As a business owner or self-employed person, there’s always a sinking feeling when one of those brown HMRC envelopes falls through your letterbox. Even if you have all your tax affairs in order, there’s often a question of “what do I owe now?”. Sometimes though, if you’re lucky, it might be a HMRC tax rebate!

Unfortunately, scammers are preying on this uncertainty around HMRC and trying to scam money from people by posing as the taxman. It’s become a huge problem in recent years, with HMRC responding to over 2,000 scams referred by the general public in 2023. This was a 14% increase from the year before.

So, if you get targeted by an HMRC scam what do you do? Let’s take a look.

Common tactics to be aware of

Scammers tend to use a range of tactics, most often around key HMRC deadlines like the 31st January self-assessment deadline. In some instances they’ll say you’re owed an HMRC tax rebate and they need your bank details to transfer a payment to you. In other cases they’ll say that you owe money to HMRC and your bank details are needed to make a payment for your tax.

Usually you’ll receive one of three things:

  1. An automated phone call asking for personal information
  2. A text message asking you to click a link to make a payment
  3. An email asking you to click a link to make a payment

You should never provide personal details to someone over the phone unless you’re sure it’s legit. Clicking on a link to a bogus website can result in a virus being downloaded to your device, with the aim of stealing your bank details.

Tips for identifying fake HMRC tax rebate phishing attempts

The first thing to note is that HMRC doesn’t act in this manner. They have a very specific way of doing things.

  • If you’re owed a tax rebate from HMRC, they will contact you by letter and send you a cheque.
  • If you have underpaid on your self-assessment tax return, HMRC will send you a letter with a full account statement detailing what you paid and when, as well as how much you still owe.
  • HMRC may communicate by email or text message, but they won’t ask for sensitive financial or personal information.

Alongside this, you should:

  • Look for red flags like poor grammar, spelling mistakes or generic greetings – if the tone feels off, it probably is.
  • Check the sender’s email address or phone number for inconsistencies – likely their email will attempt to look like an official HMRC email but will be slightly different. If it doesn’t have ‘@hmrc.gsi.gov.uk’ or ‘@gov.uk’ in it, it will be fake.
  • Hover over links to reveal the actual URL before you click on anything.
  • Be sceptical of any urgent or threatening language – HMRC doesn’t behave in this way. Usually, HMRC communicates by letter and provides you with future deadlines for when you need to act.

How you can protect yourself

Now you’re aware of the fact these scams exist and you know what to look for, it’s also important to be vigilant and make sure you protect yourself in the right way. Always:

Be aware of potential scams

  • If you’re getting emails, texts or phone calls claiming to be from HMRC, know what to look out for. Whether that’s poor grammar, incorrect email addresses or an aggressive tone.

Never share personal information over the phone, via email or through text message

  • HMRC will never ask you to do this. If they legitimately need a payment from you, they’ll write to you and detail the official ways to pay. This could be via bank transfer or cheque. And if they want to give you money back through a rebate, they’ll most often write to you and send you a cheque.

Be cautious of unsolicited offers for tax rebates

  • We’d all love a tax rebate every now and again, but it doesn’t happen often out of the blue. If you’re lucky enough to get one from HMRC, they’ll write to you and likely send you a cheque.

Use secure and updated software to protect against scams

  • It makes sense to have the latest security software on your devices to protect against any potential scams.

RIFT CEO, Bradley Post adds:

While unauthorised scams remain by far the most common, the good news is that there has been a decline in losses over the last two years which suggests it’s becoming harder for fraudsters to access our hard earned money.

Of course, the flip side is that they are becoming increasingly devious in their attempts and this has seen a significant increase in losses due to authorised fraud, whereby unsuspecting victims actually provide their sensitive information to scammers. But by following so basic rules of fraud self-defence, you have a much better chance of stopping them in their tracks.

Reporting a phishing scam to HMRC

You can report a phishing scam to HMRC by:

  • Forwarding the entire text message to 60599
  • Forwarding the complete email to phishing@hmrc.gsi.gov.uk
  • Reporting a phone call through your government gateway account

This enables HMRC to track and investigate all potential scams.

Always be on the lookout. If you’re self-employed, a business owner or regularly deal with HMRC, you could be the subject of a phishing scam. It’s so important to be vigilant, know what to look for and how to act if it happens. Plus, if you think you’re potentially owed a tax rebate, it makes sense to go through the proper channels.

Get in touch with us at RIFT and we can tell you exactly how to do it.