How to Spot HMRC Scam Emails and Texts: 2026

The Growing Threat of HMRC Impersonation Scams

HMRC impersonation scams are at an all-time high. In the 2024-25 financial year, HMRC reported receiving over 130,000 referrals of suspicious contact from the public — a figure that has increased year on year. With Making Tax Digital now requiring quarterly submissions, scammers have even more hooks to exploit: fake MTD registration emails, fraudulent quarterly reminder texts, and phishing links disguised as HMRC login pages.

As someone who helps sole traders manage their finances every day, I see the impact these scams have on people's trust and wellbeing. A convincing fake email can cause panic, especially during self-assessment season when tensions are already high. The good news is that once you know what to look for, these scams become much easier to identify and ignore.

This guide covers the most common HMRC scam tactics in 2026 and gives you practical tools to protect yourself.

How to Identify Fake HMRC Emails

HMRC does send legitimate emails, but they are very limited in what they contain. Understanding this distinction is your first line of defence.

Legitimate HMRC emails will never:

• Ask you to click a link to enter your personal details
• Ask for your password or login credentials
• Ask for your bank account details or card numbers
• Include attachments (with very rare exceptions for secure correspondence through your Government Gateway account)
• Threaten immediate legal action or arrest

Legitimate HMRC emails will typically:

• Address you by name (not "Dear Taxpayer" or "Dear Customer")
• Reference your UTR number or National Insurance number (partially masked)
• Direct you to log in to your Government Gateway account to view messages
• Come from a gov.uk email address (though this can be spoofed)

The most common scam email types in 2026 include:

Fake tax refund notifications. These emails claim you're owed a refund and ask you to click a link to "claim" it. HMRC will never email you about a refund — refunds are processed through your self-assessment account or by cheque. If you receive an email promising a refund, it is a scam without exception.

MTD registration alerts. Since Making Tax Digital became mandatory for income tax self-assessment in April 2026, scammers have created convincing emails claiming you need to "verify your MTD registration" by entering your details on a fake website. HMRC communicates MTD information through your Government Gateway account, not via email links.

Payment demand emails. These claim you have an outstanding tax bill and threaten penalties or legal action if you don't pay immediately via a provided link. Real HMRC payment requests come through your self-assessment account and official correspondence.

According to the National Cyber Security Centre (NCSC), phishing emails remain the single most common cyber attack vector in the UK, and tax authority impersonation is among the most prevalent forms.

How to Identify Fake HMRC Text Messages (Smishing)

Text message scams — known as smishing — have become increasingly sophisticated. They often appear to come from "HMRC" or "GOV.UK" and can even appear in the same message thread as legitimate texts if your phone groups messages by sender name.

Common smishing tactics include:

Fake refund texts: "HMRC: You are eligible for a tax refund of £468.50. Claim now at [link]." These are always fraudulent. HMRC will never text you a refund link.

Penalty warning texts: "HMRC URGENT: Your self-assessment is overdue. Pay now to avoid further penalties: [link]." Real penalty notices come by post or through your Government Gateway account.

Verification texts: "Your HMRC account has been locked. Verify your identity at [link] to restore access." HMRC will never ask you to verify your identity via a text message link.

To protect yourself from smishing:

• Never click links in text messages claiming to be from HMRC
• If you're concerned about your tax account, go directly to gov.uk by typing the address into your browser
• Forward suspicious texts to 7726 (which spells SPAM on your keypad) — this reports them to your mobile provider
• Report the scam to HMRC by forwarding the text to 60599

How to Identify Fake HMRC Phone Calls

Phone scams (vishing) are perhaps the most distressing because they involve direct human interaction and high-pressure tactics. Scammers call claiming to be from HMRC and use a variety of approaches:

The arrest threat: The caller claims there's a warrant for your arrest due to unpaid taxes and demands immediate payment via bank transfer or gift cards. HMRC will never threaten arrest over the phone and will never ask for payment via gift cards.

The automated voicemail: An automated message claims to be from HMRC and asks you to "press 1" to speak to an agent about your tax account. These are always scams.

The friendly helper: A caller claims they've noticed an error on your tax return and needs to "verify" your details to process a correction. They ask for your National Insurance number, UTR number, and bank details. HMRC already has these details and would never ask you to provide them over the phone.

