Quick answer
Be very cautious of messages claiming to be from HMRC that send you to links not on GOV.UK or an official HMRC domain (hmrc.gov.uk). HMRC will not ask for personal or payment details by text. If you receive a message claiming to be from HMRC, do not use links, phone numbers or QR codes in that message — verify through GOV.UK or contact HMRC using details found independently.
Every year, hundreds of thousands of people in the UK receive fake HMRC communications. Some are emails claiming you're owed a tax refund. Others are texts warning of an unpaid bill or threatening legal action. Some even arrive as convincing-looking letters with HMRC branding.
The reason HMRC is such a popular target is simple: almost everyone deals with HMRC at some point, the consequences of ignoring a genuine notice can feel serious, and the word "tax" creates immediate anxiety. Scammers exploit all three of those things at once.
The short answer: what HMRC will and won't do
Before looking at specific warning signs, it helps to know what HMRC's actual communication habits are. This alone will let you dismiss most fake messages immediately.
- HMRC will never send you a tax refund notification by email
- HMRC will never ask you to enter bank details via a link in a text or email
- HMRC will never ask you to pay a bill using gift cards, cryptocurrency, or a wire transfer
- HMRC will never call and demand immediate payment without sending a letter first
- HMRC will never threaten immediate arrest or legal action without prior correspondence
- HMRC does send letters by post — genuine HMRC letters include your UTR or NI number
- HMRC does use Personal Tax Account at gov.uk — you can always check there instead
What a fake HMRC email looks like
Subject: Tax Refund Notification — Action Required
Dear Taxpayer,
Our records show that you are entitled to a tax refund of £284.50 for the 2023/2024 tax year. To process your refund, please verify your details within 48 hours.
[Claim Your Refund Now]
Failure to claim within the deadline will result in the refund being forfeited.
HM Revenue & Customs
Notice several things about this example. The sender domain — hmrc-gov-uk-refund.com — is not a GOV.UK address. Genuine HMRC online services and payment pages use gov.uk or hmrc.gov.uk. A sender domain that does not match either of these should be treated with significant caution. The email creates urgency with a 48-hour deadline. It asks you to click a link to enter your details.
Put this email through Summarly and it would immediately flag the non-GOV.UK sender domain, the refund claim combined with an urgent deadline, and the instruction to click a link to enter personal details — all strong indicators of a phishing attempt.
What a fake HMRC text looks like
The domain in this text — hmrc-payment-secure.com — does not match a genuine HMRC domain. Genuine HMRC payment and sign-in pages use gov.uk or hmrc.gov.uk. Any payment link claiming to be from HMRC that uses a different domain should be treated as suspicious. The threat of "legal proceedings within 24 hours" is designed to create panic and stop you from thinking clearly.
What a genuine HMRC letter looks like
Genuine HMRC letters will typically include your Unique Taxpayer Reference (UTR), your National Insurance number, or both. They will be addressed to you by name, not "Dear Taxpayer" or "Dear Customer." They will not ask you to scan a QR code or click a link to enter payment details.
If you receive a letter that looks like it's from HMRC and you're unsure whether it's real, do not use any contact details or links in the letter. Instead, log in to your Personal Tax Account at gov.uk/personal-tax-account and check your correspondence there, or call HMRC on a number you find directly on gov.uk.
Warning signs to look for
- The email address or text sender does not come from a gov.uk domain
- A refund is offered — HMRC does not notify refunds by email
- There is an urgent deadline — 24, 48, or 72 hours
- You are asked to click a link and enter personal or bank details
- The message threatens arrest, court action, or debt collectors
- The letter asks you to scan a QR code to make a payment
- Your name is not used — generic "Dear Customer" or "Dear Taxpayer"
- You are asked to pay via gift cards, cryptocurrency, or bank transfer to an unfamiliar account
What to do if you receive a suspicious HMRC message
- Do not click any links or call any numbers in the message
- Check your HMRC Personal Tax Account directly at gov.uk/personal-tax-account
- If you need to contact HMRC, use the numbers on gov.uk only — not numbers from the message
- Forward suspicious emails to phishing@hmrc.gov.uk
- Forward suspicious texts to 60599 (free from most UK networks)
- If you entered your bank details, contact your bank immediately using the number on the back of your card
- Report to Action Fraud at actionfraud.police.uk or 0300 123 2040
Received an HMRC message you're not sure about?
Paste it into Summarly and get a plain-English explanation of what it appears to say, what looks suspicious, and what to do next.
Check a message freeFrequently asked questions
Does HMRC send refunds by email?
No. HMRC does not send tax refund notifications by email. If you are owed a refund, HMRC will either pay it automatically to a bank account they hold on file, or write to you by post. Any email claiming to offer an HMRC refund is a scam.
How do I check if a letter is really from HMRC?
Genuine HMRC letters include your UTR or National Insurance number and are addressed to you by name. Log in to your Personal Tax Account at gov.uk/personal-tax-account to check whether the correspondence matches your records. If in doubt, call HMRC using the number from gov.uk.
What should I do if I already clicked the link?
If you clicked but did not enter any details, the risk is lower — close the browser and run a security scan. If you entered personal information such as your NI number or date of birth, contact HMRC directly via gov.uk. If you entered bank or card details, call your bank immediately using the number on the back of your card.
Does HMRC send texts?
HMRC does occasionally send texts, but they will never contain a link asking you to enter personal or payment details. HMRC texts are typically used to notify you that correspondence is waiting in your online account, not to request payment directly.