What's going on
A text arrives claiming to be from HMRC. It says information has been received about your cryptoasset activity and a declaration is now required. There is a deadline, usually a few days away. There is a link.
The thing is, the premise sounds entirely plausible right now, and that is exactly why the timing was chosen. Since 1 January 2026, UK cryptoasset service providers have been legally required to collect information about their users and pass it to HMRC under the Cryptoasset Reporting Framework (GOV.UK). Exchanges now record your name, date of birth and home address, along with the value, type and number of units for every transaction. The first reports are due with HMRC by 31 May 2027. On top of that, HMRC has been posting nudge letters to people it suspects have under reported crypto gains, and the volume jumped from 27,700 in 2023-24 to close to 65,000 in 2024-25 (HMRC, released under Freedom of Information). Anyone holding crypto has good reason to be thinking about tax at the moment. The people sending these texts know that.
What this looked like for nine people in Kent
Kent Police issued a warning after nine people lost a combined total of more than £1 million to a crypto scam built entirely on official sounding contact. Their personal details had been exposed in a data leak. Criminals used those details to generate fake Action Fraud reports in their names, so that when the first call came, there was already a reference number to quote.
Someone claiming to be a police officer rang each victim and reassured them that an investigation had been launched into fraud against them. Helpful, calm, and on their side. The caller then told them to expect a second call from their crypto wallet host.
That second call came from a "security officer" who talked them through sharing their wallet recovery phrase. With those words, the criminals rebuilt each wallet somewhere else, moved the funds out, and put them beyond reach. Nine people. Over a million pounds. No realistic prospect of recovery.
Detective Sergeant Darryll Paulson asked Kent residents not to give away personal information over the phone to anyone claiming to be the police or a crypto host. The detail worth carrying into every message you get about your crypto is this one: at no point did those victims do anything reckless. They answered a call from someone who already knew who they were, and every step after that felt like cooperating with an investigation.
The HMRC version doing the rounds now runs on the same fuel. Officialdom, a plausible reason to be in contact, and a request that feels like compliance rather than risk. Only the badge on the front has changed.
How the scam works
This one does not try to sell you anything. It offers to help you stay on the right side of HMRC, which is a far easier thing to agree to.
1. The text lands
Short, official, and formatted to look automated. It says HMRC has received information about your cryptoasset activity and that a declaration is required. Sometimes it appears in the same message thread as genuine HMRC texts, because sender IDs like "HMRC" can be spoofed and your phone groups messages by the name shown rather than by who actually sent them.
They have no idea whether you own any crypto
These messages go out in bulk to millions of UK mobile numbers. If it reaches someone who holds nothing, it gets deleted and costs the sender nothing. If it reaches someone who does, the message feels uncannily well aimed. That flash of "how do they know?" is the whole trick, and it is coincidence at scale.
2. The fake declaration form
The link goes to a page built to look like GOV.UK, usually opening with a Government Gateway sign in screen. Crown logo, black header bar, the right typeface. Then a form asks for far more than any real tax service would: which exchanges you use, roughly how much you hold, your wallet addresses, your National Insurance number, and bank details for any refund due.
Spotting the fake address
- • The real Government Gateway sign in is at access.service.gov.uk
- • Genuine HMRC services always sit on the gov.uk domain
- • Scam sites use lookalikes such as hmrc-crypto-declaration.com, or swap the g in gov for a q
- • A padlock in the address bar only means the connection is encrypted, not that the site is real
3. What they walk away with
Two things, and the second is worse. Your Government Gateway credentials get them into your real HMRC account, where they can change the bank account on your record, read your income history and National Insurance number, and file returns in your name. The crypto details are the bigger prize though. A confirmed list of which exchanges you use and roughly what you hold turns you from a random phone number into a qualified target worth a follow up.
Never type a recovery phrase into anything
Some versions of the form ask you to verify ownership by entering your wallet's 12 or 24 word recovery phrase. That phrase is your wallet. Anyone holding it can move every coin in it within seconds, from anywhere, with nothing to reverse and no bank to ring. No tax authority, exchange or wallet provider will ever ask for it. Not once, not for any reason.
4. The phone call that follows
Days or weeks later the phone rings. The caller says they are from HMRC's cryptoasset compliance team and that your declaration has flagged a discrepancy. Because they have everything you typed into the form, they can quote your exchanges, your rough holdings and your National Insurance number straight back at you. That level of detail is what convinces people, and this is the stage where the money actually goes. It ends either with a demand for immediate payment to settle an underpayment, or with you being walked through moving your crypto to a secure HMRC wallet for safekeeping. There is no such wallet.
What these texts look like
These are examples based on messages reported across the UK. The wording shifts from batch to batch, but the shape holds. Two versions use fear and two use reassurance.
"Undeclared activity"
The most reported version. It implies HMRC already holds your exchange data and is offering one chance to put things right. Thanks to the reporting rules that began in January 2026, that premise is now genuinely true, which is what makes it land.
"HMRC: Our records show undeclared cryptoasset disposals linked to your NI number. Complete your declaration within 5 days to avoid a penalty: [link]"
"Exchange reporting"
Name drops a real exchange and the real reporting framework. It reads like routine admin rather than a threat, so people comply without the alarm bells a demand would set off.
"HMRC Notice: Your cryptoasset service provider has reported transaction data under CARF. Confirm your holdings to complete your record: [link]"
"Crypto tax refund"
The carrot instead of the stick. It claims you overpaid Capital Gains Tax on a disposal and are owed money back. People tap out of curiosity rather than fear, and the form that follows wants bank details. Who doesn't want free money?
