Save on your tax bill
Members can use GoSimpleTax's tax calculator for £32.50 and avoid accountant fees
Get startedBy clicking a retailer link you consent to third-party cookies that track your onward journey. This enables W? to receive an affiliate commission if you make a purchase, which supports our mission to be the UK's consumer champion.
HMRC warns of tax scams targeting self-assessment customers
Fake rebate messages remain the biggest threat
More than 170,000 HMRC scams were reported in the past year – and nearly 50,000 of those targeted self-assessment taxpayers.
While scam reports are down 12% on the previous year, HMRC has issued a warning to self-assessment customers ahead of the January 2026 tax return deadline.
Here, Which? explains how the scam works, how to protect yourself, and the signs to look out for in legitimate HMRC communications.
What is the most common HMRC scam?
Scammers often impersonate government bodies like HMRC to try and trick you into thinking they’re legitimate – all in an effort to steal your money or identity by getting you to reveal personal information.
According to HMRC, of the 170,000 scams reported in the 12 months up to July, more than 47,000 involved fake tax refund claims. This type of scam usually comes via email or text message, telling you you’re owed a tax rebate.
It will often include a link to a fake website that asks for your personal details.
Sharing information such as your name, address, email, passwords or login details can put your email, bank or other accounts at risk – and could help criminals steal your identity.
HMRC data shows that over a third of phishing reports last year were linked to bogus tax rebate offers.
- Find out more: tax returns 2025: important deadlines
How to avoid a HMRC tax scam
To help people avoid falling foul of fraud, HMRC has shared some ways which can help you spot tax rebate scams. These include:
File your tax return early
Filing your self-assessment tax return early can make scams easier to spot. Once you've submitted your return, you're less likely to be caught off guard by phishing messages in the lead-up to the 31 January 2026 deadline.
Last-minute filers may feel under pressure, which makes it easier to fall for emails or texts that appear urgent or official. Early filing gives you more time to review any messages carefully and spot red flags.
- Find out more: how to fill in a self-assessment tax return
Use the HMRC app
HMRC recommends using its official app as a secure way to manage your tax account and avoid scam messages altogether. The app allows you to view your real tax position, including any refunds due, without clicking on suspicious links.
It uses secure login tools such as PINs and facial recognition, which also makes it harder for scammers to access your information.
If you are due a refund, you’ll be able to claim it directly through the app.
- Find out more: HMRC adds new features to its app
4 things HMRC will never do
To help taxpayers identify scams when they appear, HMRC has shared a list of things it will never do when contacting you about your tax affairs. These include:
- Send texts, emails, or make phone calls offering tax rebates: All legitimate information about tax refunds is shared securely through your official HMRC online account or by post.
- Leave voicemails threatening legal action or arrest: If you owe tax, HMRC will contact you via formal channels and won't make aggressive threats.
- Use threatening language demanding urgent payments: Official HMRC communications, whether by phone or letter, will never use threatening or high-pressure language to demand an urgent payment. While they may contact you about overdue taxes, they will not insist on immediate payment over the phone or demand that you pay using unconventional methods, such as gift cards or cryptocurrency.
- Ask for personal or financial information: You will never be asked to provide personal details such as passwords or bank account numbers over the phone, through text, or email. Its digital communications will only direct you to guidance pages on GOV.UK.
3 things HMRC will do
HMRC does contact taxpayers through letters, texts and emails – for example, if it's unclear whether you’ve filed a return or if you’ve appealed a penalty.
But there are checks in place to help you tell when a message is genuine. HMRC says it will:
- Use specific, official subject lines: Emails will relate to a particular campaign or situation (such as an appeal or annual summary) and won’t contain vague messaging or links to login pages.
- Provide links to the official Gov.uk website: If a text or email contains a link, it should always direct you to an official page on the GOV.UK. Scammers often use slightly altered web addresses that are easy to miss, so you should always check the full URL before clicking.
- Use QR codes that lead to guidance only: HMRC uses QR codes in some of its letters and communications. These codes will direct you to official guidance on the GOV.UK website and will never take you to a page where you need to enter personal information.
Find out more: sign up to our Which? scam alert newsletter
What to do if you think you’ve fallen for a scam
HMRC warns that scammers are becoming increasingly sophisticated in their use of artificial intelligence, creating convincing emails and texts that appear to come from the tax office.
They may also use high-pressure tactics over the phone to intimidate people into acting quickly. Calls often come at busy times – such as during the school run or commute – when you’re more likely to be distracted.
You should always report any suspicious activity to HMRC. You can report phishing scams to the tax office by forwarding emails to phishing@hmrc.gov.uk. You can report scam phone calls through GOV.UK and forwarding suspicious texts to 60599.
If you think you have shared any bank details with scammers, you should contact your bank immediately.
- Find out more: how to report a scam
