Last updated: 14 October 2026
Is a message from HMRC about a company tax refund genuine?
Be careful. HMRC does repay overpaid corporation tax, VAT and PAYE to companies, but it doesn’t send emails or texts with links offering a refund, and it never asks for bank details that way. Fraudsters often target company directors with fake refund messages, sometimes using details taken from Companies House. A genuine refund is shown in the company’s HMRC business tax account, or arrives after a return you’ve filed, or in a letter you can verify.
How to spot a fake refund alert
| Warning sign | Why it matters |
| An email or text with a link to “claim your refund” | HMRC doesn’t do this |
| Requests for card details or login codes | HMRC never asks for these by email or phone |
| Urgent deadlines or threats | Pressure is a common scam tactic |
| Sender addresses that look slightly wrong | Fake domains imitate gov.uk |
| A refund you weren’t expecting | Check your business tax account first |
How genuine company refunds happen
- Corporation tax: after you file a CT600 showing an overpayment, or after a loss carry-back claim. HMRC pays to the bank account given on the return.
- VAT: a repayment return is paid to your registered bank account, sometimes after checks.
- PAYE: overpaid PAYE can be set against future liabilities or refunded through your PAYE account.
- R&D tax credits: paid after HMRC processes the claim, often following checks.
Example
A director receives an email saying the company is owed £1,846 and should click a link to claim. She logs into the company’s business tax account directly instead, and finds no refund due. She forwards the email to HMRC’s phishing team and deletes it.
What to do with a suspicious message
- Don’t click links, open attachments or reply.
2. Forward emails to phishing@hmrc.gov.uk and texts to 60599.
3. Check your HMRC online account by typing the address yourself.
4. If you’ve given details, contact your bank and HMRC straight away, and change your passwords.
5. Report fraud to Action Fraud.
Protecting your company
- Turn on two-step verification for your Government Gateway login
- Limit who can access the business tax account
- Tell staff how HMRC really contacts businesses
- Check that your registered office and director details at Companies House are correct, so you can spot changes
Waiting for a genuine refund
Most corporation tax repayments arrive within a few weeks of the return being processed. Large or unusual claims can take longer, and HMRC may check them first. Repayment interest is paid on overpaid corporation tax.
Fake refund calls and letters
Scammers also use phone calls and letters that copy HMRC branding. A real HMRC letter will match details in your online account. If you are unsure, call HMRC using a number from gov.uk, not one in the message, and quote your company’s UTR.
Frequently asked questions
Can HMRC call me about a refund?
It may phone, but won’t ask for bank details or payment in an unexpected call.
Does HMRC use WhatsApp?
It doesn’t send refund offers that way.
Can an agent claim refunds for my company?
Yes, if authorised.
What if a refund goes to the wrong account?
Contact HMRC immediately.
Related: waiting for a company’s tax refund, HMRC accounts hit by scammers and claiming overpaid tax.
Talk to Accotax
Want this handled for you? Our team at Accotax can help with company tax refunds. See our tax refund accountants service, or contact us for a free, no-obligation quote.
This page is general guidance based on HMRC rules for the 2026/27 tax year, checked against gov.uk on 14 October 2026. It is not personal advice, so speak to an accountant about your own situation.