"HMRC: You have overpaid Capital Gains Tax on cryptoasset disposals. A refund of £742.18 is available. Claim here: [link]"
"Investigation opened"
The nastiest version. It claims a compliance check is already underway. Anyone with a nagging worry that they got their crypto reporting wrong will feel their stomach drop, and that is the entire point.
"HMRC has opened a compliance check into your cryptoasset holdings. Respond within 48 hours to avoid escalation: [link]"
Why this catches people
Crypto tax is genuinely confusing, and the confusion is the foundation this scam is built on. Plenty of people holding crypto are not certain whether they have had a taxable disposal at all. Swapping one coin for another counts. So does spending crypto on something. The Capital Gains Tax annual exempt amount has fallen from £12,300 in 2022-23 to £3,000, which drags far more ordinary holders over the reporting threshold than a few years ago.
So when a message says HMRC knows about your crypto and wants a declaration, the honest reaction for a lot of us is not "that's a scam". It is "oh no, have I got this wrong?" That flicker of guilt is worth more to a fraudster than any amount of technical trickery, because somebody who thinks they might already be in trouble is far less likely to stop and check. Undeclared crypto activity feels worrying. That's the whole point.
What makes it convincing
- • Exchanges really do report user data to HMRC now, so the premise is true
- • HMRC really does contact people about crypto, tens of thousands a year
- • Most people are honestly unsure what counts as a taxable disposal
- • Sender IDs can be spoofed, so it may sit in a real HMRC message thread
- • The fake GOV.UK pages are near perfect copies on a phone screen
What should make you stop
- • The words "crypto declaration", because no such HMRC form exists
- • Any text from HMRC with a link to enter personal or payment details
- • A deadline of 48 hours, 5 days, or anything similarly tight
- • Being asked for wallet addresses or a recovery phrase
- • A web address that is not on the gov.uk domain
How to tell real from fake
HMRC does send genuine texts, and it does genuinely contact people about crypto. The difference is in what the contact asks you to do.
Genuine HMRC contact
- Crypto nudges arrive by post, not by text
- Tells you to log in at GOV.UK yourself
- Gives you weeks to respond, not hours
- Points you to Self Assessment or the CGT service
- Never asks for wallet details of any kind
Scam texts
- Reference a crypto declaration that does not exist
- Contain a link to a sign in page or a form
- Impose a deadline measured in hours or days
- Ask for exchange logins, wallet addresses or a recovery phrase
- Use a web address that is not on gov.uk
If you get one of these texts
Do not tap the link
Even if you are fairly sure you have undeclared gains. Especially then. Nothing you need to do about your crypto tax position starts with a text message, so there is no version of this where tapping the link is the right move.
Check your position at the source
Type gov.uk/personal-tax-account into your browser yourself and sign in there. If HMRC genuinely wants something, it will be in your account. If your account is quiet, the text was fake. That one step settles it every time.
Forward it to 60599, then to 7726
60599 is HMRC's number for reporting scam texts. 7726 goes to your mobile network so they can investigate the sender and block the route. Both are free on every UK network and the whole thing takes about twenty seconds.
Suspicious emails go to [email protected]. Delete the text once you have reported it.
Sort out any real tax worry separately
If the text has left you genuinely unsure whether you owe something, that is a fair question, just not one to answer through a link in a message. Ring HMRC on 0300 200 3300, read the cryptoassets manual on GOV.UK, or speak to an accountant. HMRC runs a disclosure service for unpaid crypto tax, and coming forward voluntarily is treated far more favourably than being found.
Report the number on CallerCheck
Adding the sender here means the next person who searches that number sees a warning before they tap anything. These campaigns move through numbers quickly, so early reports do the most good.
Already tapped the link?
Don't panic, but do move fast. If you entered a recovery phrase, start at step one and do not stop to read the rest first.
-
1
If you gave a recovery phrase, move your crypto now
That wallet is compromised permanently and no password change will fix it. Set up a brand new wallet with a fresh recovery phrase on a device you trust, and move everything across immediately. Minutes matter, because automated software drains exposed wallets fast.
-
2
Secure your exchange accounts
Change the password on every exchange you named, switch two step verification to an authenticator app rather than SMS, and check the withdrawal address whitelist for anything you did not add. Review recent logins and revoke any sessions you do not recognise.
-
3
Change your Government Gateway password and ring HMRC
Go to GOV.UK directly and change it, plus anywhere else you reused it. Then ring HMRC on 0300 200 3300 so they can flag your record and check whether anyone has altered your bank details or filed anything in your name.
-
4
Ring your bank if you entered card or account details
Dial 159 to be put through to your bank's fraud team, or use the number on the back of your card. Do this before anything else if money has already moved.
-
5
Report to Action Fraud, then brace yourself
Ring 0300 123 2040 or report at actionfraud.police.uk, or Police Scotland on 101 if you are in Scotland. Keep the crime reference number. Then expect a follow up, because victim details get resold and a message offering to recover your crypto is very likely to arrive within weeks. That is the same criminals coming back for a second bite.
The short version
Red flags
- • Any mention of a crypto declaration
- • A link to sign in or enter details
- • A deadline of hours or a handful of days
- • Requests for wallet addresses or a recovery phrase
- • A web address that is not gov.uk
What to do
- • Do not tap the link
- • Check gov.uk/personal-tax-account yourself
- • Forward the text to 60599 and 7726
- • Ring HMRC on 0300 200 3300 if you are worried
- • Report the sender on CallerCheck
HMRC pressure is real. The text message probably isn't.