Last updated: 16 October 2026
How do scammers target HMRC online accounts, and how can you protect yours?
Fraudsters try to take over HMRC online accounts so they can claim refunds into their own bank accounts or change your details. HMRC has found and locked tens of thousands of accounts where criminals used stolen personal data to register or sign in. To protect yourself, never share your Government Gateway or One Login details, use multi-factor authentication, ignore texts and emails offering tax refunds, and check your account regularly. HMRC never asks for bank details by text or email.
Common HMRC scams
- Texts or emails saying you’re owed a tax refund, with a link
- Calls threatening arrest over unpaid tax
- Messages asking you to “verify” your account
- Fake HMRC websites copying the gov.uk design
- Offers to “help” claim refunds for a large fee
Warning signs
| Genuine HMRC | Scam |
| Tells you about refunds by letter or in your account | Texts or emails with a refund link |
| Never asks for full bank details by email | Asks for card details |
| Doesn’t threaten immediate arrest | Threatens police or arrest |
| Uses gov.uk addresses | Uses odd web addresses |
How to protect your account
- Use the GOV.UK One Login or Government Gateway with a strong, unique password.
2. Turn on 2-step verification with an authenticator app.
3. Check your personal tax account for changes you didn’t make.
4. Keep contact details up to date.
5. Don’t sign in from links in messages.
If you think you’ve been targeted
- Forward suspicious emails to phishing@hmrc.gov.uk
- Forward texts to 60599
- Report calls through gov.uk
- If you gave details, contact HMRC and your bank immediately
- Report fraud to Action Fraud (or Police Scotland in Scotland)
Example
Tom receives a text saying he’s due a £468 tax refund, with a link to claim. He doesn’t click, forwards it to 60599 and signs in to his HMRC account via gov.uk to check. No refund is due. Two months later, a genuine P800 letter arrives for a small repayment, which he claims through his account.
Repayment agents
Some agents claim tax refunds for a cut. Check before signing anything that assigns your refund to them, and remember you can claim most refunds yourself free of charge.
Common mistakes
- Clicking refund links
- Sharing sign-in codes on calls
- Reusing passwords
- Ignoring unexpected HMRC letters
Records to keep
Keep copies of suspicious messages you report and any reference numbers given by HMRC or Action Fraud.
Protecting a business or agent account
Businesses should limit who has access to their HMRC account, remove former staff promptly and use separate sign-ins for each person rather than sharing one. Agents should authorise clients through the agent services account and check regularly for unexpected changes to bank details or VAT repayment claims. HMRC’s fraud team can lock an account quickly if you report concerns.
Frequently asked questions
Does HMRC text people?
Sometimes, but never with refund links asking for bank details.
Can I check if a call is genuine?
Hang up and call HMRC using gov.uk numbers.
Will HMRC refund money stolen by fraudsters?
HMRC will investigate and correct your tax record.
Is my business account at risk too?
Yes, protect company and agent accounts the same way.
Related: refund phishing scams, tax code error or scam and delays to tax refunds.
Talk to Accotax
Want this handled for you? Our team at Accotax can help with HMRC scam protection advice. See our tax refund accountants service, or contact us for a free, no-obligation quote.
This page is general guidance based on HMRC rules for the 2026/27 tax year, checked against gov.uk on 16 October 2026. It is not personal advice, so speak to an accountant about your own situation.
