A text promising a tax refund if you "confirm your details", an email warning of an unpaid bill with a threatening deadline, a message from your bank asking you to verify a payment through a link. These are the everyday baits of a fraud wave that keeps growing, and it leans on the tax calendar to feel plausible. In the 12 months to 31 July 2025, worried taxpayers sent HMRC more than 170,000 scam referrals, and over 47,000 of them involved bogus tax refund claims.
Why fake messages look so convincing now
The old giveaways are disappearing. Fraudsters increasingly draft messages with clean spelling, an official tone and details that make them feel personal, so a quick glance is no longer enough to tell real from fake. Impersonation of HMRC has become one of the most common ways criminals try to steal personal and payment information, and they rotate their pretexts to match the calendar.
The scale is significant. HMRC identified almost 1,300 suspected cases of its brand being misused in the 2025/26 financial year, and one phishing campaign in 2025 hit roughly 100,000 taxpayer accounts and was linked to around £47 million in losses. Activity typically spikes around the Self Assessment deadline of 31 January, when a refund or penalty message feels believable to millions of people at once.
The same tactics land by text. Smishing has grown fast because a message arrives straight on your phone and feels more personal than an email, and a short link is easy to tap before you have thought it through.
HMRC and your bank will never ask for details by text
This is the rule that defuses most scams. HMRC will never tell you about a tax rebate or penalty, or ask for personal or payment information, by text message or email, and any genuine email will only ever come from an address ending in hmrc.gov.uk. A message that pushes you to click a link and enter card numbers, passwords or one-time codes is fake, however authentic it looks.
The same applies to your bank. No legitimate bank asks you to move money to a "safe account", read out a security code or log in through a link sent by text or email. If a message creates panic and demands you act within minutes, treat that pressure itself as the warning sign.
The signs that give phishing and smishing away
Checking the sender is no longer reliable, because numbers and addresses are easily spoofed. Focus on the content instead, and be wary of a handful of recurring signals.
- Urgency and threat: a 24 or 48 hour countdown, an imminent deadline, or the promise of a fine if you fail to act now.
- A request for money or data: card number, sort code, security codes or login details to "confirm" a refund.
- A link in the text: the address does not lead to gov.uk and often hides a look-alike domain that is close but not identical.
- An unexpected refund: a tidy, tempting sum for a repayment you never claimed.
A good habit is to ask three questions of every message: does it impose a deadline or a fine? Does it want money, bank details or codes? Does it push you to tap a link? A single yes is enough to treat it as suspicious and to stop before doing anything.
Good to know: HMRC never announces a tax rebate by text or email. Genuine repayments appear in your Personal Tax Account on GOV.UK or are paid automatically, never through a link you are asked to tap.
Official versus fake: how to tell them apart
Setting what HMRC or your bank actually does next to what a fraudster does makes the decision quick, even when the message looks polished.
How to check and how to report
Verify through official routes only. Log in to your account by typing the GOV.UK address yourself rather than following a link, and if the message claims to be from your bank, call the number on the back of your card or use the official app. You can also dial 159 to reach your bank securely when a call or text about your money feels wrong.
- Do not click or reply: leave links and attachments alone and never enter your details.
- Forward suspicious emails to HMRC at [email protected].
- Forward scam text messages to 60599 for HMRC, or to 7726 to alert your mobile network to a scam posing as your bank or another company.
- Report calls and lost money through the suspicious phone call form on GOV.UK, and report fraud where you have lost money to Action Fraud at actionfraud.police.uk.
What to do and what to avoid
- Type the GOV.UK address yourself whenever you want to check your tax position.
- Dial 159 to reach your bank when a message about your money feels wrong.
- Freeze the card and tell your bank at once if you have already entered any details.
- Do not trust the sender: numbers and addresses are spoofed in seconds.
- Never enter a one-time passcode on a page opened from a link you were sent.
- Do not let anyone rush you: no genuine body demands that you act within minutes.
If you have already shared your details
Speed matters most. Contact your bank immediately and freeze the affected card so any fraudulent payments can be stopped and a refund started, then change the passwords on any exposed accounts, beginning with your online banking and your Government Gateway login. Report the loss to Action Fraud to help build the wider picture.
Knowing how your provider really communicates also helps. Understanding how current accounts work makes it easier to tell a genuine message from an imitation, while a look at the UK banks behind them shows what official offers actually look like.