Self-assessment creates a predictable window every year in which millions of people are genuinely thinking about tax, genuinely expecting correspondence, and genuinely unsure whether they owe anything. Criminals send their volume into that window, because a message about tax lands very differently in January than it does in June. The scripts barely change from year to year. There are two of them, they pull in opposite directions, and between them they cover almost everyone.
The two scripts
The first is the refund. A text or email says you are owed a rebate, often a modest and believable sum rather than a fortune, and invites you to claim it through a link. The page that follows looks like a government service and asks for your name, address, date of birth, National Insurance number and, at the end, your card or bank details so the money can be paid in. No money is ever paid. What has been collected is a complete identity package, which is worth more than the imaginary rebate and is used to open credit, take over accounts, or make the next impersonation call far more convincing.
The second is the penalty. A recorded or live call, or a text, says you owe tax, that a warrant or arrest is being arranged, that bailiffs are on their way, or that legal action starts today. It demands immediate payment, and the payment method is always unusual: a bank transfer to an account read out over the phone, a cryptocurrency transfer, or vouchers bought from a shop. The tone is aggressive where the refund version is helpful, but the structure is identical — urgency, isolation, and an irreversible payment.
How HMRC actually behaves
- HMRC does not tell you about a tax refund by text message or email, and does not ask you to claim one through a link. Refunds appear in your online tax account or arrive through the post.
- HMRC does not threaten arrest over the phone, does not ask for payment in vouchers or cryptocurrency, and does not demand that a debt be settled within the hour. Nor does it ask for your card details, your full bank details or your passwords by phone, text or email.
- HMRC does contact people by phone, letter and sometimes text about genuine matters, which is exactly why a blanket rule is not enough. The test is not whether contact happened but what it asks you to do.
Checking a message safely
- Do not use anything in the message itself. No link, no phone number, no email address, no QR code. This single habit defeats the entire category, because every version of the scam depends on you travelling by a route the sender controls.
- Go to gov.uk directly by typing it yourself, sign in to your tax account, and look at what it says. If there is a genuine refund, a genuine penalty or a genuine request, it will be there. If the account shows nothing, the message was not from HMRC.
- Check the message against HMRC’s published examples. HMRC maintains a page on gov.uk listing the genuine contact it is currently making and examples of scams in circulation, which is the fastest way to identify a message that thousands of other people have already received. If you want to speak to someone, find the number on gov.uk rather than in the message, and ring from a different phone if the suspicious call has only just ended.
If you are using an accountant
Agents complicate this, because a genuine message may reasonably arrive from someone you do not deal with directly. The rule stays the same: verify through a channel you chose. Ring your accountant on the number you have always used, not one supplied in an email, and be particularly careful in the days around a filing deadline, when a message claiming your return has been rejected or your payment has failed is both plausible and easy to manufacture. Payment details sent by email are worth a phone call every single time.
What to do now
If a message is still sitting on your phone, do not reply to it or click anything. Forward the text to 7726, which is free on UK networks, and report the suspicious email or text using the reporting routes HMRC publishes on gov.uk. Then look up the number on cislo.info and add a short note on the wording used, because the same script comes back on a new number within days and the description is what makes it recognisable. If you already entered details, change the passwords on your email and your government account immediately, turn on two-step verification, and watch your credit file for applications you did not make. If you paid money, ring your bank straight away on the number from the back of your card, say plainly that you think you have been scammed, and report it to Action Fraud, or Police Scotland on 101 in Scotland. And if you are the person in your family who understands tax, forward this to the ones who do not — the penalty script works best on people who are not sure whether they were supposed to file at all.