A text or email says HMRC owes you a tax refund — click the link to claim
A text, email, or WhatsApp claiming to be from HMRC says you are owed a tax refund and asks you to click a link and enter your bank details, National Insurance number, and Government Gateway password. HMRC never texts, emails, or WhatsApps about refunds — you check your tax account at gov.uk instead.
Also known as: HMRC tax refund text scam, fake HMRC rebate email, Gov.uk phishing text, HMRC self-assessment refund scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Do not click the link. Forward the text to 60599 (HMRC's phishing text reporting number), or the email to phishing@hmrc.gov.uk, then delete it
- 2 Check whether you actually have a refund due only by logging in directly at https://www.gov.uk/personal-tax-account — type the URL yourself, never use a link from a message
- 3 If you already entered bank details or your Government Gateway password on the fake site, log into gov.uk from a clean device and change your Government Gateway password immediately, then call your bank to freeze the card
- 4 If money has already been taken, call your bank on the number printed on your card and ask for the transaction to be recalled — some faster payments can be reversed within hours
- 5 Report to Action Fraud at https://www.actionfraud.police.uk or call 0300 123 2040.
Red flags
- ⚠ HMRC never notifies you of a tax refund by text, email, WhatsApp, or phone call — they only write letters or contact you through your Government Gateway account
- ⚠ The link points to a domain that is not gov.uk (often 'hmrc-refund.co.uk', 'gov-refund-uk.com', or a shortened URL that hides the real destination)
- ⚠ You are asked for full bank card details, sort code, account number, Government Gateway password, or National Insurance number — HMRC has this information already and never asks you to confirm it
- ⚠ The message creates urgency: 'claim within 24 hours or the refund will be returned to the Treasury'
- ⚠ The sender ID says 'HMRC' but hovering over it or checking the raw sender reveals a personal mobile number or a suspicious email domain