How to check for scams
The following guidance has been laid out by HMRC.
GOV.UK Coronavirus Alert – SMS campaign
You may receive an SMS entitled ‘GOV.UK CORONAVIRUS ALERT’ stating ‘New rules in force now: you must stay at home. More info & exemptions at gov.uk/coronavirus Stay at home. Protect the NHS. Save lives’. The SMS will be sent from UK_Gov.
These messages do not ask you to reply or give out any personal or financial information. The link within the SMS will only direct you to the GOV.UK website giving advice on what you need to do during the coronavirus outbreak.
How to tell if an email is fraudulent
As well as spelling mistakes and poor grammar, there are a number of things you can look out for to help you recognise a phishing or bogus email.
Incorrect ‘from’ address
Look out for a sender’s email address that is similar to, but not the same as, HMRC’s email addresses. Fraudsters often have email accounts with HMRC or revenue names in them (such as ‘refunds@hmrc.org.uk’). These email addresses are used to mislead you.
However be aware, fraudsters can falsify (spoof) the ‘from’ address to look like a legitimate HMRC address.
If you are not 100% sure that the message has come from HMRC, do not open it. If you do open the email and you are in doubt, do not click on any links or downloads.
Personal information
Emails from HMRC will never:
-
notify you of a tax rebate
-
offer you a repayment
-
ask you to disclose personal information such as your full address, postcode, Unique Taxpayer Reference or details of your bank account
-
give a non HMRC personal email address to send a response to
-
ask for financial information such as specific figures or tax computations, unless you’ve given us prior consent and you’ve formally accepted the risks
-
have attachments, unless you’ve given prior consent and you’ve formally accepted the risks
Urgent action required
Fraudsters ask for immediate action. Be wary of emails containing phrases like ‘you only have 3 days to reply’ or ‘urgent action required’.
Bogus websites
Fraudsters often include links to webpages that look like the homepage of the HMRC website. This is to trick you into disclosing personal or confidential information. Just because the page may look genuine, does not mean it is.
Bogus webpages often contain links to banks or building societies, or display fields and boxes requesting your personal information such as passwords, credit card or bank account details.
You should be aware that fraudsters sometimes include genuine links to HMRC webpages in their emails, this is to try and make their emails appear genuine.
Common greeting
Fraudsters often send high volumes of phishing emails in one go, so even though they may have your email address, they seldom have your name. Emails from HMRC will:
-
usually use the preferred name you’ve provided, where you’ve signed-up to HMRC subscription services for example
-
always include information on how to report phishing emails to HMRC
Attachments
Be cautious of attachments as these could contain viruses designed to steal your personal information.
HMRC SMS text messages
SMS text message or voice call – activating multi-factor authentication and logging into your HMRC tax account
Multi-factor authentication is an extra security feature for customers which replaces 2-step verification. It helps prevent someone else from accessing a customer’s digital account, even if they know the user ID and password. HMRC will send an access code by SMS or voice call to the customer’s chosen mobile phone or landline number to activate the multi-factor authorisation. The customer will need this code to complete the access.
These SMS messages and voice calls will never ask the customer to provide personal or financial information.
Customers who have activated multi-factor authentication will only be able to access the account using:
-
the Government Gateway user ID and password
-
the mobile or landline device which they have registered
SMS text messages: Self Assessment, VAT, PAYE and Corporation Tax customers
HMRC may contact customers who have debts or outstanding returns to:
-
request payment
-
request overdue returns
-
update their personal or business address
HMRC may also remind them of payment or return submission deadlines becoming due.
The messages will either direct them to the GOV.UK website or ask them to contact HMRC by phone to make payment or update their addresses. The messages will not include or request any personal or financial information.
Confirmation and update texts
HMRC may contact you by text to confirm the receipt of:
-
a claim
-
a form
-
other correspondence
The current confirmation SMS messages being issued are:
-
Child Benefit – education changes
-
PAYE or Self Assessment complaints
-
VAT DIY House building
National Minimum Wage - SMS campaigns
HMRC advises customers by text message who claim Working Tax Credits when their entitlement to National Minimum Wage has gone up following:
-
a recent 18th, 21st or 25th birthday - messages are issued on a monthly basis
-
the annual rate increase on 1 April
HMRC also contacts apprentices by SMS text message after the annual rate increase on 1 April. The SMS texts are issued from June, on an annual basis.
These messages do not request any personal or financial information.
Tax credit - SMS campaign
HMRC may contact you via SMS to confirm receipt of your 2020 tax credit renewal. You may also receive an SMS message to:
-
remind and advise you on the completion of your renewal claim
-
provide completion guidance for the renewal claim for those in receipt of Statutory Maternity Pay income during 2019 to 2020
-
invite you to a telephone interview
-
request that you contact us by phone or webchat to discuss the letter we sent you regarding your 2019 to 2020 household income
These messages do not request personal or financial information. The messages will not include any hyperlinks.
Tax-free Childcare and 30 hours free childcare SMS messages
HMRC will contact parents by text message if they have not reconfirmed their eligibility.
