unsure whether a contact is genuine, call HMRC directly on 0300 200 3300 using the number you look up yourself. Never call back a number given to you in the suspicious message.
Frequently Asked Questions
HMRC left me a voicemail saying I'll be arrested if I don't call back. Is it real?
No. This is a very common scam script. HMRC does not threaten arrest by voicemail. Do not call the number back. Report the voicemail to Action Fraud.
I paid a scammer pretending to be HMRC. Can I get my money back?
Contact your bank immediately and explain it was a fraud payment. Banks are required under the APP Fraud Reimbursement Code (October 2024) to reimburse most authorised push payment fraud up to £85,000 — but you must report quickly. Also report to Action Fraud.
How do I check if a genuine letter from HMRC is real?
Genuine HMRC letters come from specific addresses and include your full name and reference number. You can verify any contact through your personal tax account at gov.uk/personal-tax-account — genuine communications will be reflected there.