What's happening
Fake HMRC refund messages are one of the most reported scams in the UK. You get a text or email that says you are owed a tax refund and that you need to click a link to claim it. The message looks official. Some use the HMRC logo. Others copy the GOV.UK branding. But the link goes to a fake website that harvests your bank details and personal information.
In the year to July 2025, the public reported more than 170,000 scam referrals to HMRC (GOV.UK). Over 47,000 of those were about fake tax refund claims. Since February 2025, more than 4,800 Self Assessment scams alone were flagged. The numbers keep climbing because these messages work. People see a refund amount, click without thinking, and hand over their details.
What these messages look like
These are examples based on real scam messages reported to HMRC. The wording shifts, but the formula stays the same: a refund, a link, and a request for your bank details.
"HMRC: You are due a tax refund of £268.37. Claim your refund now at: hmrc-refund-claim.co.uk"
"HMRC Tax Notification: Our records show you have been overtaxed by £419.52. To receive your refund, visit: gov-uk-tax-return.com"
"Dear Taxpayer, After reviewing your income tax account we have determined that you are eligible to receive a refund of £347.20. Click here to submit your refund request."
"You have a pending HMRC tax rebate. Ref: TX290417. Claim before 15/04 or it will be forfeited: hmrc-rebate-uk.com"
Patterns to watch for
The refund amount is always specific, like £268.37 or £419.52, to make it feel real. The URLs look close to GOV.UK but are not official government domains. And most include a deadline to make you act fast. Real HMRC refunds do not expire if you miss a text.
How the scam works
The con is simple. It preys on the fact that most people would quite like a few hundred quid from HMRC. Here's how it plays out.
1. The message lands
You get a text or email that says HMRC has calculated your tax and you are due a refund. It might quote a specific amount. It might include a reference number. The sender name may even say "HMRC" because criminals can spoof sender IDs on text messages.
When do these peak?
January to April is the worst period. Self Assessment returns are due on 31 January, and the end of the tax year on 5 April means millions of people are thinking about tax. Scammers know this and time their messages to match.
2. You click the link
The link takes you to a website built to look like GOV.UK. It might have the crown logo, the same green buttons, and the same fonts. Some of these sites are extremely convincing. They ask for your National Insurance number, full name, date of birth, and then your bank details so they can "send the refund".
How to check the URL
HMRC's website is on gov.uk/hmrc. Anything else is fake. Watch for lookalike domains such as hmrc-gov.co.uk, govuk-tax.com, or hmrc-refund.org.uk. If the address bar does not show gov.uk, close the page.
3. You hand over your details
The site collects your bank account number, sort code, and personal information. Some versions also ask for your debit card number and security code. The criminals now have enough to clean out your account, open credit in your name, or sell your details on to other fraudsters. There is no refund. There never was.
4. The fallout
Once criminals have your bank details and personal data, the damage can go well beyond your bank balance. Identity fraud cases in the UK topped 237,000 in 2024 according to Cifas, and a large share of those started with a phishing message just like this one. Victims have reported losing thousands of pounds, having loans taken out in their name, and spending months sorting out the mess.
Why it works so well
The word "refund" makes people drop their guard. Nobody questions free money. The amounts are believable. £268 or £347 is just about right for a small tax overpayment. And because the messages arrive during tax season, people assume it must be connected to their return.
How HMRC actually sends refunds
The real process when you are owed a refund
If HMRC owes you money, they will tell you through official channels. They do not send texts or emails with links asking for your bank details. If you are due a refund, HMRC will either send it automatically using the bank details they already hold, or notify you through your Personal Tax Account on GOV.UK.
HMRC app or Personal Tax Account
Check your account at gov.uk or use the free HMRC app
Official letter by post
HMRC may write to you about a tax calculation (P800)
No bank details requested via text
HMRC already holds your bank details if they owe you money (GOV.UK)
How to tell fake from real
Signs it's a scam
- • Text or email with a link to claim a refund
- • Asks for your bank details or card number
- • Sender address is not @hmrc.gov.uk
- • URL is not on gov.uk
- • Deadline to claim ("expires in 48 hours")
- • Specific refund amount you weren't expecting
- • Generic greeting like "Dear Taxpayer"
Signs it's genuine
- ✓ Notification appears in your Personal Tax Account
- ✓ Official P800 letter arrives by post
- ✓ Refund paid automatically using bank details HMRC holds
- ✓ You can check at gov.uk/check-income-tax
- ✓ No pressure to act within hours
- ✓ HMRC texts may link to gov.uk but never ask for bank details
- ✓ You can call HMRC on 0300 200 3300 to confirm
Clicked the link or entered your details? Do this now
Ring your bank immediately
If you entered your bank details, sort code, or card number on the fake site, call your bank using the number on the back of your card. Tell them what happened and ask them to block any suspicious payments. Do this now, not later. The faster you act, the better your chance of stopping the money leaving your account.
Change your passwords
If you entered your Government Gateway login or any password on the fake site, change it straight away. Go to gov.uk and sign in to your account directly. If you use the same password on other sites, change those too.
Check your credit report
If you gave your National Insurance number, name, and date of birth, criminals could use that to apply for credit in your name. Check your credit report with Experian, Equifax, or TransUnion. You can do this for free. Look for any accounts or applications you don't recognise.
Report the scam
Forward scam texts to 60599. Forward scam emails to [email protected]. If you've lost money, report it to Report Fraud at reporting.actionfraud.police.uk or call 0300 123 2040.
Where to report HMRC scams
Suspicious Texts
Forward HMRC scam texts to this number. Delete the message after forwarding.
Suspicious Emails
Forward the full email to HMRC's phishing team
Then delete the emailReport Fraud
If you've lost money or given out personal details
HMRC Phone Line
Call HMRC directly to check if a message is real
Frequently Asked Questions
Does HMRC ever text people?
How do I check if I'm actually owed a refund?
Can HMRC refund scams lead to identity theft?
What does a real P800 tax calculation look like?
Golden Rules for Spotting Fake HMRC Refund Messages
- HMRC will not text or email you asking for bank details
- Check your Personal Tax Account at gov.uk to confirm
- Do not click links in unexpected tax messages
- Real refunds are paid using bank details HMRC already holds
- Forward scam texts to 60599
- Forward scam emails to [email protected]
- Ring your bank straight away if you gave out card details
- Tell friends and family, especially during tax season