Guidance from HMRC 

HMRC is encouraging taxpayers to check on GOV.UK if a communication claiming to be from HMRC is genuine. HMRC says that it will never:

• leave voicemails threatening legal action or arrest;
• ask for personal or financial information via text message or email; or
• contact taxpayers by email, text, or phone to inform them about a refund or ask them to claim one. Anyone due a refund can claim it securely through their HMRC online account or the HMRC app.

Reporting suspicious activity

HMRC has published guidance on how to report suspicious HMRC emails, texts, social media accounts and phone calls. 

In December 2025, HMRC launched an online tool that taxpayers can use to report suspicious activity in their online account, such as:

• account access codes being sent to the taxpayer’s phone when they have not tried to sign in;
• the taxpayer being unable to access their online account because their password has been changed;
• changes to the taxpayer’s tax records they did not make; and
• receiving letters or payments from HMRC they were not expecting.

Although the tool is intended for use by taxpayers, HMRC has advised that agents can also use it by:

• answering the questions in the tool based on the client’s information; and
• editing the pre-populated email that the tool will generate to send to HMRC’s Fraud Prevention Centre. Agents should indicate that they are acting on behalf of a client and can add additional information, including the details of clients when reporting multiple cases. 

Further reading

• HMRC loses £47m in fraudulent tax repayments | ICAEW