We are sharing this update from ACCA, our professional body, for the interest of clients and contacts. The content is (c) ACCA. Note some of this content is specifically aimed at Accountancy Practices, but we’re sharing it as the principles are of wider application.
How to identify fraudulent HMRC communications
In recent years, HMRC scams have become increasingly prevalent, with scammers employing various methods such as phone calls, emails, text messages and even WhatsApp to deceive individuals into providing personal information, transferring money, or inadvertently downloading spyware and other malicious software.
During peak periods, such as the self-assessment tax return deadline, accountants may be busier and hurrying to meet deadlines. This sense of urgency can sometimes make it easier for scammers to exploit individuals who are less vigilant or rushed.
Latest scam text message: what to look out for
Several ACCA members have highlighted a text message shown below purportedly from HMRC asking for confirmation of their Agent Services Account. The sender appears as ‘TaxGateway’, and the message reads:
AGENT SERVICES CONFIRMATION REQUIRED
The message often includes a link that looks very similar to what you would expect from a legitimate HMRC communication. However, there’s a subtle but crucial error in the link that should raise alarms:
https://government-gateway.qov.com.es/login-signin-cred-agents/?id=xxxxxx
Notice that the domain ‘gov’ has been incorrectly replaced with ‘qov’ – this is a clear indication that the link is fraudulent. Scammers frequently use slight variations in spelling to trick individuals into clicking on dangerous links.
Always check the spelling of any link carefully before you click on it. A small error in the domain, like ‘qov’ instead of ‘gov’ is often a red flag.
A further indication of a false link is the use of the domain ‘.com.es’ which would point to a Spanish domain rather that UK.
If you receive this or a similar text message or email, do not click on any links. Instead, report it to HMRC and delete the message immediately.
Other red flags to watch out for
In addition to fraudulent text messages like the one mentioned above, there are several other warning signs to help you identify scams. Here’s a checklist of things to look out for when receiving unsolicited phone calls, emails, or text messages that claim to be from HMRC:
- rushes you: scammers often create a sense of urgency to pressure you into acting quickly. If the message or call is rushing you to act without giving you time to think, it’s likely a scam
- threatens legal action: fraudulent communications may threaten severe consequences, such as arrest or legal action, to make you panic and take hasty decisions
- is unexpected: be cautious if you receive communication from HMRC that you weren’t expecting. Official HMRC correspondence typically arrives through channels that you are familiar with
- asks for personal information: legitimate HMRC communications will never ask for sensitive personal information, such as bank account details or personal identification numbers (PINs)
- tells you to transfer money: any message asking you to transfer money or make urgent payments should be considered suspicious
- offers a refund, tax rebate, or grant: fraudsters often try to lure victims by promising tax refunds or grants in exchange for personal information or payments.
How to deal with suspicious phone calls
If you receive a suspicious phone call that seems to be from HMRC, remember that:
- HMRC will never leave a voicemail threatening legal action or arrest
- HMRC will never ask for immediate payment over the phone.
If you receive such a call, do not engage and hang up. You can verify any concerns directly by contacting HMRC using their official contact details.
What to do if you receive a scam text message
If you receive a suspicious text message, it’s important to take the following steps:
- do not click on any links in the message
- do not reply to the text with any personal information
- report it: Forward the text message to 60599 (network charges may apply) or email phishing@hmrc.gov.uk
- delete the message: After reporting, delete the message from your phone.
WhatsApp messages from HMRC
If you’ve subscribed to the UK Government Channel on WhatsApp, you may receive occasional tax-related updates. However, HMRC will only send one-way alerts –you will not be able to reply to these messages. Be cautious if you receive unsolicited messages asking for personal information via WhatsApp, as these are likely scams.
QR codes in HMRC communications
HMRC occasionally uses QR codes in its correspondence to direct you to useful information on GOV.UK. However:
- never input personal information after scanning a QR code
- if you’re logged into your HMRC account, QR codes may take you to your bank’s login page, but only after you’ve logged in.
Be cautious if you receive emails or texts with QR codes asking for personal details. If this happens, report the email or text to phishing@hmrc.gov.uk
Gift or payment vouchers
HMRC will never ask you to pay with gift or payment vouchers. If you receive such a request, it is a clear sign that you are dealing with a scam.
If you have already shared personal information
If you believe you’ve already shared personal information with a scammer, it’s important to take immediate action:
- report the disclosure to HMRC’s security team
- if you’ve suffered financial loss, report it to Action Fraud or Police Scotland by calling 101 (if you live in Scotland).
Below are some recent resources we have previously highlighted that will be helpful and should be cascaded through to all your team, if applicable.