HMRC scams

Scammers send emails, texts and links that look like they come from HMRC, to take your password, card details or money. Here is how to tell a fake from the real thing, and how to report one so it gets taken down.

Got a HMRC message you are not sure about?

Don't click the link in it. Paste the link into ScamX and we'll tell you whether it really goes to HMRC.

Check the link

The real HMRC addresses

HMRC's own sites end in:

  • gov.uk

Read the address up to the first single slash: it must end with one of these. An extra word, a different ending or a shortened link means it is not HMRC, however real the page looks. When in doubt, type the address yourself or use the HMRC app.

What fake HMRC messages look like

  • Tax refund or rebate emails and texts linking to phishing websites
  • Automated calls saying HMRC is filing a lawsuit and to press 1 to pay
  • Fake social media accounts offering tax refunds
  • Customs duty demands to release a parcel that doesn't exist

What HMRC says

  • HMRC only emails about a tax rebate, or asks for personal or payment details, from an address ending in hmrc.gov.uk.
  • HMRC never tells you about a tax rebate or asks for personal or payment information by text, and never offers rebates on social media.

How to report a HMRC scam

  1. Tell HMRC. Forward suspicious emails: [email protected]. Or: Forward suspicious texts (network rate): text 60599. Or: Report suspicious social media accounts: [email protected]. Or: Report a suspicious phone call: https://www.tax.service.gov.uk/submissions/new-form/report-a-suspicious-hmrc-phone-call.
  2. Get the fake site taken down. Scan the link: the report names the company hosting it and the registrar of its domain, with a ready-written message for each.
  3. Put a warning in front of everyone else. Report the link to Google Safe Browsing and Microsoft SmartScreen.
  4. If you lost money or shared details, call your bank first, then report it to the police or your national fraud line. Where to report in your country.

HMRC's reporting route checked against HMRC's own page on 2026-10-10. ScamX is not affiliated with HMRC.