Phishing examples
(emails, letters, bogus callers, SMS text messages)

If you think you may have received a HMRC related phishing/bogus email, you can check it against the examples shown on this page.

It will assist our investigations if you report all 'HMRC related' phishing emails to us. Even if you receive the same / similar phishing email on multiple occasions, please forward it to phishing@hmrc.gsi.gov.uk and then delete it. Do not open any attachments or click on any links within the email, as they may contain malicious software.

1. Tax rebate / tax refund - email scam

HM Revenue & Customs (HMRC) will never send notifications of a tax rebate / refund by email, or ask you to disclose personal or payment information by email.

Do not visit the website contained within the email or disclose any personal or payment information.

A selection of fake email addresses used to distribute the tax rebate emails can be seen below:

  • reve.alert@hmrc.gov.uk
  • services@hmrc.co.uk
  • noreply@hmrevenue.com
  • service@hmrc.gov.uk
  • service.refund@hmrc.gov
  • secure@hmrc.co.uk
  • hmrc@gov.uk
  • taxes@hmrc.co.uk
  • taxrefund-notice@hmrc.gov.uk
  • taxrefund@hmrc.gov.uk
  • refund-help@hmrc.gov.uk
  • service@online.com
  • email@hmrc.gov.uk
  • refund.alert@hmrc.gov.uk
  • refunds@hmrc.gov.uk
  • srvcs@hmrc.gov.uk
  • alertsonline@hmrc.co.uk
  • info@hmrc.gov.uk
  • rebate@hmrc.gov.uk

HMRC does not use any of the above email addresses.

Examples of tax rebate phishing emails/fake HMRC pages issued by fraudsters to try obtain personal/payment information can be viewed below:

Example 1 (PDF 16K)
Example 2 (PDF 80K)
Example 3 (PDF 72K)
Example 4 (PDF 87K)
Example 5 (PDF 86K)

2.1 Individuals - Tax information newsletter, Issue: 2014/September - email scam

HMRC is aware of a bogus email being circulated requesting customers to verify their identity. It asks customers to provide photographic copies of their passport, NI card, utility bill and bank statement. Do not respond to this email. Forward it to phishing@hmrc.gsi.gov.uk then delete it.

Example of the email scam (PDF 69K)

2.2 PAYE - P6/P6B 'You have received new messages from HMRC' - email scam

HMRC is aware of a bogus email being circulated advising customers their tax notices have been issued. The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the email scam (PDF 39K)

2.3 HMRC Alert - email scam

HMRC is aware of a bogus email being circulated advising customers they have paid too much tax due to an official error. The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the email scam (PDF 25K)

2.4 HMRC Employer Annual Return - email scam

HMRC is aware of a bogus email being circulated advising customers to file their Employer Annual Return (P35 and P14s) for 2013-14 online. The email includes an attachment which should not be opened as it contains a virus. Do not respond to the email and delete it immediately.

Example of the email scam (PDF 76K)

2.5 Important notification from HM Revenue & Customs - email scam

HMRC is aware of a bogus email being circulated advising customers of a registered unpaid invoice recommending that it should be paid in full to avoid legal action. The email includes an attachment which should not be opened as it contains a virus. Do not respond to the email and delete it immediately.

Example of the email scam (PDF 94K)

2.6 HMRC Employer Alerts and Registrations - email scam

HMRC is aware that a bogus version of the 'Employer Alerts & Registrations' email is currently being circulated. The email advises customers that their registration details have been recorded for email alert purposes only. The fraudulent version of the email encourages customers to open an attached zip file and to complete all the relevant sections.

The attached zip file contains a virus and should not be opened. The genuine version does not contain a zip file.

Example of the HMRC Employer Alerts & Registrations email scam. (PDF 10K)

2.7 Important information for employers - Employer Bulletin Issue 46 - email scam

HMRC is aware of a bogus email being circulated advising customers that the latest version of the Employer Bulletin (Issue 46) has just been published. The email contains a separate zip file attachment which should not be opened as this contains a virus.

The genuine Employer Bulletin 46 was issued from 17 February and does not contain a zip file attachment.

Example of the Employer Bulletin email scam (PDF 12K)

2.8 Important information for employers - Employer Bulletin Issue 45 - email scam

HMRC is aware of a bogus email being circulated advising customers that version 45 of the Employer Bulletin has just been published. The email contains a zip file attachment which should not be opened as this contains a virus.

The genuine Employer Bulletin was issued in September and does not contain a zip file.

Example of the Employer Bulletin email scam (PDF 13K)

2.9 Could not process Online Submission for Reference ***/EG123456 - email scam

HMRC is aware of a bogus email being circulated advising customers that HMRC has not been able to process their Full Payment Submission. The email includes an attachment which should not be opened as it contains a virus. Do not respond to the email and delete it immediately.

