HMRC Tax Refund Scam Warning 2026

Every year, thousands of UK taxpayers receive convincing-looking emails, texts, or phone calls claiming to be from HMRC and promising a tax refund—sometimes for hundreds of pounds. Almost all of these are scams designed to steal your money, bank details, or personal information. The good news: HMRC follows a predictable, secure process for genuine refunds, and once you know what to look for, fake messages become easy to spot. This guide explains exactly how HMRC really contacts you about refunds, the red flags that scream "scam," and what to do if you've already clicked a dodgy link or handed over details.

How HMRC Actually Issues Tax Refunds

Understanding the genuine process is your best defence. HMRC has strict protocols and will never deviate from them to "speed things up" or because of a "system update."

The Real Refund Process (2026-27)

When HMRC owes you money—usually because you've overpaid tax through PAYE, Self Assessment, or a tax code error—here's what actually happens:

Step 1: You receive a P800 letter or Simple Assessment in the post. This is a physical letter sent to your registered address. It explains why you're owed money and how much. The letter will show your Unique Taxpayer Reference (UTR) or National Insurance number, the tax year in question, and a clear breakdown of the calculation.

Step 2: The letter tells you how to claim. For amounts under £3,000, you'll typically be instructed to log in to your Government Gateway account at gov.uk (not a shortened link, not a different domain). For larger amounts or certain circumstances, HMRC may pay directly into a bank account they already hold for you, or send a cheque (payable order).

Step 3: You claim through your online account. You navigate to gov.uk yourself (by typing it into your browser), log in with your existing credentials, and follow the prompts. HMRC already has your bank details from previous tax returns or PAYE records—you don't need to provide them again in most cases.

Step 4: Payment arrives within 5 working days (for online claims) or up to 6 weeks (for cheques). That's it. No phone calls, no texts with links, no requests for card details.

When HMRC Uses Other Channels

HMRC does occasionally use email and text messages, but only in very specific, limited ways:

Appointment reminders if you've booked a call or meeting
Notifications that a message is waiting in your online account (the message itself is never in the email—you must log in separately to read it)
Generic service updates with no personal information

HMRC will never include clickable links to claim money, ask you to verify your identity via email, or request any payment details through these channels.

The Anatomy of a Tax Refund Scam

Scammers have become sophisticated. They copy HMRC branding, use official-looking language, and create urgency. In 2023 alone, HMRC removed over 33,000 scam pages from the internet—and those are just the ones they found.

Common Scam Tactics

The "You're Due a Refund" Email or Text

You receive a message—often well-designed, with the HMRC logo and correct fonts—saying you're owed £247.63 (scammers use specific amounts to seem credible). The message includes a link: "Click here to claim your refund now" or "Verify your details to release payment."

The link takes you to a fake website that looks identical to gov.uk. It asks for your National Insurance number, date of birth, bank account details, card number, and sometimes even your mother's maiden name or passwords. Every piece of information you enter goes straight to criminals.

The Threatening Phone Call

A recorded message or live caller claims to be from "HMRC investigations" or the "tax fraud department." They say you owe money, a warrant is out for your arrest, or legal action is imminent unless you pay immediately—usually via bank transfer, iTunes gift cards, or cryptocurrency.

The caller may know some of your details (purchased from data breaches) to seem legitimate. They create panic, insisting you can't hang up or consult anyone. Some scammers even spoof HMRC's real phone numbers so your caller ID shows an official-looking number.

The WhatsApp or Social Media Message

You receive a direct message on WhatsApp, Facebook, or Instagram from someone claiming to be an HMRC officer. They offer to "help you claim your refund" or "resolve a tax issue" if you provide personal details or pay an "administration fee."

HMRC does not use social media or messaging apps for individual taxpayer contact. Ever.

Red Flags That Scream "Fake"

Any link in an email or text about money. Real HMRC notifications never include clickable links to claim refunds or update details.
Requests for bank, card, or PIN details. HMRC already has your bank details if they owe you money.
Urgency or threats. "Claim within 24 hours or lose your refund," "Pay now or face arrest," "Final notice" (when you've received no previous notices).
Unusual payment methods. HMRC never asks for payment via gift cards, Bitcoin, wire transfer to a personal account, or cash.
Poor spelling or grammar. Though some scams are now well-written, many still contain errors.
Generic greetings. "Dear customer" or "Dear taxpayer" instead of your name.
Suspicious sender addresses. Look closely: "[email protected]" or "[email protected]" are fake. Real HMRC emails come from @hmrc.gov.uk or @hmrc.gsi.gov.uk.
Requests to "verify" or "update" your information. HMRC doesn't ask you to confirm details out of the blue.

Real-World Examples

Example 1: The Convincing Email

James receives an email with the subject "HMRC Tax Refund Notification – £312.45 Awaiting." The email looks perfect—correct logo, professional formatting, his name in the greeting. It says his 2025-26 tax calculation shows an overpayment and he should click the link to claim within 72 hours.

James hovers over the link (without clicking) and sees the URL is "hmrc-refund-portal.co.uk"—not gov.uk. He deletes the email and checks his actual Government Gateway account by typing gov.uk into his browser. No messages. He forwards the scam email to [email protected].

Example 2: The Panic Phone Call

Sarah's phone rings showing "0300 200 3300" (a real HMRC number—spoofed by scammers). A stern voice says she owes £4,800 in unpaid tax and must pay immediately or the police will be dispatched to arrest her. The caller insists she stay on the line and go to a shop to buy iTunes gift cards.

