It is a mistake to assume that the criminals behind fake HMRC communications are operating a haphazard, scatter gun operation. They are sophisticated enough to mimic HMRC language and use their logos to create convincing phishing emails, voicemails and text messages. So they are also very able to plan their scams around the tax calendar.
What is the current scam?
As HMRC are in the middle of processing end-of-year tax refunds, the content of scam communications has changed accordingly. Phishing emails are being sent to unsuspecting individuals requesting bank details in order to pay in an income tax refund. As it is the time of year that you may be expecting some overpaid tax back, this adds a layer of legitimacy.
It’s clever and devastating to anyone who is victimised by these fraudsters. Clicking on any of the links enables them to ‘fish for’ (hence, ‘phishing’) and steal personal and financial details from your computer.
How many phishing reports do HMRC get?
In just one month, HMRC got 84,549 phishing reports. This was March this year and resulted in HMRC being able to ask for 2,672 criminal websites to be taken down. This number is set to rise as the period for refunding overpaid tax continues for a few more months.
Is it only emails I need to worry about?
You might receive emails, voicemails, phone calls or SMS messages that claim to be from HMRC. And they’re not always asking for your bank details to give you a tax refund. Some play on the fear factor of saying that you owe HMRC taxes. Accountants and tax advisers do get calls from terrified clients, saying that the police are being sent round because an arrest warrant has been issued if they don’t pay their tax bill immediately. Sometimes they just say that there are unspecified debts in your name and want payment in iTunes voucher codes.
What are the government doing about this?
The Financial Secretary to the Treasury, Mel Stride MP, said: “HMRC only informs you about tax refunds through the post or through your pay via your employer. All emails, text messages, or voicemail messages saying you have a tax refund are a scam. Do not click on any links in these messages and forward them to HMRC’s phishing email address and phone number.
“We know that criminals will try and use events like the end of the financial year, the self-assessment deadline, and the issuing of tax refunds to target the public and attempt to get them to reveal their personal data. It is important to be alert to the danger.”
The government are aware of the situation, are warning the public to stay safe against this cyber crime and are using phishing reports to close down these criminal websites.
What should I do about this?
You need to protect yourself with information and common sense. Financial institutions and HMRC will never randomly get in touch to ask you for bank details, personal information, passwords or PIN numbers (including your own bank). Tax refunds are only paid through the PAYE system (your pay from your employer) or by post. Everything else is a scam; all texts, voicemails, emails and phone calls to do with tax refunds are fake.
Do not give out any personal or financial information. Do not click on any links or attachments in emails or message. Do not reply to any texts. Then report it to HMRC’s fraud team here, and Action Fraud. Even if you haven’t lost any money or given any details, you should report it. Every report is useful evidence against the criminals. So don’t just delete, forward it first and help put a stop to this fraud.
