Fraudulent phishing emails claiming to be issued by HMRC and demanding payment or notifying you of a refund, have been in existence for some years. They are still as, if not more, popular with scammers.
In the UK, the deadline for self-assessment tax returns every year is January 31st and the deadlines for the dates for payments on account are January 31st and July 31st. The deadline for renewal of Tax Credits is also normally 31st July. Various other dates apply to other forms of taxation and reliefs.
Such fraudulent emails can be received at any time of the year, but it is during the periods leading up to these dates that they become more prevalent as many people are thinking about their tax affairs.
Typically – during the tax credit renewal period – thousands of phishing emails are reported to HMRC and hundreds of hoax websites closed down, figures that increase year-on-year.
The risks
Get started ...
- Remember that HMRC or other government organisations will never inform you about a tax rebate or penalty – or request personal payment information details – by email, text or social networking post..
- Do not click on links or open attachments unless you are absolutely certain that they are from an authentic source.
- If you are a taxpayer or have other business with HMRC, you may receive a phishing email requesting confidential information which would grant criminals access to your bank or payment card accounts
- Alternatively, the email may include an attachment disguised as a genuine document, but which actually introduces a virus which can be used to defraud you, steal your identity, spy on you or hold you to financial ransom.
Another risk is that of being coaxed into using an unofficial service instead of the HMRC website, of the type which normally charge elevated and often exorbitant fees for services provided free or at a lower cost by the government. These are generally known as copycat websites.
Protecting yourself
- Remember that HMRC or other government organisations will never inform you about a tax rebate or penalty – or request personal payment information details – by email, text or social networking post.
- Beware of emails which:
- Have a sender’s email address which is different from the HMRC or other trusted organisation’s website address.
- Are sent from a completely different address or a free webmail address.
- Do not use your proper name, but a non-specific greeting such as “Dear customer”, “Dear Taxpayer” or no greeting at all.
- Incorporate a sense of urgency; for example the threat that unless you act immediately your account may be closed or you may miss a payment or refund claim deadline.
- Request personal information such as username, password or bank details.
- Be cautious with emails that contain attachments. If in any doubt, do not click on the attachment and delete the email, do not respond and do not forward it unless to report it to the authentic organisation.
- Be on the lookout for copycat websites, which may well charge a high fee for a service which would be free, or at lower cost, from the official government site. These sites will cost you unnecessary money and possibly not even deliver any service at all, despite being featured prominently on Google and other search engines.
What to do if you receive suspicious emails claiming to be from HMRC
Forward them to phishing@hmrc.gsi.gov.uk or check HMRC’s guidance on recognising scams
If you think you have been a victim of fraud
Report it to Action Fraud, the UK’s national fraud reporting centre by calling 0300 123 20 40 or by visiting www.actionfraud.police.uk