Sarah recognises the pressure tactic. She hangs up, waits 10 minutes (to ensure the line is clear), and calls HMRC back on the official number from gov.uk. HMRC confirms no such debt exists. She reports the scam to Action Fraud.

Example 3: The Text Message

Mohammed receives a text: "HMRC: You are eligible for a tax refund of £247.50. To claim, visit: [shortened link]." He's tempted—he did change jobs last year and might have overpaid. But he remembers HMRC sends P800 letters, not texts with links. He forwards the text to 60599 (HMRC's scam reporting number) and deletes it.

What to Do If You've Been Targeted

If You Haven't Clicked or Responded

For scam emails: Forward the entire email to [email protected], then delete it. Don't click any links, even to "unsubscribe."

For scam texts: Forward the message to 60599 (it's free). Your mobile provider and HMRC use this to track and block scam numbers.

For scam calls: Hang up. If you want to check whether HMRC really needs to speak to you, wait at least 10 minutes (to clear the line), then call HMRC on a number you find yourself on gov.uk—never use a number the caller gave you.

For social media scams: Report the account to the platform (Facebook, WhatsApp, Instagram) and block the sender. Report to Action Fraud if they've asked for money or personal details.

If You've Clicked a Link (But Entered No Details)

You're probably fine. Close the page immediately. Run a virus scan on your device as a precaution—scam sites sometimes attempt to install malware. Change your passwords for important accounts (email, banking, Government Gateway) if you're concerned.

If You've Entered Personal or Bank Details

Act immediately:

Contact your bank. Call the fraud number on the back of your card (or on your bank's official website). Explain what happened. They can monitor your account, block suspicious transactions, and potentially issue new cards or account numbers.
Report to Action Fraud. Call 0300 123 2040 or report online at actionfraud.police.uk. This is the UK's national fraud reporting centre. They'll give you a crime reference number and may investigate.
Change your passwords. Update your Government Gateway, email, and any other accounts where you used the same password. Use strong, unique passwords for each account.
Check your credit report. Sign up for a free credit monitoring service (ClearScore, Experian, etc.) to watch for fraudulent credit applications in your name.
Tell HMRC. Forward the scam email or details to [email protected] so they can track the scam and warn others.

If You've Sent Money

Follow all the steps above, but understand that recovering money sent via bank transfer, gift cards, or cryptocurrency is extremely difficult. Your bank may be able to help if you act within hours, but there's no guarantee. Action Fraud will investigate, but recovery rates are low. This is why prevention is so critical.

Common Mistakes People Make

"The email looked so real." Scammers copy official branding perfectly. Always verify through a separate channel—log in to your Government Gateway account directly, or call HMRC on a number you find yourself on gov.uk.

"They knew my name and address." Data breaches are common. Scammers buy personal details on the dark web. HMRC knowing your name doesn't prove legitimacy—the process they follow does.

"I thought I had to act fast." Urgency is a scammer's favourite tool. Real HMRC refunds don't expire in 24 hours. You have months to claim via your P800 letter.

"I didn't want to bother HMRC to check." It's not a bother—it's exactly what you should do. HMRC would rather you call to verify than fall victim to a scam.

"I assumed the phone number was real." Caller ID can be spoofed. Never trust the number displayed. Always hang up and call back on an official number.

"I thought only old people fall for scams." Scammers target everyone. Younger people are often victims of sophisticated phishing, while older people may be targeted with phone scams. No one is immune.

How to Protect Yourself Year-Round

Set up a Government Gateway account at gov.uk if you don't have one. This is where HMRC will genuinely communicate with you online.
Register for HMRC's online services. You'll receive notifications when real messages are waiting—reducing the chance you'll fall for a fake one.
Never click links in unexpected emails or texts. Always navigate to gov.uk yourself by typing it into your browser.
Enable two-factor authentication on your Government Gateway and email accounts.
Keep your address up to date with HMRC. If they can't send you a P800 letter, you might be more vulnerable to scams claiming to offer an "alternative" way to claim.
Educate family members. Share this information with older relatives or anyone less familiar with online scams.

The Legal Framework

HMRC's authority to collect tax and issue refunds comes from various Acts of Parliament, including the Taxes Management Act 1970 and the Finance Acts. These laws specify how HMRC must operate—and none of them allow for the shortcuts scammers claim ("just give us your card details and we'll process it today").

When scammers impersonate HMRC, they're committing fraud under the Fraud Act 2006, which carries a maximum sentence of 10 years in prison. Phishing and identity theft are also offences under the Computer Misuse Act 1990. Reporting scams helps law enforcement build cases against these criminals.

What to Do Next

If you've received a suspicious message: Forward it to [email protected] (emails) or 60599 (texts) right now. Don't wait.

If you're expecting a refund: Log in to your Government Gateway account at gov.uk to check. If there's nothing there, wait for a P800 letter in the post. Don't go looking for shortcuts.

If you're unsure about anything HMRC-related: Use AI Tax's chat feature at myaitax.info to ask specific questions about your situation. The AI is trained on HMRC guidance and can help you understand what's real and what's not—without the risk of clicking a dodgy link.

If you need someone to handle your tax affairs properly: AI Accountant (also at myaitax.info) offers end-to-end tax support, ensuring you claim every refund you're genuinely owed through the correct, secure channels.

The bottom line: HMRC's refund process is slow, bureaucratic, and involves letters and logging in to gov.uk yourself. If someone's offering you a faster, easier way—it's a scam. Every time.

HMRC Tax Refund Scams: How to Spot the Fakes (2026)