I got an email that says it is from HMRC: is it a scam?

What the deadline means

A date the list gives for one email

• GOV.UK's list says that from 1 September 2026 HMRC's Fraud Prevention Centre may email you if you have reported suspicious activity in an HMRC online account, or if HMRC has noticed activity that may be suspicious. The email explains what HMRC has done to secure your account, and the list says it will never ask for personal, business or financial information.

Why you got it

GOV.UK gives reasons for HMRC using more than one way to get in touch: it can provide an extra level of security, and it can help prepare you for the follow up contact.

A GOV.UK news story of 17 November 2020 said many scams target customers to inform them of a fake tax rebate or tax refund they are due, and that others trick people into paying fictitious tax bills.

Got a letter from HMRC? Paste it into the checker for a plain-English identification.

Your options

1. Check it against GOV.UK's list of HMRC emails

   GOV.UK lists the emails HMRC may send and what each one is for. If an email is not listed there, GOV.UK points to its page on HMRC contact that uses more than one communication method.

2. Report it

   GOV.UK's page of examples says to forward an email you are unsure about to HMRC and then delete it, and to delete any emails or texts once you have reported them.

3. If you replied or clicked

   If you think you have given personal information in reply to a suspicious email or text, contact the HMRC security team at [email protected].

4. If you lost money

   If you have been the victim of a scam and lost money, GOV.UK says to report it to Report Fraud through its website, or to Police Scotland on 101 if you live in Scotland.

These are the routes GOV.UK describes, set out as information from GOV.UK and HMRC. They are not advice on your own case.

The emails HMRC does send

GOV.UK's list includes an email saying you are due a tax refund, also called a P800 refund. The list says that email will not ask you for personal or financial information and will not provide any links to websites.

GOV.UK's list includes emails from the HMRC Self Assessment team, sent to some customers, with the title "Your Annual Tax Summary is ready". The list says these emails will never ask for personal or financial information.

GOV.UK's list includes emails about Child Benefit claim updates, and says these emails will never ask you for any personal or financial information. GOV.UK's list includes VAT debt reminder emails, and says these emails will never ask for personal or financial information.

• GOV.UK: Check if an email you've received from HMRC is genuineGOV.UK lists the emails HMRC may send and what each one is for. If an email is not listed there, GOV.UK points to its page on HMRC contact that uses more than one communication method.

The signs of a fake email

GOV.UK's page on reporting HMRC scams says you will never get an email, text message, message in an app or phone call from HMRC which asks for your personal or payment information.

The sender's address

GOV.UK's page of examples warns that fraudsters may spoof a genuine email address or change the display name.

Links, attachments and QR codes

GOV.UK says not to open attachments or click any links in an unexpected email or text message.

For a tax rebate email, GOV.UK's page of examples lists three things not to do: click on the links to visit a website the email mentions, open any attachments, or disclose any personal or payment information.

GOV.UK says suspicious emails containing QR codes can be sent to [email protected] and then deleted.

Fake email patterns GOV.UK has described

GOV.UK's page of examples shows a scam email about a tax rebate that carries a link to a phishing website, and an example of that website, which is designed to trick you into disclosing personal information.

GOV.UK's page of examples describes a Customs Duty scam in which victims are told they must pay Customs Duty to receive a valuable parcel that does not exist.

GOV.UK's page of examples also has a section on refund companies, firms that offer to claim a tax refund for a fee, and says these companies are not connected with HMRC in any way.

Real emails that can look odd

GOV.UK's pages do not always word the same point in the same way. Each statement on this page is given as the page it comes from words it, and that page is linked.

GOV.UK's list says that when you are registering for VAT, HMRC may email you if additional information is needed to verify your business or identity, and that this may include requests for personal or financial information. It says HMRC uses the email address on your VAT registration application.

GOV.UK's list includes an email about tariff and quota policy that may ask you to send information to an HMRC email address, either to confirm that the details HMRC holds for you are correct or to provide updated details. The list says information you provide is held securely.

GOV.UK's list of HMRC contact that uses more than one communication method includes an email or letter to Construction Industry Scheme (CIS) contractors, sent when HMRC's checks suggest the deduction rate on their monthly returns did not match. It asks the contractor to review the monthly returns, and may ask them to correct errors or give HMRC further information. Many entries on that page give a 'from … up to and including …' window; the live page is the one to check.

The same list has an entry for people who have traded cryptoassets, and says HMRC may contact you by letter, email or text message. It also has an entry for investors in offshore funds, and says HMRC may send you an email or letter if you hold, or have recently held, investments in an offshore fund.

• GOV.UK: Check genuine HMRC contact that uses more than one communication methodGOV.UK says HMRC sometimes uses more than one way to get in touch, for example a letter first and then an email, call or text message, and lists those contacts on one page.

How to report a suspicious email

GOV.UK's general page on reporting internet scams says to forward suspicious emails to [email protected], and that the National Cyber Security Centre will investigate it. For emails that claim to be from HMRC, GOV.UK's page on HMRC scams gives HMRC's own address.

GOV.UK says the email address and phone number you report from will be shared with other organisations if that is necessary to close down the scam.

• GOV.UK: Report scam HMRC messages, calls and social media accountsGOV.UK lists how to report suspicious HMRC emails, texts, phone calls, social media accounts and letters: texts to 60599, emails to [email protected], and for a letter, the HMRC team the letter says it is from.

If you clicked a link or replied

When you tell the HMRC security team what you gave away, GOV.UK says to include brief details of what you disclosed, for example a name, address, HMRC User ID or password, but not to give your personal details in the email.

GOV.UK says that if you get HMRC sign in codes by text or voice call when you are not trying to sign in, it may mean someone has your sign in details, and that it would be sensible to change your password.

If you lost money

GOV.UK says to contact your bank immediately if you have recently transferred funds to a third party and believe you have been scammed.

GOV.UK says that if you have been a victim of an online scam, you can contact Victim Support by phone on 08 08 16 89 111.

• GOV.UK: Report suspicious activity happening in an HMRC online accountIf you think someone has accessed your HMRC online account, GOV.UK says to report it immediately to HMRC. Its page on suspicious activity in an HMRC online account lists account access codes sent to your phone when you have not tried to sign in as a sign of this.
• GOV.UK: Identify tax scams by phone, text, email or social mediaGOV.UK's checklist for deciding whether a suspicious phone call, text message, email or social media account is a scam also sets out what to do if you have already shared personal details.

Checks on this site

• The scam checkCalls, texts, emails and letters: check through GOV.UK, not the message.
• The letter checkerPaste a letter or message, or take a photo of a letter, to see what it most likely is. Your letter is read here and is not kept.
• Spot the FakeA daily practice page for telling real HMRC contact from fakes.

If it turns out to be HMRC

For an email that matches an entry on GOV.UK's list, the entry says what the email is for and, for many entries, what the email will not ask you for. HMRC's lists describe emails, phone calls, letters and text messages it has recently issued. Not every HMRC communication is included.

If you ignore real HMRC contact

Setting aside a message you suspect is a scam is not the same as setting aside real HMRC contact, and GOV.UK's lists exist so the two can be told apart. What follows from leaving a real email unanswered depends on its subject, and GOV.UK's page for that subject states it.

If you want to ask an adviser

• Is there anything open on my HMRC record that HMRC would be emailing me about?
• If I replied to a suspicious email, what should I look at on my HMRC online account?
• Could a real HMRC email and a fake one both be about the tax matter I am dealing with?
• If I gave away sign in details, what would an adviser check to protect my account and records?

Quick answers