FAQs

Q1: What should I do if I clicked on a link in a suspected HMRC phishing email but didn’t enter any details?

A1: Well, it’s worth noting that simply clicking the link doesn’t automatically hand over your information, but it does expose you to potential malware or a fake login page. In my experience with clients who’ve done exactly this, the first step is to close the browser tab immediately, then run a full antivirus scan on your device. Next, log directly into your genuine HMRC account via GOV.UK – not through any bookmark or search result – and change your password while enabling or refreshing multi-factor authentication. If you use the same password elsewhere, update those too. I once helped a PAYE employee in Manchester who clicked a fake refund link; spotting it early meant no financial loss, just a quick security tidy-up.

Q2: Can HMRC ever legitimately phone me about an urgent tax matter, or are all calls scams?

A2: In my experience advising business owners and directors, genuine HMRC phone contact is rare and almost always follows prior written correspondence or a query you’ve raised yourself. They won’t cold-call demanding immediate payment or threatening arrest. That said, if you’ve been expecting a callback about a specific Self Assessment query or VAT issue, it could be real – but always hang up and ring back using the official number listed on GOV.UK. A client of mine, a freelance consultant in Leeds, received what looked like a legitimate follow-up call; verifying independently saved her from a very convincing scam that mimicked her earlier helpline interaction.

Q3: I’ve received a text claiming I’m due a tax refund – how can I confirm it’s not a phishing attempt without forwarding it straight away?

A3: It’s a common mix-up, but HMRC simply doesn’t send unsolicited texts about refunds or ask you to verify details this way. The safest check is to ignore the message entirely and log into your personal tax account directly through GOV.UK to see if any genuine refund notice appears there. Consider a shop owner I advised in Birmingham who ignored a similar text and discovered the real overpayment was already sitting in her account waiting to be claimed via the proper online route – no text required.

Q4: What actually happens behind the scenes when I forward a suspicious text to 60599?

A4: Forwarding helps HMRC and the National Cyber Security Centre build a picture of active campaigns so they can block the numbers and warn others. In practice, you won’t usually receive a personal reply, but your report contributes to shutting down the operation faster. I’ve seen this work particularly well for self-employed clients whose details appeared in targeted batches – one Glasgow freelancer’s report helped flag a wave of VAT-related texts that were hitting dozens of sole traders the same week.

Q5: Do self-employed people and freelancers face unique HMRC scam risks that PAYE employees don’t?

A5: Absolutely – scammers know self-employed individuals often juggle irregular income and deadlines, so they tailor messages around late Self Assessment filings or fake VAT adjustments. In my experience, freelancers are more likely to receive sophisticated emails referencing specific gig platform earnings or creative industry relief claims. A web designer client in Bristol nearly fell for one that mentioned her exact turnover figure lifted from public data; the key difference is that PAYE workers tend to get simpler refund bait, while the self-employed see more compliance-themed pressure.

Q6: I provided my National Insurance number to what turned out to be a scam caller pretending to be HMRC – what are the realistic next steps?

A6: Don’t panic, but act quickly. The NI number alone isn’t enough for most immediate fraud, yet it can be used to build a more convincing future attack. Contact HMRC’s fraud team via their official helpline (sourced directly from GOV.UK), update your online account security, and monitor your credit file for any unusual activity. I’ve guided several directors through this exact situation; in one case a company owner in Cardiff limited the damage by alerting his accountant early, preventing the scammers from attempting a corporation tax filing in his name.

Q7: Are there particular scams aimed at landlords receiving rental income, and how do they differ from standard ones?

A7: Landlords often see messages claiming unpaid tax on rental income or fabricated Capital Gains Tax bills tied to recent property sales. These feel more personalised because scammers scrape Land Registry data. The pitfall many miss is that genuine HMRC contact about property income almost always arrives by post first. One landlord client in Edinburgh received a text referencing his exact postcode and tenancy; verifying via his business tax account revealed nothing, and reporting it stopped the campaign targeting his street.

Q8: What if a phishing email includes a reference number that matches something on my actual tax return – does that make it genuine?

A8: Not necessarily. Sophisticated scammers scrape or guess reference numbers from public or breached data. Always treat any unexpected request for further details as suspicious, regardless of how official the number looks. In my practice I’ve seen this trip up high-earning contractors who assumed the reference proved legitimacy; the fix is the same – check your HMRC account independently rather than replying.

Q9: How should company directors protect their HMRC business tax account from targeted phishing?

A9: Directors’ accounts are high-value targets because they link to corporation tax and payroll. Use separate email addresses for business correspondence, enable extra security layers, and ensure only authorised agents can view the account. I advised a small manufacturing director in the Midlands who set up dual approval for any changes; when a scam email arrived pretending to be from his accountant, the extra layer flagged it immediately.

Q10: I replied to a scam email with basic contact details before realising – am I at greater risk than someone who did nothing?

A10: Replying confirms your number or email is active, which can lead to follow-up calls or more tailored attacks, but it’s not irreversible. Block the sender, report it, and watch for secondary contact. One PAYE client in Liverpool did this and then received a follow-up call; because she’d already secured her accounts, the scammers got nowhere when they tried the next stage.

Q11: Can genuine HMRC texts or emails ever come from a non-government phone number or personal-looking email address?

A11: No. Legitimate contact uses official channels only – texts show as “HM Revenue and Customs” and emails end in @hmrc.gov.uk. Anything else, even if it looks professional, is fake. This trips up many first-time self-employed clients who assume flexibility in communication methods.

Q12: I think I logged into a fake HMRC site after following a text link – how do I check for damage?

A12: Immediately change your real HMRC password from the official site, review recent account activity for unfamiliar logins, and contact your bank if any payment details were saved. Run a malware check too. I’ve walked several gig economy workers through this; one delivery driver in Newcastle discovered the fake site had captured his login attempt but, acting within hours, prevented any further access.

Q13: Do Scottish or Welsh taxpayers need to watch for different HMRC scam tactics because of devolved tax rates?

A13: The core scams remain the same UK-wide, but Scottish taxpayers sometimes see extra confusion around Scottish Income Tax bands mixed into refund messages, while Welsh clients get similar with the Welsh rate. The scam relies on that extra layer of complexity to sound plausible. Always verify through your personal tax account regardless of nation.

Q14: Are Making Tax Digital users more likely to receive convincing phishing attempts, and what should they look for?

A14: Yes, because scammers reference MTD deadlines or software compatibility. Look out for emails claiming your accounting software needs “urgent HMRC verification.” Genuine updates appear in your Business Tax Account first. A contractor client using MTD for VAT spotted this pattern early and avoided handing over login credentials.

Q15: What extra precautions should gig economy workers take around platform earnings reports?

A15: Platforms share data with HMRC, so scammers send fake “earnings reconciliation” texts. Never provide bank details in response. Treat any message about Uber, Deliveroo or similar earnings as suspect unless it matches something already in your HMRC account. I’ve seen this become more common with the growth of side hustles post-2025.