Scam library · United Kingdom · Updated 20 October 2026
HMRC tax refund scams: what they say, how to spot it, what to do
A message promising money back can make a link feel useful. Check the tax account you normally use before entering any personal or payment details.
What they say
Illustrative examples, written in our own words:
- A tax repayment is waiting, but you must claim it before the end of today.
- The sender says your tax record needs a card check before the refund can arrive.
- A caller offers to process the repayment if you read out a security code.
- An email asks you to sign in through its link to avoid losing the refund.
How to spot it
- A refund is being used to hurry you towards a link, attachment or unexpected call.
- The request moves from a tax question to card details, passwords or a one-time code.
- A convincing logo and a sender name are being offered as proof of who sent it.
What to do now
- Leave the message alone and open GOV.UK yourself. Use your usual HMRC account or a contact route found there.
- Compare the claim with your tax records. Ask HMRC through that independent route if you are unsure.
- Do not let an unexpected caller walk you through a payment or a screen-sharing session.
If you already paid or shared details
Call your bank immediately on the number on your card, using a trusted device. After hanging up, 159 can connect you to participating UK banks; coverage and call charges depend on your provider. Explain what you sent or shared and ask about stopping payments and securing the account.
If you entered your tax-account password, change it through the genuine service and change any other account using the same password. Tell HMRC through its official contact route if someone may be using your identity.
Under Payment Systems Regulator rules, UK banks and payment firms must refund most eligible authorised push payment (APP) scam losses from UK Faster Payments transfers made on or after 7 October 2024, up to £85,000 per claim. This means you were tricked into authorising a transfer. Eligibility and exceptions apply. Cards, cash, international transfers and crypto payments are not automatically covered by this rule. Report promptly and ask the bank to explain its assessment, any excess and the relevant deadlines.
Keep messages and payment references. In England, Wales and Northern Ireland, report to Report Fraud (formerly Action Fraud). In Scotland, report to Police Scotland on 101. If someone is in immediate danger, call 999.
Forward suspicious SMS texts to 7726 and emails to report@phishing.gov.uk, following GOV.UK reporting guidance. For message apps, use the app’s report and block tools. Reporting a message does not replace contacting your bank about a payment.
Questions people ask
How should I check an HMRC refund message?
Open GOV.UK independently and check your usual HMRC account or contact HMRC through details found there. Do not sign in through the message.
Does an HMRC logo prove an email is genuine?
No. Check the claim through your own tax account before sharing details or acting on a link.