HMRC scam messages: how small businesses can tell real from fake

If you run a small business, you will get messages that claim to be from HMRC. Some are genuine. Many are not. The trouble is that a real HMRC text and a fake one can look almost identical on a phone screen, and a busy owner replying quickly is exactly what a scammer wants. This post sets out, using HMRC's own published guidance, how to tell the difference, where to report a fake, and what to put in place so one rushed click does not cost you money.

Start with how the message makes you feel

HMRC's guidance on spotting tax scams gives a simple checklist. Treat a contact as suspicious if it:

• rushes you or threatens you
• is unexpected
• asks for bank or personal details
• tells you to transfer money
• offers a refund, a tax rebate or a grant

That last point catches a lot of people out. A message that says you are owed money is flattering, so it gets less scrutiny than one that threatens a fine. Treat both with the same caution.

What HMRC says it will never do

HMRC publishes a short list of things it will not do. These are useful because you can rule a message out without any technical knowledge:

• It will never leave a voicemail threatening legal action or threaten arrest.
• It will never use social media to offer a tax rebate or to ask for personal or financial information.
• It will never ask you to pay using gift or payment vouchers.
• It will not contact you on WhatsApp, other than single-message alerts sent to people who have subscribed to the UK Government Channel.
• It will never send you to a page asking for personal information from a QR code. HMRC says QR codes usually lead to GOV.UK and it will tell you if one goes elsewhere.

The QR code point is worth passing on to staff.

HMRC does send some texts, so check the list

It would be easy to say that any text from HMRC is fake, but that is not true, and HMRC says so itself. Its page on checking whether a text is genuine lists the types it does send. Examples include confirmations of a claim or form, texts after a call to certain helplines, debt recovery texts, Self Assessment texts about penalty appeals, tax refunds or overdue returns, and VAT registration updates. Some of these have date windows. For example, the page lists debt recovery texts running from 15 June to 14 December 2026, and VAT registration updates from 5 October 2026.

The page also gives a firm rule: HMRC will never ask for personal or financial information when it sends text messages. Many genuine texts contain no website link at all, and some types never include one. It lists the fast parcel operator, Self Assessment refund and penalty appeal texts as examples. So the quickest test is this:

• Does the text match a type on the list, and is it inside the date window if one applies?
• Is it asking for personal or financial information? If so, treat it as suspicious.
• Does it contain a link when that type of text never should?

HMRC also keeps a collection called "Check a list of genuine HMRC contacts", with separate pages for emails, phone calls, letters and texts. It warns that not every HMRC communication is included, so a message that does not match is not automatically a scam, but it is a good reason to stop and check another way. The safe habit is to ignore any link in the message and sign in to your HMRC account the way you normally do.

How to report a scam

HMRC's published routes are:

• Text messages: forward to 60599 (network charges apply) or email phishing@hmrc.gov.uk, then delete the text.
• Emails, including ones with QR codes: send to phishing@hmrc.gov.uk, then delete.
• Social media accounts: do not reply. Email the account name and platform to branddefence@hmrc.gov.uk, then ignore the account.
• Phone calls: use the report suspicious HMRC contacts page on GOV.UK.

For scams that do not claim to be from HMRC, the government's general page says to forward suspicious emails to report@phishing.gov.uk, where the National Cyber Security Centre will investigate, and to forward suspicious texts to 7726, which is free and goes to your mobile provider. Scam adverts can be reported to the Advertising Standards Authority.

If you have already clicked, replied or paid

This is the part nobody wants to read, but it is the part that matters. HMRC's guidance says that if you have shared personal details, you should report the disclosure to the HMRC security team through its report a disclosure page. If you have lost money, report it through Report Fraud (the service formerly called Action Fraud) at reportfraud.police.uk, or call Police Scotland on 101 if you are in Scotland. On the general scams page, England and Wales victims are given the number 0300 123 2040. HMRC's account security page adds that if you transferred money to a third party after a scam, you should contact your bank immediately. The pages do not promise a refund or describe how recovery works, so do not assume money can be clawed back. Speed helps, so make the call to your bank first.

Protect your HMRC online account

Scam messages often aim at your sign-in details rather than your money directly. HMRC's guidance on keeping your login details safe says you must not share them with anyone, including a tax agent, and that you should use a unique password for each online service. Sign-in uses a single-use code as a second step. If you receive a code by text or voice call when you have not tried to sign in, HMRC says someone may have your details and you should change your password. You can also check your last sign-in date and time under My Details, and if the last recorded sign-in was not you, contact the online services helpdesk straight away. The page notes that the "Remember Me" option skips the extra step for 7 days, which is worth knowing on a shared office computer.

What to do this week

• Tell everyone who opens post, email or texts that HMRC will not threaten arrest, ask for vouchers or ask for personal details by text.
• Save phishing@hmrc.gov.uk and 60599 somewhere the team can find them.
• Decide who in the business checks any message that mentions a refund, a penalty or a payment, and make it normal to ask them first.
• Check your HMRC account sign-in history and make sure each person who needs access has their own login, not a shared one.
• Keep your bank's fraud line number handy for the first call if money does go.

The mood among people who follow this

Reaction to HMRC phishing is cautious rather than angry. The discussion we found on developer forums is small, and what there is leans towards concern. Searches for current commentary show the same advice repeated: do not click, check the official list, and report it.

If your business takes orders or payments online and you want your own systems to be harder to impersonate and easier to monitor, our cloud and security team can talk through what is practical for a business your size.