What's going on
You get a text that looks like it came from HMRC. It says your Self Assessment tax return hasn't been filed, or that you owe a penalty, or that you're due a refund. There's a link to sort it out.
The link takes you to a website that looks almost identical to the Government Gateway login page. It asks for your user ID and password. Once the criminals have those, they can access your real HMRC account, see your tax records, change your bank details, and file fake returns to steal refunds. HMRC received 4,800 reports of Self Assessment scams alone since February 2025, part of a total 135,500 scam reports in just ten months (GOV.UK). They also received 29,000 fake tax refund claims in the same period and shut down 25,000 fake websites and phone numbers used by fraudsters.
How the scam works
It's a well rehearsed routine. The text is just the way in. The real damage happens once they have your Government Gateway credentials.
1. The text arrives
These texts land heaviest around January and July, timed to match the Self Assessment filing deadline on 31 January and the payment on account dates. They say your return is overdue, a penalty has been applied, or you're due a refund. There's always a link. The criminals blast these out to millions of numbers knowing that 11.5 million people in the UK file Self Assessment each year (GOV.UK). The odds of hitting someone who actually has a tax return due are pretty decent.
Why Self Assessment is such a target
Most people who file Self Assessment are self employed, freelancers, or landlords. They're used to dealing with HMRC online and they know penalties are real. A text about a late return or a missed payment doesn't seem far fetched. That familiarity is exactly what the scammers count on.
2. The fake website
The link goes to a page that looks exactly like the Government Gateway sign in screen. Same layout, same colours, same crown logo. On a phone, you'd struggle to tell the difference. But the URL gives it away if you look closely. Scammers register domains like "government-gateway.qov.com" where they swap the letter 'g' in gov for the letter 'q'. On a small screen, that's almost invisible.
Spotting the fake URL
- • The real Government Gateway is at access.service.gov.uk
- • Scam sites use domains with "qov" instead of "gov" or add extra words
- • Some use completely unrelated domains with an HMRC page bolted on
- • An HTTPS padlock does not mean the site is genuine
3. They steal your credentials
Once they have your Government Gateway user ID and password, they're inside your actual HMRC account. They can see your tax records, your National Insurance number, your employment history, your bank details. From there, they change the bank account linked to your Self Assessment so any refund gets paid to them. Some gangs file fake tax returns in your name to generate refunds that never existed.
It goes beyond tax
Your Government Gateway account is connected to a lot more than just Self Assessment. It links to your personal tax account, PAYE records, and National Insurance contributions. With that information, criminals can open credit accounts in your name, apply for loans, or commit other forms of identity fraud. HMRC reported 29,000 fake refund claims in just ten months (GOV.UK).
4. The follow up
Sometimes it doesn't stop at the text. A few days later, you might get a phone call from someone claiming to be from HMRC. They say there's a problem with your Self Assessment, maybe a discrepancy or an investigation. They already know enough about your tax affairs from your hacked account to sound convincing. The goal is to get you to make a payment over the phone or hand over your bank details. Others skip the call and just use the stolen information for identity fraud, opening accounts and taking out credit in your name.
What these texts look like
The wording changes but the formula stays the same: a tax problem, a sense of urgency, and a link. Here are the most commonly reported versions.
"Overdue return"
The classic. Tells you your return is late and a penalty has been applied. This one works because plenty of people genuinely do file late and know that penalties are a real thing.
"Your Self Assessment return has not been received. A penalty has been applied. Complete your filing here: [link]"
"Tax refund"
The carrot instead of the stick. Who doesn't want free money? This one promises a refund for overpaid tax. People click because they're curious, not scared. HMRC flagged 29,000 fake refund claims in ten months (GOV.UK).
"HMRC: You are due a refund of £268.40 for overpayment of tax. Claim your refund: [link]"
"Gateway verification"
This one plays on security fears. It says your Government Gateway account has been locked or flagged for unusual activity. You need to verify your identity. People click because they're worried someone else has got into their account. Ironic, really.
"Your Government Gateway account has been locked due to unusual activity. Verify your identity: [link]"
"Payment reminder"
This one quotes a specific amount to make it feel real. The number is always plausible but not round, something like £1,243.00 rather than £1,000. That detail makes people think it must be genuine because a scammer wouldn't know the exact amount. Except they don't. They just picked a number.
