HMRC phishing scams have been rife in recent years - from voicemails threatening warrants for people's arrest to the promise of tax rebates.
The aim of most of these scams, which can target you over the phone, email or arrive via text message, is to get your personal information and, most importantly, your bank details.
However, Which? has heard of a recent scam that didn't involve taking any of the victim's money - instead, the fraudster beat the victim to filing her tax return and initiated a tax refund worth almost £7,000 into another account.
Here, we explain how the scam came about and what you should watch out for to avoid falling victim to these tax fraudsters.
On 22 March, Diane (not her real name) from New Malden, who has been self-employed for several years, received a text from HMRC saying she had qualified for a tax rebate. It was the day before Prime Minister Boris Johnson announced the first UK-wide coronavirus .
Many businesses had already been forced to close, and it was two days after the had been announced. It was a time of desperate anxiety and chaos; loo roll and pasta was nowhere to be found in supermarkets.
'We'd just gone into lockdown, and we were being told we could get some money from the government if you met certain criteria,' she says. 'So when I saw this text I thought “Oh great, I'm going to be meeting that criteria”.'
The text said it was from HMRC, and informed Diane 'We have determined that you are eligible to receive a tax refund. Check the following link to begin'.
'I still think it looks very kosher,' she says. The link began 'govrevenue.info/' and was then followed by a code. Needless to say, the server for the site is no longer in use.
The link, when it worked, asked Diane to provide her full name, address, phone number and National Insurance number. 'I can't quite remember if it asked for my - but I suspect it did, and I suspect I gave it to them,' she recalls.
It was only when Diane went to submit her tax return online that she found what her details may have been used for.
'My account told me I couldn't submit my tax return and had a note to say I'd already submitted it on 17 October. I was logging in on the 27 October,' she says. 'It also said 'registered date due 19 October', and then said that a repayment for £6,962.19 was issued on 22 October.'
'I checked to see if my details were correct - and they were - it had my correct name, address and National Insurance number, but I couldn't see any details for the bank account where the refund had been paid.'
It was only a week later, when Diane received a letter from HMRC confirming 'her' refund that she could see where the money had been paid. The fraudsters had seemingly opened a fake bank account under 'Mr M' and then had used Diane's surname. She doesn't know anyone by that name.
When Diane spoke to HMRC she alerted them to this fact but was told the money had already been paid and cleared.
Diane's case is currently being investigated by HMRC's fraud department, while she waits to see what happens next.
She's worried about being on the hook for the tax refund that's been paid out - 'I'm just working on the assumption that they [HMRC] will just write it off and things can go back to normal', as well as when she'll be able to file her actual tax return - after all, the clock is ticking down to the 31 January deadline.
'I'm also worried about things I might have to change in case this happens again - I mean, they've got my National Insurance number now, which could affect my pension in a few years' time.'
We put the details of Diane's scam case to HMRC, and a spokesperson told us: 'Criminals sometimes steal identities to fraudulently register for Self Assessment and request repayments.
'HMRC takes steps to identify and stop such repayment claims, and uses the full range of legal powers available to tackle those that abuse these services.
'If someone believes their details have been stolen they should contact us as soon as possible so we can secure their account and help solve any problems the fraud may have caused.'
HMRC scams are incredibly common and have been particularly rife of late. Over the past year, the tax authority has responded to 846,435 referrals of suspicious HMRC communications from the public, and nearly 500,000 of these offered bogus tax rebates.
There are a few basic things you should watch out for to avoid becoming a scam victim.
If you're worried you've been the victim of a scam, it's best to contact your bank or payment provider as soon as possible - particularly if you've given someone your bank details.
You should be given advice on how to protect your account, and if you've lost any money your bank should help you get it back.
It's also important to report the scam to the authorities.
You can forward suspicious emails claiming to be from HMRC to firstname.lastname@example.org and texts to 60599.