Example of the email scam (PDF 13K)

2.10 Gateway Registration Notification - email scam

HMRC is aware of a bogus email being circulated advising customers to check which services they use. The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the email scam (PDF 12K)

2.11 Notice of Underreported Income - email scam

HMRC is aware of a bogus email being circulated advising customers to review their tax income statement. The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the scam email (PDF 13K)

2.12 VAT - successful receipt of online submission - email scam

HMRC is aware of a bogus email being circulated thanking customers for sending a VAT Return online. The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the scam email (PDF 9K)

2.13 Tax Credits - 'Your 2013 Tax Refund Report!' email scam

HMRC is aware of a bogus email being circulated from 'taxretund@hmrc.gov.uk' advising of a 2013 tax refund report. The email appears to have been issued by Preston Tax Credit office, however this is not the case, it is a scam.

The email includes an attachment which should not be opened as it contains a virus.

Do not respond to the email and delete it immediately.

Example of the scam email (PDF 12K)

2.14 Publication of companies and VAT registration numbers in the UK - letter

Whilst this is not a phishing scam HMRC is aware of a letter which is being issued to customers which leads them to believe that they are required to provide details of their VAT registration number.

This company is not connected to HMRC and you are under no obligation to reply to the letter.

Example of the letter (PDF 219K)

3. Requests made to customers for payment or personal information - '419' scam

HMRC is aware that customers have received emails requesting personal details or payment in exchange for:

  • lottery winnings
  • seized goods/packages (held by Customs and Excise)
  • certificates/bonds
  • inheritance payments

Example one - Phishing request for payment or personal information - '419' scam (PDF 11K)

Example two - Phishing request for payment or personal information - '419' scam (PDF 22K)

Example three - Phishing request for payment or personal information - '419' scam (PDF 47K)

These are known as '419' scams. HMRC will never request payment or personal details by e-mail.

If you receive any of these emails please forward them to phishing@hmrc.gsi.gov.uk and then delete them.

Note: Fraudsters sometimes sign off such scams using the name of a genuine member of HMRC to try and make the scam appear more genuine. If you are in any doubt, please forward the email to HMRC for verification.

4. Refund companies

HMRC is aware of companies who issue emails advertising their services. They offer to apply to HMRC for a rebate of National Insurance/tax on the customer's behalf, usually for a fee.

These companies are not connected with HMRC in any way.

5. Bogus callers

HMRC is aware that some customers have received telephone calls or home visits from people claiming to be from HMRC. They are encouraged to provide their bank account details in exchange for tax advice enabling them to make a payment or obtain a refund of tax. A fee is charged for this service.

If you cannot verify the identity of the caller we recommend that you report it to the police immediately.

6. SMS text messages

If you receive an SMS text message claiming to be from HMRC asking you to contact any telephone number or reply to the SMS you should not respond. This warning only applies to any SMS text messages from HMRC. It does not apply to any messages left in person by HMRC officers asking you to ring them back at your local office.

7. Request to complete NRL1 forms and return by Fax

Lettings agents and landlords living abroad are being targeted by a series of scams. These request, by email, letter or fax, completion of a form NRL1 and ask for a considerable amount of personal information.

These forms (which may be headed 'Application for Withholding Certificate for Dispositions by Foreign Persons of UK Real Property Interests' or 'Application for a tax-free account and to receive rental income without deduction of tax for Non- UK Residents') are not issued by HMRC and should not be completed.

HMRC will never ask you to disclose personal information by email or fax.

8. Historical phishing emails

The following are descriptions of phishing emails already reported by customers to HMRC:

PayPal

Emails advising customers to download an attachment to request a tax refund via PayPal. Do not download the attachment.

Example of an email offering a tax refund through PayPal (PDF 16K)

Security checks

Emails sent to customers from secure@hmrc.gov.uk claiming that HMRC is carrying out additional security checks and requesting confirmation of bank details. Do not click on any of the links contained in the email.

Compensation claim

The scam leads customers to believe that they may have been the victim of fraud and requests personal details on the pretext that compensation will be paid.

Example of the compensation email (PDF 32K)

Export Clearance Process (Delivery Stop Order)

Emails claim that goods have been withheld by customs and require a payment before release.

Example of the Export Clearance Process (Delivery Stop Order) (PDF 92K)

9. Account change notification - letter scam

HMRC is aware of a letter which has been issued to customers advising them of a change to HMRC's bank account details. This is a scam, please do not respond to this letter. To check how to pay HMRC, please see the information shown by following the link below:-

HMRC bank account details - A to Z

An example of the fraudulent letter can be seen by selecting the link below:-

Example - 'Account change notification letter' - scam (PDF 187K)

Top