Is This HMRC Text Genuine? UK Tax Scam Check 2026/27

If you receive a text saying that HMRC owes you a refund, wants your bank details or will take action unless you pay immediately, do not use the message link or reply with personal information. Check the wording against HMRC's current genuine-message guidance and open GOV.UK by typing the address yourself or using your existing HMRC account.

HMRC does send some text messages. A genuine message may confirm a claim, form, complaint, penalty appeal or refund request, and some current campaigns use more than one communication method. The key boundary is that HMRC says it will not ask for personal or financial information in a text message. A message offering a tax refund in exchange for those details is a phishing warning sign.

The fastest way to check an HMRC text

Use this sequence before taking action:

1. Stop. Do not click the link, scan a QR code or call the number in the message.
2. Read the request. HMRC's current text guidance says it will not ask for personal or financial information by text. Treat requests for card details, bank login information, passwords, one-time codes or a payment as a warning sign.
3. Check the official list. Compare the message with HMRC's live page of genuine text messages and contacts. Look for the relevant subject, such as a Self Assessment refund, P800 refund, complaint, penalty appeal or debt-recovery contact.
4. Open HMRC separately. Type gov.uk into the browser or sign in through the HMRC app or Personal Tax Account you already use. Do not rely on the link supplied in the SMS.
5. Report and delete. Forward a suspicious text to 60599, then delete it. HMRC also publishes reporting routes for suspicious emails, calls and social-media accounts.

What genuine HMRC texts may cover

The existence of an HMRC text does not automatically mean it is a scam. The current guidance lists several genuine situations, including:

HMRC's separate multi-channel contact page says it may use a letter first and then follow up by email, phone or text for some listed activities. That context is useful, but a familiar subject line still does not make a message safe: verify it through the official page or your account.

September 2026 international debt messages

HMRC's text-message guidance was updated on 18 September 2026. It says that from 21 September 2026 through 19 March 2027, HMRC may contact international debt customers by text when a payment has not been received. The message may tell the recipient to check their online account and search GOV.UK for “non-resident payment enquiries”.

That is a genuine published scenario, not a blank cheque for every message using the words “international debt”. Do not disclose details or pay from the SMS. Sign in through the official HMRC route and compare the account, letter and payment history.

Common tax-refund scam signals

HMRC's scam checklist identifies messages that are unexpected, rushed or threatening, ask for bank information, tell you to transfer money, or offer a refund, rebate or grant. Be especially careful when a message:

• uses a shortened or unfamiliar web address;
• says your refund expires today;
• asks for a card number, online-banking password or security code;
• asks you to install an app or share your screen;
• threatens arrest, court action or account closure without giving you time to verify it; or
• tells you to keep the conversation secret.

Do not assume that correct spelling, the HMRC logo or the sender name proves authenticity. Sender names can be imitated, and a scammer may know enough public information to make a message sound plausible.

A safe decision tree for an unexpected message

Separate the message into four questions: is the subject plausible, is the contact channel genuine, is there a matching official account record, and have you already disclosed anything? A real tax event does not make an SMS safe. A false message can mention a genuine refund, deadline or payment arrangement and still direct you to a fraudulent page.

If you have not clicked, preserve the sender number, wording, time and screenshot, then open GOV.UK separately. Look for the relevant HMRC service or sign in to the Personal Tax Account. If the account shows no matching notice, do not continue through the message. Report it through the current HMRC route and delete it after the evidence is preserved.

If you clicked but entered nothing, close the page and do not download software or approve a notification. Check browser downloads and device security using trusted tools. If you entered a password, change it through the official service and anywhere else it was reused. If you entered bank, card or authentication information, contact the bank immediately and explain exactly what was disclosed.

If money has left the account, the bank call takes priority. Use the number on the card or the bank's independently typed website, not the SMS. Ask what can be stopped, recalled or secured. Keep the payment reference and do not pay a second amount to someone promising to recover the first payment.

Genuine HMRC contact still needs independent verification

HMRC's published genuine-message list can change. A message may be genuine but not appear in an older screenshot, or a scam may copy a current subject. Use the live HMRC guidance and the official account rather than a social-media post, search advert or forwarded message. The safest habit is to navigate independently for every refund, payment and account-security request.

Some messages refer to a letter, complaint, penalty appeal or debt record. Find that record in the account or locate the letter through your own files. Compare the tax year, amount, reference and action requested. A mismatch is a reason to stop and contact HMRC through GOV.UK. A match is still not permission to use an SMS payment link; make the payment only in the official service or through the method printed in verified correspondence.

HMRC will not need your online-banking password, full card number, one-time bank code or remote access to verify a refund. It may need information through an authenticated service or a formal process, but the route matters. Never read a security code to someone who contacted you unexpectedly, even if they know your name, address or part of a tax reference.

