Scam Alert: HMRC Warns of Fake Self Assessment Refund Emails
HMRC posted a scam alert on 2 August. Reports are up of fake emails telling people they're due a Self Assessment tax refund for the 2024 to 2025 tax year, with a link to claim it urgently and a form asking for personal and bank details.
The timing is not an accident. August is when a lot of people start pulling paperwork together for the 2024-25 return, even though the filing deadline is 31 January 2027. Tax is back on people's minds, nobody has filed yet, and a message about money coming back to you lands nicely in that gap.
It works often enough to be worth doing. HMRC logged more than 170,000 scam referrals in the twelve months to July 2025. Over 47,000 of those were fake tax refund claims.
1. The fake HMRC refund email
It arrives looking right. HMRC green, the crown logo, the same slightly stiff wording the real letters use. Usually it mentions an overpayment on your 2024 to 2025 Self Assessment, or a credit sitting on your record waiting to be released.
Then the deadline. Claim within 24 hours. Respond before the refund expires. That pressure is the whole trick, because it stops you doing the one thing that ends the scam instantly, which is checking.
Click the link and you land on a copy of the HMRC sign-in page, or a claim form wanting your name, address, date of birth and bank account details so the refund can be paid in. There is no refund. What you've handed over is enough to take money out rather than put it in.
HMRC will never email you about a refund with a deadline attached. If you are genuinely owed money it sits in your HMRC account, and it will still be there next week. Log in yourself at tax.service.gov.uk or open the HMRC app and look. Type the address in rather than clicking through from anything.
Forward the email to phishing@hmrc.gov.uk and delete it. HMRC's guidance on genuine contacts lists what real messages from them do and don't do. Worth a bookmark.
2. WhatsApp messages pretending to be from HMRC
This version catches people who have already learned to be careful with email.
HMRC does use WhatsApp, which is exactly what makes it work. It's a broadcast channel: general reminders about deadlines and forms, sent one way, to everyone who signed up. Nobody at the other end reads replies, and nothing about your personal tax account ever goes through it.
The scam version turns up as a direct message. There's a penalty on your account, or a refund waiting, and there's either a link or a number to ring. Ring the number and you get someone patient and helpful who talks you through handing over your details.
HMRC will never send you a direct WhatsApp message about your tax account. Not about a penalty, not about a refund, not to confirm your details. If it's a one-to-one chat, it isn't HMRC.
Screenshot it, forward the screenshot to phishing@hmrc.gov.uk, report the contact inside WhatsApp, then delete the chat.
If you've already clicked or replied
Plenty of sharp people fall for these. The emails are good, and they arrive on a day when you're busy. If you've entered details or replied, do this in order:
- Ring your bank now. Use the number on the back of your card. UK banks run 24/7 fraud lines and the sooner you call, the more they can do.
- Change your HMRC password and turn on two-factor authentication if it isn't already on. That second step is what keeps someone out even when they have the password.
- Change your email password too. If they have access to your email they can reset almost everything else you own.
- Report it. Report Fraud on
0300 123 2040or at reportfraud.police.uk. - Get the machine checked if you installed anything or let anyone connect to your PC. Remote access tools tend to leave bits behind, and uninstalling the obvious one doesn't always clear it.
How to report HMRC scams
- Scam email → forward to
phishing@hmrc.gov.uk - Scam text → forward to
60599 - Scam WhatsApp → screenshot and forward to
phishing@hmrc.gov.uk, then report in WhatsApp and delete - Fraud of any kind → Report Fraud on
0300 123 2040or reportfraud.police.uk
Reporting takes about a minute and it does something. Takedowns of fake HMRC sites run on volume of reports, so the more that come in early, the shorter the window that site stays up for the next person.
If a scammer has been on your PC, or you installed something you now regret, get it looked at properly instead of hoping. I do virus and malware removal in St Helens and can check what's actually left on the machine. If you bank online from the same PC, my post on keeping a PC safe for online banking covers the basics worth having in place before the next one of these lands.
Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google
Think you've been scammed? Or had someone on your PC?
If you've let someone remote in, installed dodgy software, or just want your PC checked over — get in touch and I'll have a proper look.
★★★★★"Absolutely fantastic service from Local Computer Guy, I was unable to help my grandparents with their computer issues after an unfortunate issue with a scammer and potential virus being installed on their machine. After a quick call I knew they were in good hands. Arrived on time and quickly wiped the machine and made it safe, also helped investigate what had happened and helped my grandparents get using their computer again."
— Joe Gempton, via Google