"HMRC: Your Self Assessment payment of £1,243.00 is overdue. Pay now to avoid further penalties: [link]"
Why this catches people
Self Assessment brings out the stress in everyone. Nobody enjoys dealing with their tax return, and most people have a nagging worry that they've done something wrong or missed a deadline. When a text lands saying there's a problem, your gut reaction is to fix it straight away.
The timing is clever too. These texts peak around the 31 January deadline and the start of the new tax year in April. That's when people are already thinking about their returns and when the message feels most believable. If you filed late last year and got a real penalty, a text about it this year won't raise any alarm bells.
What makes it convincing
- • 11.5 million people file Self Assessment, so it's a huge pool of potential victims
- • Most people genuinely worry about getting their tax wrong
- • HMRC does send real texts, so the format feels normal
- • Penalties for late filing are a real thing, which makes the threat believable
- • The fake Government Gateway pages are very convincing copies
What should make you stop
- • Any text from HMRC that contains a link
- • Being asked to enter your Government Gateway details via a text link
- • Requests for bank details or card numbers
- • Urgency and threats about penalties or legal action
- • A URL that isn't on the gov.uk domain
How to tell real from fake
HMRC does send text messages sometimes. But there are clear differences between a genuine HMRC text and a scam. Here's what to look for.
Real HMRC texts
- Tell you to log in at GOV.UK yourself, no link provided
- Never contain payment links
- Reference your UTR number if related to Self Assessment
- Come from the sender ID "HMRC"
- Never ask for personal or financial information
Scam texts
- Contain a clickable link to a website
- Ask for bank or card details
- Use urgency and threats about penalties or prosecution
- Don't reference your UTR or any specific details
- Use a URL that isn't on the gov.uk domain
If you get a suspicious text
Do not click the link
Even if you think you might owe tax. Even if you're late filing. Do not click the link. If there's a real problem with your Self Assessment, it will show up when you log in to your HMRC account yourself.
Check your HMRC account yourself
Go to gov.uk/personal-tax-account by typing it into your browser. Log in to your Government Gateway account from there. If you owe money or need to file, it will say so. If it doesn't, the text was fake.
Forward the text to 60599
This is HMRC's dedicated number for reporting scam texts. Forwarding the message helps them track and shut down the scammers. You can also forward suspicious emails to [email protected].
Forwarding to 60599 is free. You can also report scam texts to your mobile network by forwarding to 7726.
Block the number
Block the sender on your phone. It won't stop every scam text since they come from different numbers, but it stops that one from bothering you again.
Delete the text
Once you've forwarded and reported it, get rid of it. You don't want to accidentally tap that link later or have someone else with access to your phone click it.
Already entered your details?
Don't panic, but do act fast. The quicker you move, the less damage they can do.
-
1
Change your Government Gateway password now
Go to the real Government Gateway at gov.uk and change your password immediately. If you use the same password anywhere else, change it there too. The criminals may already be in your account, so speed matters.
-
2
Call HMRC on 0300 200 3300
Tell them what happened. They can put a note on your account, check whether anyone has changed your bank details or filed a return in your name, and take steps to protect your records.
-
3
Contact your bank if you gave card details
If you entered any bank or card information on the fake site, call your bank straight away. Use the number on the back of your card or dial 159 to be connected to your bank's fraud team. They can freeze your card before it gets used.
-
4
Report to Action Fraud
Call 0300 123 2040 or report online at actionfraud.police.uk. If you're in Scotland, report to Police Scotland on 101. Get a crime reference number because you may need it later if you need to claim money back.
The short version
Red flags
- • Any text from HMRC containing a link
- • Being asked for your Government Gateway login via text
- • Threats about penalties or prosecution
- • Promises of a tax refund you didn't expect
- • A URL with "qov" instead of "gov"
What to do
- • Do not click the link
- • Check your account at gov.uk/personal-tax-account
- • Forward the text to 60599
- • Call HMRC yourself on 0300 200 3300 if worried
- • Dial 159 if you've given out bank details