How to tell a fake HMRC letter from a real one

What the deadline means

Why you got it

GOV.UK says HMRC may contact you by letter first and then follow up with an email, call or text message, because this can provide an extra level of security, can help prepare you for the follow up contact, and because these are the contact details HMRC has for you.

HMRC's Compliance Handbook says a One to Many approach is where HMRC sends one standard message to many customers, to influence their behaviour so they are more likely to comply with their tax obligations. HMRC's manual says a One to Many approach sets out what HMRC wants customers to do and why, what happens if they do or do not respond, and what follow up HMRC will undertake.

HMRC's manual tells its staff that if a One to Many letter asks people for more information or records to show their tax affairs are correct, HMRC must either open a compliance check or make clear that, where information is asked for voluntarily, there is no obligation to provide it.

Got a letter from HMRC? Paste it into the checker for a plain-English identification.

Your options

1. Check the letter against GOV.UK's lists

   GOV.UK lists letters HMRC has recently sent and what each one is for.

2. Report a letter you think is fake

   For a suspicious letter, GOV.UK says to contact the HMRC team the letter says it is from, for example the Self Assessment team.

3. Tell HMRC what you gave away

   GOV.UK says that if you have already shared personal details, you can report the disclosure of personal information to the HMRC security team. When you tell the HMRC security team what you gave away, GOV.UK says to include brief details of what you disclosed, for example a name, address, HMRC User ID or password, but not to give your personal details in the email.

4. Contact your bank and Report Fraud if you lost money

   GOV.UK's page on internet scams says that if you think you have lost money or been hacked because of an online scam or fraud and you are in England or Wales, you can contact Report Fraud online, with an account or as a guest, or by phone on 0300 123 2040, and that in Scotland you report the crime to Police Scotland.

GOV.UK says the email address and phone number you report from will be shared with other organisations if that is necessary to close down the scam.

Check the letter against HMRC's published lists

Letter codes

GOV.UK's list names many letters by the code HMRC gives them, for example CA2490, IDMS99 and NISPAR1MM, and others by their subject, for example a Self Assessment repayment claim and criteria review.

Payment references

Paying a Self Assessment bill needs the 11-character payment reference: the 10-digit Unique Taxpayer Reference followed by the letter K.

Paying a Simple Assessment needs the 14-character payment reference starting with X from the letter.

GOV.UK's guide to paying taxes, penalties or enquiry settlements is for payments whose reference starts with X and that HMRC's other paying guides do not cover. If the reference does not start with an X, GOV.UK says to check HMRC's other paying guides. GOV.UK says paying through that guide needs your 14 or 15 character payment reference that begins with X, found on your payslip or Notice to Pay, and to contact HMRC if you are unsure about your payment reference.

Phone numbers and addresses, as GOV.UK gives them

GOV.UK's list includes letter IDMS99P, about an overdue Simple Assessment tax bill. It says the letter tells you how to pay and, if you cannot pay in full now, to call HMRC on 0300 322 7835.

GOV.UK's list says HMRC may contact Stamp Duty Land Tax and Capital Gains Tax customers who have debts or outstanding returns, to request payment, request overdue returns or update their address. The messages either direct you to GOV.UK or ask you to contact HMRC by phone on 0300 200 3844, and will not include or ask for any personal or financial information.

HMRC's Income Tax enquiries line is 0300 200 3300. The Income Tax enquiries line is open Monday to Friday, 8am to 6pm, and closed on bank holidays.

HMRC's Self Assessment general enquiries line is 0300 200 3310, open Monday to Friday, 8am to 6pm, and closed on bank holidays.

Post for PAYE and Income Tax queries goes to Pay As You Earn and Self Assessment, HM Revenue and Customs, BX9 1AS.

QR codes in HMRC letters

HMRC uses QR codes in its letters, usually leading to guidance on GOV.UK, and says it will tell you if a code goes anywhere else and that you will never be taken to a page where you have to put in personal information. When you are signed in to your HMRC account it may use a QR code to redirect you, for example to your bank's login page.

GOV.UK's QR code page says letters and leaflets from HMRC may contain a QR code you can scan for further information or help, and lists each letter with a QR code and where the code takes you. For example, the QR code on a tax code notice (P2) takes you to GOV.UK's guidance on tax codes, and the one on letter IDMS99 takes you to GOV.UK's guidance and support if you owe money to HMRC.