Key facts about legitimate HMRC phone contact:

• HMRC may genuinely call you, but they will never demand immediate payment
• HMRC will never ask you to pay by gift card, cryptocurrency, or wire transfer
• If you're unsure whether a call is genuine, hang up and call HMRC directly on 0300 200 3310
• Wait at least 5 minutes before calling back, or use a different phone, as some scam technology keeps the line open

For more guidance on protecting your finances, read our comprehensive post on protecting your business from financial fraud.

The Self-Assessment Season Surge

Scam activity peaks around key tax dates: the 31 January self-assessment deadline, the 31 July payments on account deadline, and — since 2026 — the quarterly MTD submission deadlines. Scammers time their campaigns to coincide with these dates because they know taxpayers are anxious about deadlines and more likely to act impulsively.

During January 2026, I noticed a significant increase in users forwarding me suspicious messages asking "Is this real?" The messages were sophisticated — correct HMRC branding, plausible reference numbers, and links to convincing-looking websites. But they all shared common red flags: urgency language, direct payment links, and requests for personal information.

If you receive any communication claiming to be from HMRC and you're unsure, you can always check with me. Send me a screenshot on WhatsApp and I'll help you determine whether it's genuine. You can also check our guide to filing your self-assessment for information about legitimate HMRC communications.

What to Do If You've Already Fallen Victim

If you've clicked a link in a scam email or text, provided personal information over the phone, or made a payment to scammers, take these steps immediately:

1. Contact your bank. If you've made a payment or shared bank details, call your bank's fraud department immediately. Most banks are available 24/7 for fraud reports. The sooner you act, the more likely they can recover or freeze the funds.

2. Change your passwords. If you've entered login credentials on a phishing site, change your Government Gateway password and the password for any other account that uses the same credentials. Enable two-factor authentication where available.

3. Report to HMRC. Forward phishing emails to phishing@hmrc.gov.uk. Forward suspicious texts to 60599. Report phone scams by calling HMRC on 0300 200 3310.

4. Report to Action Fraud. File a report at Action Fraud (actionfraud.police.uk) or call 0300 123 2040. Action Fraud is the UK's national reporting centre for fraud and cyber crime.

5. Check your credit file. If you've shared personal information such as your National Insurance number, date of birth, or address, check your credit file for any unauthorised activity. You can use free services from the three main credit reference agencies.

6. Monitor your tax account. Log in to your Government Gateway account regularly over the following months to check for any unauthorised changes or filings.

Protecting Yourself Going Forward

Prevention is always better than cure. Here are practical steps to protect yourself from HMRC scams in 2026 and beyond:

Bookmark the real HMRC website. Rather than clicking links in emails, always navigate to gov.uk directly. Save your Government Gateway login page as a bookmark.

Use strong, unique passwords. Your Government Gateway password should be unique — not used for any other service. Use a password manager to generate and store complex passwords.

Enable two-factor authentication. HMRC's Government Gateway supports two-factor authentication. Enable it. This means that even if a scammer obtains your password, they cannot access your account without the second factor.

Be sceptical of urgency. Legitimate organisations rarely create artificial urgency. If a message demands immediate action and threatens dire consequences, treat it with extreme suspicion.

Keep your contact details current with HMRC. Ensure HMRC has your correct address and phone number so legitimate correspondence reaches you. This reduces the risk of being caught off guard by a scam when you haven't received genuine HMRC communications.

Use Penny. By letting me handle your tax submissions and deadline management, you always know your actual tax position. This means when a scam email claims you owe £3,000, you know immediately that it's false because you've seen your real figures in your weekly summary.

For broader guidance on keeping your business safe from fraud, explore our posts on invoice fraud and protecting your business bank account. And if you'd like to see how Accounted helps you stay on top of your tax obligations legitimately, visit our pricing page to find the plan that suits your business.

Stay vigilant, stay sceptical, and never let urgency override your judgement. If something doesn't feel right, it probably isn't.

Useful Resources

• HMRC Self Assessment guidance
• HMRC's guidance on self-employed expenses

Accounted makes bookkeeping simple — Penny categorises your transactions automatically so you don't have to. See how →