HMRC have updated their guidance on checking if the letter you have received is genuinely from them and not a scam.
Sadly it’s nothing new that fraudsters are using HMRC to exploit people’s financial anxieties to obtain sensitive personal and banking details.
Communications often appear legitimate, displaying official HMRC branding and contact information.
Last updated 28 August 2025 HMRC has provided a list of letters that they send covering a range of tax topics to help taxpayers decide if they are being targeted with a postal scam.
Included in HMRC’s update are app leaflets which have QR codes leading you to further information on subjects like child benefit.
During the period ending 31 July 2025, HMRC documented over 170,000 fraudulent incidents, with more than 47,000 involving bogus tax refund claims.
They often try and create urgency to prompt hasty responses from recipients and can occur throughout the tax year not just at busy tax times in January and April.
In addition to letters through the post they use robocalls that can manipulate phone displays to show HMRC as the caller identity.
Emails are also common which direct recipients to follow links and enter credentials to either process payments or receive reimbursements.
HMRC emphasises that it never initiates contact through these channels regarding refund claims or personal information requests, nor does it send voicemail messages threatening arrest or legal proceedings.
The guidance published gives a list of letters that they regularly send with their specific meaning so you can cross reference anything you receive.
Example letters from HMRC
HMRC can send out letters to employed individuals under PAYE for a range of reasons and produces informational leaflets including QR codes.
Some common examples are:
Simple assessment Letter IDMS99P
If you have received a simple assessment letter reference IDMS99P it means that you not paid enough tax.
Simple assessment letters are issued to individuals who are not registered for Self-Assessment, as well as those who either lack a PAYE tax code or cannot have automatic tax deductions processed through that system.
A simple assessment letter clearly outlines what individuals must do and includes details about the amount of tax payable, the payment deadline (typically by the following 31 January), payment methods, and guidance on how to challenge the assessment if they dispute it.
Tax code notice letter P2
A form P2 is an HMRC tax code notification letter which typically arrives when a new tax year begins.
It specifies your assigned tax code and provides detailed explanations for why you’ve received that specific PAYE coding notice.
A P2 details tax allowances, tax reliefs and underpayments of tax collected through your tax code.
HMRC can include a QR code in their P2 letters which takes you to further information about tax codes.
Self assessment – if you are due a tax refund
Taxpayers who submit a tax return and have overpaid tax can be sent a letter requesting that you contact HMRC to complete the repayment process.
HMRC states: “If you receive further requests for information to be sent to an email address that does not end in ‘hmrc.gov.uk’, they will not be genuine and you should report this to HMRC.”
Child benefit leaflet
Hospitals receive informational leaflets from HMRC to guide new parents on accessing child benefit after birth registration.
Parents can access child benefit guidelines and how to claim details through the QR-coded leaflets.
HMRC provides a comprehensive list of legitimate contact reasons and methods that can be referenced. Review this information carefully to identify the authentic characteristics of legitimate HMRC communication.
What to do if you are unsure
Receiving a notification from HMRC about a discrepancy in your tax records or payments might not immediately raise any suspicions or concerns.
Both of these scenarios typically present urgent deadlines for action, which can create a sense of pressure and urgency for the recipient.
Unfortunately, this is a perfect scenario for fraudsters to exploit people’s financial anxieties and uncertainties to obtain sensitive personal and banking details.
If you are unsure of the validity of what you have received verification before taking any action is key.
Using your personal tax account (PTA) or the HMRC app is a quick way to check what you have been sent through the post.
Both options should reflect the same information you have been sent in your letter from HMRC.
If you encounter any suspicious letters or messages, it is important to alert HMRC. You can forward questionable emails to [email protected] and texts to 60599.
