HMRC is, reliably, one of the most impersonated organisations in the UK. Every year, millions of phishing messages claiming to be from HMRC land in UK inboxes. Some promise a tax rebate. Some threaten an overdue payment and legal action. Some are urgent, some are polite, and some are frighteningly convincing.
For small business owners and their employees, this matters more than most people realise. HMRC communications are a normal part of running a business — Self Assessment, VAT, PAYE, corporation tax — which means staff are primed to treat HMRC-branded emails as legitimate. That’s exactly what attackers are relying on.
What HMRC phishing actually looks like
The most common variant is the tax rebate scam. You receive an email or text saying HMRC has calculated that you’re owed a refund — often a suspiciously specific figure like £312.47 — and that you need to click a link and provide your bank details to receive it. The link goes to a convincing HMRC-lookalike site that harvests your banking credentials.
The second common type is the penalty notice. You’re told you have an overdue tax payment and face legal action, arrest, or account suspension unless you act immediately. These create urgency, which is the point — urgency bypasses careful thinking. Some versions ask you to call a phone number where an operator will then walk you through “resolving” the issue, which invariably involves making a payment or revealing account details.
Less common but increasingly seen are fake HMRC emails asking you to verify your Government Gateway credentials, or messages about a VAT refund that require you to log in via a link. The Government Gateway login page is replicated convincingly enough that it catches people who are looking for it.
Finally, there’s the fake HMRC WhatsApp or text message asking you to follow a link to claim a rebate. These have become more prevalent as text-based verification has become normalised.
The thing HMRC actually does
Here’s what separates real HMRC communications from fake ones. HMRC will contact you by letter for significant matters — penalties, formal notices, compliance queries. They do send emails and texts, but these are always general notifications pointing you to your Government Gateway account, not requests to click a link and enter credentials.
HMRC will never: email or text you a direct refund link requiring bank details; call you and demand immediate payment to avoid arrest; ask you to pay a tax debt using gift cards or cryptocurrency; or send links to log in to Government Gateway via email.
If you get an email saying you have a refund and need to click a link, that’s a phishing email. Full stop. Real HMRC refunds are processed to the bank account you have on file through your HMRC online account — there’s no separate claim process involving a link.
How to check if a communication is genuine
The cleanest approach is to ignore the communication entirely and log in to your Government Gateway account directly at gov.uk/government-gateway. If there’s actually a rebate, a notice, or an overdue amount, it will show there. If your Government Gateway account shows nothing relevant, the communication is fake.
For PAYE correspondence if you’re an employer, and for VAT communications, everything legitimate will be visible in your Business Tax Account. If you receive a letter — rather than an email or text — that looks like HMRC, the reference numbers on it will correspond to your tax record and will be visible when you log in.
If you’re uncertain about an email’s legitimacy, you can forward it to HMRC’s phishing reporting address: phishing@hmrc.gov.uk. They actively maintain a database of known phishing campaigns and will confirm whether a message is genuine.
What to do if someone at your business has been caught out
Act quickly. If anyone has clicked a phishing link and entered credentials — Government Gateway password, banking details, or National Insurance number — assume those credentials are compromised.
For banking credentials: call your bank immediately using the number on the back of your card. Most banks have dedicated fraud lines and can freeze accounts and reverse unauthorised transactions if you contact them promptly.
For Government Gateway credentials: change your password immediately. HMRC also recommends enabling two-step verification on your Business Tax Account if it isn’t already active. Contact HMRC’s helpline (0300 200 3300 for businesses) to flag the compromise.
Report the phishing attempt to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040. Action Fraud feeds reports into the National Fraud Intelligence Bureau, and reporting genuinely helps — it’s how phishing campaigns get identified and taken down.
If you’ve lost money as a result of a scam claiming to be HMRC, also report it to your local police force alongside Action Fraud.
Five minutes of prevention
The easiest fix is a brief, specific team conversation: tell staff that HMRC never sends direct refund links, never demands immediate payment over the phone, and that any communication about tax should be checked by logging directly into your HMRC Business Tax Account. Make that the default response to any HMRC email that creates urgency or asks for credentials: log in directly, don’t click the link.
For higher-risk staff — finance employees, accountants, anyone managing PAYE or VAT — it’s worth running through a few example screenshots of HMRC phishing emails. Recognition is dramatically better after seeing examples than after reading a description.
The campaigns are sophisticated enough now that no single visual cue reliably identifies fakes. What reliably identifies them is the behaviour they’re asking for. HMRC never asks for banking details via a link. Remember that and you’ve taken away most of the risk.