• GOV.UK: Check if a letter you've received from HMRC is genuineGOV.UK lists letters HMRC has recently sent and what each one is for.
• GOV.UK: Check a list of genuine HMRC contactsGOV.UK's lists of genuine HMRC contacts describe emails, phone calls, letters and text messages HMRC has recently issued, to help you decide whether a contact is genuine or a scam. Not every HMRC communication is included.
• GOV.UK: Check if a QR code on a letter you've received from HMRC is genuineGOV.UK lists the QR codes on HMRC letters and leaflets and where each one takes you.

What HMRC and GOV.UK say to look for

Payment

HMRC says it will never ask you to pay with gift or payment vouchers.

Requests for personal details

GOV.UK's page on reporting HMRC scams says you will never get an email, text message, message in an app or phone call from HMRC which asks for your personal or payment information.

GOV.UK's sentence that you will never get an email, text message, message in an application or phone call from HMRC which asks for your personal or payment information names those four kinds of contact. It does not name letters.

Email addresses

In its entries for the VAT registration letter (VPCF1) and for Self Assessment repayment claims, GOV.UK says that if you receive further requests for information to be sent to an email address that does not end in hmrc.gov.uk, they will not be genuine and you should report this to HMRC.

Offers to claim a refund for you

GOV.UK says HMRC is aware of companies that send emails or texts offering to claim tax refunds or rebates on your behalf, usually for a fee, and that these companies are not connected with HMRC in any way.

While you check

GOV.UK says not to give out private information such as bank details or passwords, reply to text messages, download attachments or click on any links in emails if you are not sure they are genuine.

Real letters that look wrong

Refund invitations

HMRC says it may write to you, from 10 July 2026 up to and including 31 March 2027, if its records show that you continued to pay National Insurance contributions after reaching State Pension age, and may invite you to claim a refund. HMRC's list says the letter asks you either to complete the form on the back of the letter with your bank details and post it to HMRC, or to contact HMRC using the National Insurance helpline. HMRC says it will review your National Insurance record and confirm if you are due a refund.

GOV.UK's list includes letter CA4361, which HMRC sends if it thinks you may have paid too much National Insurance. It asks for information about your past employment, by the online form or the paper form attached to the letter, and says HMRC will then review the details and confirm if you are due a refund.

GOV.UK's list includes letter NI Refunds 1, which HMRC sends to a representative of a deceased person if it thinks the deceased paid too much National Insurance. It asks you to claim a refund, either by contacting HMRC on the telephone number at the top of the letter or by posting the paper form attached.

GOV.UK's list of contact that uses more than one method includes National Insurance refunds 2. It says HMRC will contact you by letter or email if it thinks you may be due a National Insurance refund after a review requested by your employer, and will explain whether you are due a refund and how to provide your bank details.

GOV.UK's list includes a letter about a Self Assessment repayment claim. It says you may get a letter asking you to contact HMRC about your claim, that HMRC may ask for more information to verify the claim, and that you must respond so HMRC can make any repayments owed to you as soon as possible.

GOV.UK's list includes letter OCA300, which tells you a repayment of student loan deductions is due, with details of why and of the employer you worked with at the time. It says HMRC will ask for personal information to allow a faster repayment, and that you can contact the Income Tax general enquiry helpline to confirm the request.

Letters that sound alarming

GOV.UK's list includes letter IDMS99, which HMRC sends to tell you its records show a payment is overdue. It says the letter tells you how to pay.

GOV.UK's list includes a letter warning of possible involvement in tax avoidance. HMRC sends it when its systems show you may be using, or have used, employment arrangements that involve tax avoidance, or when HMRC publishes information about tax avoidance arrangements and the people involved in supplying and marketing them.

GOV.UK's list includes letter VPCF1, which HMRC may send as part of its VAT registration security procedures if it believes a business is not eligible to be registered for VAT. The letter advises of HMRC's intention to deregister the business, and HMRC says it will let you know what information and documents to provide.

GOV.UK's list includes a Self Assessment repayment claim and criteria review letter, which HMRC sends if it believes you do not meet the criteria for submitting a Self Assessment tax return. It asks you, if you disagree, to contact HMRC within 30 days using the phone number given on the letter, to explain why you meet the Self Assessment criteria and to provide evidence if requested.

