HMRC advises that anyone who has received an email they haven’t requested, to verify a change to their online account, should ignore it. Taxpayers and agents should also ignore any follow-up emails asking them to click a link. 

HMRC says, “These emails, which we are aware have been received by some customers, are a tactic by scammers to direct people to a phishing site and steal personal details.  HMRC systems have not been compromised – but criminals have attempted to create fake customer accounts or to access existing accounts using personal data obtained through a variety of routes, including breaching other organisations’ security.” 

Anyone who has received such a message is encouraged to report it to HMRC at phishing@hmrc.gov.uk.