HMRC Tax Rebate Text Scams: The Refund That Never Was

If you have a mobile phone or an email address in the UK, the odds are good that you have already received a message claiming to be from HMRC. The wording varies, but the pattern is familiar. You are owed a tax refund. The amount is usually small enough to seem plausible, often somewhere between fifty and a few hundred pounds. All you need to do is click a link and confirm your bank details, and the money will be on its way.

It will not be on its way. There is no refund. The message is a scam, and the people behind it want one of two things: your banking details, or enough personal information to convince your bank that they are you.

How the scam usually works

The opening message is the bait. It might arrive as a text, an email, or occasionally a WhatsApp message. The sender claims to be HMRC, sometimes using a name like "GOV.UK" or "HMRC Refunds" to look more convincing. The message says you are due a rebate and includes a link.

Click the link and you land on a page that looks a lot like the real GOV.UK site. The colours, the crown logo, the layout, all of it can be copied. You will be asked for your name, address, date of birth, National Insurance number, and bank or card details. Some versions also ask for your online banking password or a one time passcode.

That information goes straight to the scammer. In many cases it is then used in a second stage. A few days later you may get a phone call from someone claiming to be from your bank's fraud team. They already know your name, your address, perhaps the last four digits of your card, and they sound entirely professional. They tell you there has been suspicious activity and that you need to move your money to a "safe account". The safe account belongs to them.

This follow on call is what catches people out. By the time it happens, the original text has often been forgotten, and the caller seems to have the kind of detail only a real bank would hold.

Why HMRC will not text or email you about a refund

HMRC's own guidance is straightforward on this point. It does not send text messages or emails telling people they are owed a tax refund, and it does not ask for personal or payment information by text, email or voicemail. If you are due a repayment of tax, you will normally be told by post, or you will see it through your Personal Tax Account on GOV.UK.

Refunds are not paid by clicking a link in a message. They are either paid directly into the account HMRC already has on file, sent as a cheque, or applied against future tax. There is no scenario in which a genuine refund requires you to enter card details on a web form you reached through a text.

If you ever want to check whether HMRC really is trying to contact you, log in to your Personal Tax Account directly through GOV.UK. Do not use any link from a message. Type the address into your browser yourself.

Signs the message is fake

• It promises a refund and asks you to click a link.
• It asks for bank details, card numbers or your online banking login.
• It uses pressure, for example saying the refund expires in 24 hours.
• The sender address looks odd, with extra characters or a domain that is not gov.uk.
• The link, when you hover over it without clicking, points somewhere other than gov.uk.
• The greeting is generic, such as "Dear customer" or "Dear taxpayer".

None of these on their own prove a message is a scam, but any of them should make you stop. A genuine HMRC letter will refer to your own tax affairs in specific terms and will not push you to act within hours.

Scam Detector

Got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next.

Try our Scam Detector free, here on this site →

What to do if you receive one

Do not click the link. Do not reply. Do not call any number given in the message.

HMRC has its own reporting routes, and using them helps shut the scams down faster. Forward suspicious emails to phishing@hmrc.gov.uk. Forward suspicious text messages to 7726, which is the free shortcode that flags the message to your mobile provider for investigation. Scam phone calls claiming to be from HMRC can be reported through the form on GOV.UK.

Once you have forwarded the message, delete it. You can also report scams to Action Fraud on 0300 123 2040, or through the Action Fraud website. In Scotland, report to Police Scotland on 101. It is worth checking GOV.UK directly from time to time, since reporting routes and shortcodes do occasionally change.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

If you have already given information

If you clicked the link and entered card or bank details, contact your bank straight away. Most banks have a 24 hour fraud line printed on the back of your card. Ask them to block the card and watch the account.

If you handed over your online banking password or a one time code, treat it as urgent. Change the password from a device you trust, and tell the bank what has happened. Under the Contingent Reimbursement Model, many UK banks will refund victims of authorised push payment fraud, although this depends on the circumstances and how the payment was made.

If you gave away personal details such as your National Insurance number, date of birth and address, you are at higher risk of identity fraud. Cifas runs a Protective Registration service which flags your name to lenders so they carry out extra checks before opening accounts. There is a fee for this, and the current amount is shown on the Cifas website. The Information Commissioner's Office also has guidance on what to do if your personal data has been misused.

For free, independent help, Citizens Advice can talk you through the next steps, particularly if money has been lost or if you are not sure where to start.

The short version

HMRC does not text or email about refunds. Any message that says otherwise is a scam, no matter how official it looks. Forward texts to 7726, send suspicious emails to phishing@hmrc.gov.uk, and check your tax position by logging in to GOV.UK yourself.

Related warnings

• Royal Mail Missed Parcel Text Scams
• Fake Bank Fraud Team Calls
• Energy Rebate and Cost of Living Scams
• The Hi Mum WhatsApp Scam

See more recent scams on the Latest Scam Warnings page.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Scam Detector lets you got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next. Try it now →