One-to-many letters and texts

GOV.UK says HMRC may write or text asking you to check whether the High Income Child Benefit Charge applies: a charge may apply if you or your partner receive Child Benefit and either of you has an adjusted net income of £60,000 or more, and a charge due can be paid through your tax code or a Self Assessment return. GOV.UK says HMRC's letters and texts asking people to check the High Income Child Benefit Charge will not ask for any personal or financial information.

GOV.UK says that if you have traded in cryptoassets, HMRC may contact you by letter, email or text message, and that a text message will direct you to guidance on GOV.UK.

GOV.UK publishes what one campaign's letters say happens without a reply: for its 2026 letters to companies about Marginal Relief, HMRC says that if you do not respond, it may take further action, including opening a compliance check.

If you think the letter is fake

GOV.UK's examples page says to report scam contacts even if you get the same or similar ones often, and not to open attachments or click any links in an unexpected email or text message.

GOV.UK says some websites, emails or phone numbers look like they are part of an official government service when they are not, and says to search GOV.UK to find official government services and phone numbers.

• GOV.UK: Report scam HMRC messages, calls and social media accountsGOV.UK lists how to report suspicious HMRC emails, texts, phone calls, social media accounts and letters: texts to 60599, emails to [email protected], and for a letter, the HMRC team the letter says it is from.
• GOV.UK: Contact HMRCGOV.UK's Contact HMRC page gives contact details by subject, including Self Assessment, Income Tax, National Insurance, VAT and Child Benefit, and has a route for contact from HMRC that you think might not be genuine. It says you will usually have the option to contact HMRC through an online form, webchat, by phone or by post.

If you have already replied or paid

Your bank

GOV.UK says to contact your bank immediately if you have recently transferred funds to a third party and believe you have been scammed.

Report Fraud and Police Scotland

If you have been the victim of a scam and lost money, GOV.UK says to report it to Report Fraud through its website, or to Police Scotland on 101 if you live in Scotland.

GOV.UK's page on internet scams says that if you think you have lost money or been hacked because of an online scam or fraud and you are in England or Wales, you can contact Report Fraud online, with an account or as a guest, or by phone on 0300 123 2040, and that in Scotland you report the crime to Police Scotland.

HMRC's security team

GOV.UK says that if you have already shared personal details, you can report the disclosure of personal information to the HMRC security team.

If you think you have given personal information in reply to a suspicious email or text, contact the HMRC security team at [email protected].

When you tell the HMRC security team what you gave away, GOV.UK says to include brief details of what you disclosed, for example a name, address, HMRC User ID or password, but not to give your personal details in the email.

Sign-in codes you did not ask for

GOV.UK says that if you get HMRC sign in codes by text or voice call when you are not trying to sign in, it may mean someone has your sign in details, and that it would be sensible to change your password.

Support

GOV.UK says that if you have been a victim of an online scam, you can contact Victim Support by phone on 08 08 16 89 111.

Check a letter on this site

• Letter checkerPaste your letter for a plain-English identification. Your letter is read here and is not kept.
• Scam checkCheck through HMRC's own lists, not the letter.
• Spot the FakeA short game to practise telling a fake from a real one.

If it turns out to be real

For letters on its list, GOV.UK's entries say what the letter asks you to do, for example to complete the online form, to complete and post the paper form attached to the letter, or to contact HMRC using the telephone number at the top of the letter.

If you ignore a real letter

In its entries for the overdue payment letters IDMS99 and IDMS99P, and for the letter warning of possible involvement in tax avoidance, GOV.UK says you must not ignore the letter. For the overdue payment letters it says the letter explains what happens if you do not pay or call within 28 days of receiving it. GOV.UK's list also says what follows if two other letters are not answered. For the VAT registration letter, VPCF1, HMRC will deregister the business from VAT if the information it asks for is not sent within 30 days. For the Self Assessment repayment claim and criteria review letter, if you do not contact HMRC within 30 days, HMRC will not process your return, issue a repayment of income tax to you or send you a notice to file a Self Assessment tax return in future.

If you want to ask an adviser

• Is my letter on HMRC's list of letters, and under which code or subject?
• If it is not listed, which other HMRC list or contact route should I use to check it?
• Which HMRC team should I contact about this letter, and by which route?
• If I have replied to a letter I now doubt, what should I tell my bank and HMRC's security team?
• If the real letter asks for a reply by a date, what happens under HMRC's rules if I reply late?

Quick answers