With the 2025-26 UK tax year now closed, fraudsters are sending a surge of fake “HMRC refund” texts, emails, and calls. HMRC’s SMS-contact policy also changed on 27 April 2026 — the old blanket rule that any HMRC text was automatically a scam no longer applies — making it more important than ever to know what separates a genuine message from a fraudulent one. This article explains the current scam patterns, what HMRC will and won’t do, and how to verify your real refund without trusting an unsolicited message.
How to tell a genuine HMRC message from a scam
- HMRC will never ask for personal or financial information in an SMS reply or via a link in a text. This is the definitive test, regardless of whether the SMS itself is genuine.
- Since 27 April 2026, HMRC may contact you by text in some situations — but a genuine HMRC SMS will direct you to log in at gov.uk yourself, not click an embedded link. Verify any text at gov.uk/guidance/check-if-a-text-message-youve-received-from-hmrc-is-genuine.
- The genuine HMRC domain is gov.uk. Any link ending in hmrc-refund.com, gov-uk-refund.org, or anything other than gov.uk is fake.
- HMRC will never threaten arrest, deportation, or police action for a tax debt. That threat is always a scam.
- HMRC will never demand payment by gift card, cryptocurrency, or wire transfer.
- Your Personal Tax Account at gov.uk/personal-tax-account is the genuine self-service channel — check your refund status there directly.
Common 2026 scam patterns
SMS and text scams
Fake-refund SMS is the highest-volume UK tax scam. Messages typically claim HMRC has calculated a refund and provide a shortened link to a convincing look-alike domain asking for your National Insurance number, bank details, or Government Gateway credentials. Since 27 April 2026 HMRC may send genuine texts, but genuine messages will never contain a link requesting your details — they direct you to log in to gov.uk yourself. Any text asking you to click and enter information is a scam.
Email and phishing
Phishing emails mimic HMRC’s branding and claim you are owed a refund or a P800 calculation. They use spoofed sender addresses and link to replica Government Gateway login pages. Fake Self Assessment attachments are also circulating that install malware when opened. A genuine P800 will appear in your Personal Tax Account — HMRC does not send actionable refund forms as email attachments.
Phone-call scams
The dominant 2026 phone scam is an automated robocall claiming HMRC is filing a lawsuit and instructing you to press 1. HMRC has confirmed on gov.uk that it is aware of this scam and that it is always fraudulent — end the call immediately. National Insurance number fraud calls are also common, with callers claiming your NI number has been “suspended.” Fraudsters can spoof the caller-ID to show a number that looks like HMRC, so a recognised number does not make a call legitimate.
WhatsApp and social media scams
WhatsApp messages impersonating HMRC are increasingly common, often claiming to offer a tax rebate and asking you to click a payment link or share your bank details. Fake HMRC accounts operate on X, Facebook, and Instagram. HMRC does not initiate contact through WhatsApp or social media. If you receive a suspicious WhatsApp message, take a screenshot and forward it to [email protected].
What HMRC will and won’t do
HMRC will:
- Contact you through your Personal Tax Account, by letter, or by phone or email using details you have already provided
- Address you by your full name in written correspondence
- Since 27 April 2026, send texts in some situations — but only to direct you to log in at gov.uk, never to collect information via a link or reply
HMRC won’t:
- Ask for personal or financial details in a text reply or via a link in a message
- Demand payment in gift cards, cryptocurrency, or wire transfer
- Threaten arrest, deportation, or police action for a tax debt
- Request remote-desktop access to your computer
See HMRC’s full guidance on phishing and scams: gov.uk/government/collections/hmrc-phishing-and-scams-detailed-information.
If you have already clicked a link or shared details
- Do not reply or click any further links.
- Forward suspicious texts to 60599 (standard network charges apply).
- Forward phishing emails to [email protected] then delete them. For suspicious WhatsApp messages, take a screenshot and email it to [email protected].
- Report fraud to Action Fraud at actionfraud.police.uk or call 0300 123 2040 (Monday to Friday).
- Change your passwords for your Personal Tax Account, email, and any online banking you use. Enable two-factor authentication where you have not already done so.
- Contact your bank immediately if you shared any payment or banking details.
Verify your real refund before trusting any message
Genuine refunds and P800 assessments for 2025-26 appear in your Personal Tax Account at gov.uk on HMRC’s own timetable — not via an unsolicited text. If you want to know whether you are owed a refund, calculate it yourself with our refund estimator and verify directly at gov.uk. The Self Assessment filing deadline for 2025-26 is 31 January 2027, so there is plenty of time to check properly rather than risk clicking a fraudulent link.
Last verified 2026-05-01. HMRC guidance for the 2026-27 UK tax year, including the 27 April 2026 SMS-contact policy update.