Keep a short incident record

Record the message, sender, link without opening it, date, screenshots, action taken, bank contact, HMRC report and any account changes. Do not forward the scam widely because another person may tap the link. Send it through the official reporting route and warn family or colleagues using a description rather than the live URL.

If the message concerns an employer, agency, accountant or family member, tell them through a separate known channel. A compromised mailbox or phone can make a second message appear to confirm the first. Check the account owner and the person who actually needs to act. Keep the incident record with the relevant tax documents, but do not store passwords, seed phrases or full card details in it.

Review the account again after a few days for changed bank details, new payment instructions, unfamiliar contact information or unexpected sign-ins. If the device was compromised, use a trusted device for password changes and account checks. Continue to distrust unsolicited follow-up calls claiming to be HMRC, the bank or a recovery service.

Frequently Asked Questions

Keep the official page open in a separate tab and use its wording, dates and reporting route as the current reference; scam campaigns and genuine-message lists can change.

Why a genuine subject can still be a fake message

Fraudulent messages often borrow a real HMRC topic. A tax return deadline, a payment arrangement, a refund, a tax-code change or a new government support scheme may all exist, but the text itself may still be fake. Check the event separately from the message. Search GOV.UK using your own browser, open the relevant service, and look for the same task in your account. If the official account contains no matching notice, treat the text as unverified.

Never provide a one-time passcode, banking password, full card details or remote access because a message says the request is urgent. HMRC may use a limited set of genuine contact methods, but it does not need security credentials in an SMS. A genuine-looking logo, a familiar sender name, or a link that redirects through several domains is not proof. Take a screenshot, report it through the current HMRC route and delete it only after preserving the evidence.

If you are unsure, ask a trusted person to read the message without opening the link, or contact HMRC using a number found independently on GOV.UK. Do not use a search-result advert or the contact details printed in an unexpected message. If money or credentials have already been exposed, the bank and account-security steps come before investigating whether the original message was genuine.

What to do after a successful payment or account takeover

If you paid through a scam link, call the bank or card issuer immediately and explain that the payment may be fraudulent. Ask what protective action is available, including stopping a transfer, replacing a card or securing online banking. Do not call a number in the text. If you gave away an authentication code, say so explicitly because it changes the bank's risk assessment.

If you entered an HMRC password or reused it elsewhere, change it from the official service and change the reused password on other accounts. Review recent account activity, payment details, contact information and sign-in alerts. Remove any unfamiliar device or payment instruction. If a scammer installed remote-access software, disconnect the device from the internet and obtain trusted technical help before signing in again.

Keep the message, web address, phone number, payment reference and a short chronology. Report the message using HMRC's current route and report financial fraud through the appropriate UK channel. A report does not guarantee recovery, but the evidence can help the bank, HMRC and law enforcement connect related campaigns. Continue to verify any later “recovery” offer independently; victims are often targeted again by people claiming they can retrieve the money.

A verification routine for messages that look plausible

Scammers often use a genuine tax event as the subject of a false message. A Self Assessment deadline, an energy-support payment or an HMRC debt letter may be real, but that does not make the text genuine. Treat the subject and the contact channel as separate questions. Look up the relevant service on GOV.UK, sign in through a saved or freshly typed official address, and check whether the same issue appears in your account or correspondence.

Do not let the sender control the pace. Save a screenshot and the sender details, but do not tap the link to investigate it. Check the web address character by character if a browser was opened, and close the page if it asks for card details, online-banking credentials, a security code, remote access or a payment to release a refund. HMRC may use limited text scenarios, but it does not need your banking password or one-time authentication code by SMS.

If a message refers to a debt, compare the amount and reference with the official account and any letter. If they do not match, call HMRC using the contact details found independently on GOV.UK. If they do match, still pay only through the official service. Keep the message and report it after protecting your account; reporting helps identify campaigns but does not turn an unsafe link into a safe one.

Official sources

• Check if a text message from HMRC is genuine
• Report suspicious HMRC contact
• HMRC security guidance

Use HMRC's live genuine text-message checklist and suspicious-contact reporting page before responding to any tax-related SMS.

Official sources

• HMRC — Check if a text message is genuine — genuine HMRC text scenarios and limits.
• HMRC — Identify tax scam calls, emails and texts — scam warning signs.
• HMRC — Check genuine contact using more than one method — multi-channel verification.
• HMRC — Report suspicious HMRC contact — current reporting routes.
• HMRC — Report suspicious emails and messages — reporting guidance.
• HMRC — Report fraud and phishing — account and fraud response.

This guide is general educational information for UK HMRC contact checks in 2026/27. Scam campaigns and genuine-message lists can change. Use the current official HMRC guidance, your bank's verified contact route and your authenticated HMRC account before acting. It is not confirmation that a message, refund or tax bill is genuine.