In March 2025, HMRC warned that agent online service accounts and agent services accounts are “often a target for fraudsters” and that it would act quickly where it believes an account “has been compromised”. Depending on the circumstances, HMRC may suspend the agent’s account without notice, potentially causing significant disruption for the agent.  

HMRC has published guidance in issues 129, 130 and 135 of the Agent Update on how agents can protect their accounts from fraud. Agents are encouraged to: 

• Check that all software used is automatically updated on a regular basis.
• Ensure that antivirus protection is up to date and that scans are performed and reviewed on a regular basis. 
• Use strong passwords and change passwords where it is suspected that a device has been compromised.
• Think twice before following links or downloading attachments in suspicious or unexpected emails. HMRC says that only emails sent from an address that ends in gov.uk (eg, @hmrc.gov.uk) are genuine emails from HMRC. HMRC also publishes details of recent email campaigns to help agents decide if an email is genuine. 
• Forward phishing emails that mention HMRC to phishing@hmrc.gov.uk.
• Report any suspicious activity on agent accounts to HMRC’s online services team immediately. 
• Consider having regular security check-ups with cyber security specialists, particularly if there have been issues in the past.
• Explore the guidance published by the National Cyber Security Centre, including on the benefits of becoming Cyber Essentials certified.  

If an account has been suspended, the agent should receive a letter from HMRC with instructions on how they can restore access to the account. If the agent has not received a letter, they can call HMRC’s online services helpdesk on 0300 200 3600.  

The warnings come against a backdrop of increasing digitalisation. HMRC is working towards becoming a digital-first organisation and has been set a target of at least 90% of interactions being undertaken digitally by 2029/30. It is likely that email contact with HMRC will increase in the next few years, making HMRC’s guidance on keeping accounts and data safe even more important.  

Further information 

• Stop! Think Fraud - How to stay safe from scams 
• ICAEW's Cyber security awareness hub