HMRC Tax Refund Text Scam: UK Guide to Spotting & Reporting
HMRC will never ask for your personal details or direct you to claim a refund via text message.
What is this scam?
The HMRC tax refund text scam is a phishing attack where criminals send SMS messages impersonating HM Revenue and Customs. The message claims you are entitled to a tax refund, often citing a recent tax year or overpayment. It typically asks you to click a link to "claim your refund" or "confirm your details." The fake link either leads to a fraudulent website designed to look like the real HMRC portal, where you enter your login credentials, bank details, or National Insurance number. Alternatively, the scammer may ask you to reply with personal information directly via text. The goal is to steal your identity, bank account access, or enough information to commit fraud in your name. These scams are widespread in the UK and exploit the fact that genuine tax refunds do happen—making the initial message seem plausible to busy or unsuspecting taxpayers.
Warning signs to look for
- The message claims you are owed money and asks you to act urgently or "claim within 24 hours"—creating artificial pressure to bypass your caution.
- A shortened or suspicious URL (like bit.ly, tinyurl, or a domain vaguely resembling HMRC but spelled slightly differently) instead of a direct link to the official HMRC website.
- The text asks you to provide or "verify" personal details such as your National Insurance number, date of birth, bank account details, or login credentials.
- The message is generic or poorly formatted—real HMRC communications address you by name and use consistent branding.
- HMRC logo or branding that looks blurry, low-resolution, or unprofessional if an image is included.
- A request to reply by text with sensitive information, or to call a number provided in the message—HMRC never conducts sensitive business by text or over unsecured phone lines.
- The sender's number looks odd or doesn't match an official HMRC number; scammers often use random digits or short codes.
How this scam works step by step
Step 1: You receive an SMS claiming to be from HMRC, stating that you have a tax refund waiting. The message often quotes a specific tax year or mentions an overpayment, making it sound credible. Step 2: The scammer creates urgency by suggesting the refund will expire, or that you must claim within a deadline. Step 3: You are prompted to click a link or call a number. If you click the link, you are taken to a fake HMRC website that looks very similar to the real one. Step 4: You are asked to "log in" using your HMRC username and password, or to enter personal details such as your National Insurance number, bank details, or date of birth. Step 5: The scammer now has your credentials or identity information. They can log into your genuine HMRC account, access your tax history, or use your personal data to commit fraud—such as opening accounts in your name or accessing your bank. Step 6: By the time you realise the scam, the criminal has already moved money or sold your data. The entire process can take minutes.
How to verify if it is genuine
Do not click any link in the text message. Instead, go directly to the official HMRC website by typing www.gov.uk/hmrc into your browser, or use the official HMRC app if you have it installed from the Apple App Store or Google Play Store. Log in using your own credentials (never use credentials from the text message link). Check your tax account—genuine refunds are visible in your HMRC account under "Your returns" or "Payments." If you see a refund there, HMRC will not text you; they will send it to your nominated bank account automatically. Call HMRC directly on the number listed on gov.uk (0300 200 3300 for general enquiries), and ask if a refund is due to you. They will verify this using information only you know. A legitimate HMRC refund is never claimed via a text link, and HMRC never asks you to confirm details by SMS. For more information on identifying fake websites, read our guide on /guides/is-this-website-a-scam/.
What to do if you have already interacted
Act immediately. If you clicked the link but did not enter any information, stop there and do not proceed further. If you entered your HMRC login details: change your HMRC password right now by logging in at gov.uk. Then contact HMRC on 0300 200 3300 to report the breach and ask them to review your account for unauthorised activity. If you entered your bank details or National Insurance number: contact your bank immediately on the number on the back of your card (not a number from the text), and tell them you may have been compromised. Ask them to cancel your current card and issue a replacement, and to flag your account for fraud monitoring. Register for free fraud alerts with Experian, Equifax, or CallCredit to monitor your credit file for suspicious activity. Report the scam to Action Fraud on 0300 123 2040 or at actionfraud.police.uk. Forward the SMS to 7726 ("SPAM") to report it to your mobile network operator. Do not delete the text message—keep it as evidence.
Reporting this scam in the UK
Report the scam to Action Fraud, the UK's official fraud reporting centre, by calling 0300 123 2040 or visiting actionfraud.police.uk online. They will create a crime report and help track patterns of HMRC scams. Forward the SMS itself to 7726 (which spells "SPAM" on a phone keypad)—this sends it directly to your mobile network provider, who can investigate and block the sender's number. If you interacted with a fake website, report the phishing link to the National Cyber Security Centre (NCSC) by emailing report@phishing.gov.uk. Include the URL and a screenshot if possible. You can also contact Citizens Advice's consumer helpline on 0808 223 1133 for guidance on next steps if you have lost money or are worried about identity theft. If money was transferred, your bank may be able to recover it under the Contingent Reimbursement Model (CRM) code, which requires them to investigate unauthorized payments. Tell your bank immediately. Keep records of all communications with scammers, screenshots, and your crime reference number from Action Fraud.
Frequently asked questions
Is HMRC a legitimate organisation, or should I assume all HMRC messages are scams?
HMRC is legitimate, but they will never contact you via unsolicited text message about a refund. If you are genuinely owed a refund, HMRC will either send it directly to your bank account without asking you to claim it, or it will be visible when you log into your official HMRC account at gov.uk. Any HMRC text asking you to click a link or provide details is a scam.
I already sent money to the scammer. Can I get it back?
Contact your bank immediately on the number on the back of your card and explain that you have been scammed. If the payment was made by bank transfer or debit card in the last few days, your bank may be able to recall or block it. Under the Contingent Reimbursement Model, banks are required to investigate and may reimburse you if they failed to protect you adequately. Report the scam to Action Fraud (0300 123 2040) and obtain your crime reference number, which your bank will need. Time is critical—act within 24 hours if possible.
What should I do if I gave the scammer my National Insurance number but not my bank details?
Contact HMRC immediately on 0300 200 3300 to report the breach. Monitor your credit file free with one of the three credit reference agencies (Experian, Equifax, or CallCredit) to watch for fraudulent accounts opened in your name. Register with the National Fraud Database via cifas.org.uk to add extra protection. Report the scam to Action Fraud and forward the text to 7726. Your National Insurance number alone is less immediately valuable than your banking credentials, but criminals can use it for identity fraud, so vigilance is important.
How do I report an HMRC tax refund scam text?
Forward the SMS to 7726 ("SPAM") to report it to your mobile network. Call Action Fraud on 0300 123 2040 or report it online at actionfraud.police.uk. If you clicked a link and saw a fake website, report the URL to the NCSC at report@phishing.gov.uk. Save the original text message and any screenshots as evidence. If you are unsure whether to report, contact Citizens Advice on 0808 223 1133 for guidance.