HMRC scams: new controls protect taxpayers from 'number spoofing' calls

Millions of taxpayers have more fraud protection thanks to new HMRC controls that crack down on popular 'number-spoofing' techniques.

Through number spoofing, scammers were able to call victims using what appeared to be HMRC's own helpline numbers, making scams more difficult to spot.

Created in partnership with Ofcom and the telecoms industry, HMRC says the new controls have already reduced the number of calls spoofing its inbound numbers to zero, and slashed scam reports by 25%.

Scammers can still spoof other numbers, though. And while these new protections are welcome, there are still ways for fraudsters to trick victims into parting with their cash. Here, we explain what you need to do to stay safe.

How did HMRC number-spoofing scams work?

You receive a threatening phone call from an eerie automated voice that claims to be from HMRC. It says you owe money, or that you are due a sizeable refund.

You're pretty sure this can't be true, but when you look up the number online, you find that the call really was from HMRC. Or at least it appeared to be.

Since 2016, the number of phone-based HMRC scams reported has risen dramatically, from 407 in the 2016/17 tax year to 104,774 in 2018/19.

The most convincing scammers used number spoofing to mask their own numbers and replace them with trusted HMRC numbers, making it appear as if the tax authority was genuinely calling.

Real clips from HMRC scams below demonstrate some of the more intimidating messages people have received.

Thanks to HMRC's new controls, scammers are no longer able to spoof the tax authority's well-known 0300 helpline numbers.

They are still able to use fake numbers to conduct scams, but as these numbers can't be the same as HMRC's, the scams will be far less convincing.

Pauline Smith, head of Action Fraud, the UK's national fraud reporting centre, said: 'Phone calls are one of the top ways for fraudsters to make contact with their victims. Between April 2018 and March 2019, one in four phishing reports made to Action Fraud were about fraudulent phone calls.'

'It is encouraging to see that these newly developed controls by HMRC have already achieved a reduction in the number of calls spoofing genuine HMRC numbers. If you believe you have fallen victim to a fraudster, please report it to Action Fraud.'

Gareth Shaw, head of money at Which?, said: 'For too long, fraud victims have lost life-changing sums of money to scammers they believed to be legitimate.'

'Number spoofing can be incredibly hard to spot, so it is good to see HMRC, one of the most impersonated firms, taking action to stop fraudsters from exploiting their helpline number and identity.'

'A cross-sector approach is needed to tackle fraud, and it is now vital other public bodies and firms that are commonly impersonated follow this example and work with telecoms companies and Ofcom to stop fraudsters spoofing their numbers and targeting victims.'

Number-spoofing scams: the bigger picture

Alongside HMRC, there have also been reports of criminals spoofing numbers from banks and well-known brands.

In April, we conducted a survey of more than 10,000 Which? members. Of those surveyed, 10% said they had been targeted by number spoofers.

As well as phone calls, fraudsters can use number spoofing to hijack genuine text or WhatsApp message chains from organisations you trust, convincing you to click on dangerous links.

In December 2018, the UK's largest mobile providers launched an initiative to combat this practice. This came after Which? research revealed that one in three people had received fraudulent texts in the six months leading up to August 2018.

UK Finance, the industry body representing the financial sector, told us that it is working with Ofcom as part of the same initiative as HMRC to introduce similar controls for bank customer service numbers, although it did not give a timeframe for when these protections will be brought in.

How to spot a scam

By their very nature, number-spoofing scams are difficult to spot. If you look up the number, you could still reasonably believe that the call or text was legitimate.

However, there are still some telltale signs to look out for. HMRC has confirmed that it would never call anyone threatening their arrest. Even if someone was accused of a crime, the accused couldn't 'cancel' it by paying the money they owed.

The best approach if anyone calls out of blue claiming to be from HMRC or your bank is to hang up and call them back using the number on its website. This way you can be sure that it's legitimate.

You can read our full guide on how to spot a scam for more helpful tips. And HMRC has issued more general advice on how to avoid phone scams:

• Recognise the signs: you'll never be contacted out of the blue by a genuine organisation asking for personal info like your Pin, password or bank details.
• Stay safe: don't give out private information, and don't reply to text messages, download attachments or click on links in emails you didn't expect.
• Take action: if you think you've been targeted by fraudsters, make sure you report it.

Reporting a scam

Reporting scams helps the authorities understand them so they can work on new protections.

You can report any kind of scam to Action Fraud online, or by calling 0300 123 2040.

Forward scam or spam texts to your mobile phone provider via the free number 7726.

Any HMRC-related fraud can be reported by emailing phishing@hmrc.gov.uk or texting 60599.

• Find out more: see ourcomprehensive guide on how to report a scam for more details, and find out what to do if you're the victim of a bank transfer scam here.