Fake HMRC Refund Text Scam: How It Works, How to Check Safely and How to Report It

"You are owed a tax refund of £286.40. Claim within 24 hours." It is a small amount, a short deadline, and a link that looks vaguely official. If you pay tax in the UK, the idea that you might be owed some back is believable. That is exactly why fake HMRC refund texts are one of the most common scams people report.

How fake HMRC refund text scams work

This is phishing by text message, often called smishing. The text is cheap to send in bulk, and the message is designed to feel like good news.

1. The bait. A text says HMRC has calculated that you are owed a refund, or that your rebate is pending.
2. The pressure. There is a deadline, such as "within 24 hours," or a warning that the refund will expire.
3. The link. The link opens a page that copies the look of a government site and asks for your name, address, date of birth, and card or bank details, sometimes followed by a code sent to your phone.
4. The theft. The details go to the scammer, who uses them to take money, open accounts in your name, or call you pretending to be your bank.

The same scam on other channels

The important detail: HMRC does send some texts

Many older guides say HMRC never sends refund texts at all. That is no longer the full picture. GOV.UK now publishes a list of genuine HMRC text messages, and it is updated often. What matters is not whether a text exists, but what it asks you to do.

GOV.UK also says some customers may receive branded messages that show HM Revenue and Customs as the sender with the HMRC logo and verified sender information. Because sender names can still be faked on some devices, the safest test is the content: a refund text should never ask you to tap a link or hand over details. Check the current list on the GOV.UK page for genuine HMRC texts, because it changes.

Warning signs of a fake HMRC refund text

• It contains a link to "claim" a refund or "verify your identity."
• It asks for bank details, card numbers, a PIN, a password, or a code sent to your phone.
• It sets a short deadline, such as 24 hours, or says the refund will expire.
• You were not expecting a refund, and you have not requested one or received a letter.
• The web address is not on gov.uk, or "gov.uk" appears inside a longer address such as gov-uk-refund.co.uk.
• It comes from an ordinary mobile number or from a sender name that cannot be checked.
• The wording is vague or oddly worded, with a round or attractive amount.
• It threatens consequences, such as penalties or legal action, if you do not act now.
• A follow-up call says it is from your bank and asks you to move money to a "safe account."

How to check a suspicious link

The best check is not to tap it. If you want to understand a link, follow these steps without opening it.

1. Find the domain. It is the part right after https:// and before the first single /. In https://gov.uk.refund-claim.com/start, the real site is refund-claim.com, not GOV.UK.
2. Read the ending first. A genuine government service uses an address that ends in gov.uk. Words placed before a different ending do not turn that site into GOV.UK.
3. Watch for tricks: extra words ("refund," "claim," "tax"), hyphens, swapped letters, or endings such as .co.uk, .com or .org.uk with a government-sounding name.
4. Do not trust the padlock. https only means the connection is encrypted. Fake pages can have it too.
5. Be wary of shortened links such as bit.ly, which hide the destination.
6. Remember the bigger rule. Even a link that looks correct should not be in a refund text that asks for your details. Type the address yourself instead.

Try the link red-flag scanner

Paste a link you received. The tool reads the address only. It does not open the link, and nothing you paste leaves your browser.

Realistic examples

These are composite examples written to show the pattern. They are not reports about real people.

How to verify a tax refund message safely

You can check any "refund" message without touching the link in it.

1. Do not tap, reply, or call any number in the message.
2. Ask yourself: have I requested a refund, or received a letter from HMRC about one? If not, treat the message as suspicious.
3. Go to HMRC yourself. Type gov.uk into your browser, or open the HMRC app, and sign in to your HMRC online account. Your account shows what HMRC holds for you.
4. Compare with GOV.UK's lists. Check the genuine text messages page and HMRC's list of genuine contacts.
5. Use only contact details published on GOV.UK if you need to speak to HMRC. If a caller is pushing you, hang up and call back on a number you found yourself.
6. Learn the real route to a refund. GOV.UK explains how to claim a refund if you are due one. It never involves a link in a message.
7. Ask someone you trust, or your accountant, if you are still unsure.

Prevention tips

• Save the HMRC app or the GOV.UK address on your phone, so checking your account is quick and does not need a message.
• Never share your Government Gateway user ID, password, or one-time codes with anyone.
• Use a unique password for your HMRC account, and turn on extra security if offered.
• Be wary at busy tax times, such as around Self Assessment deadlines, when scammers expect you to be looking for HMRC messages.
• Do not reply to suspicious texts, even to say "stop," as that tells the sender your number is active.
• Block the number after you report the text.
• Tell family members, especially older relatives, that HMRC does not text people links to claim refunds.
• If a caller says they are from your bank, hang up and call back using the number on your card or by dialling 159.

How to report a suspicious HMRC text

Reporting helps HMRC and other agencies take scam sites and numbers down. It takes less than a minute.

1. Forward the text to 60599. GOV.UK says to forward suspicious texts to 60599 (network charges apply), or to email phishing@hmrc.gov.uk, and then delete them.
2. Forward it to 7726 as well, if you want to alert your mobile network to the scam number.
3. Report scam emails by forwarding them to phishing@hmrc.gov.uk, and to report@phishing.gov.uk, the National Cyber Security Centre's reporting address.
4. Report scam calls and other contact using the HMRC reporting page on GOV.UK.
5. See the NCSC's page on reporting a scam text message for more detail.

What to do if you have been scammed

If you tapped the link or shared details, act quickly. This happens to careful people, and there is no need to feel embarrassed.

If you only tapped the link

1. Close the page and do not enter anything.
2. Report and delete the text as above.
3. If you downloaded anything, run a security scan, and change your passwords if you are unsure what you typed.

If you entered bank or card details

1. Call your bank immediately on the number on your card, or dial 159, and ask them to secure your accounts and cards.
2. Do not move money to a "safe account" for anyone who calls you, however convincing they sound.
3. Report the fraud to Report Fraud (formerly Action Fraud) on 0300 123 2040. In Scotland, you can also contact Police Scotland on 101.
4. Check your accounts and credit report for activity you do not recognise.

If you shared your HMRC or Government Gateway login

1. Change your password from the official GOV.UK sign-in page, which you reach by typing the address yourself.
2. Report the contact to HMRC using the reporting page on GOV.UK, and check your online account for changes you do not recognise.

Be wary of anyone who contacts you afterwards offering to recover your money for a fee. That is a common second scam. If you need support after a scam, ask your bank and people you trust for help.

Conclusion

The fake HMRC refund text works because a refund sounds like good news, and because HMRC does send some real texts. The safe habit is simple. A refund message should never need you to tap a link or hand over bank details. Check your own HMRC account by typing gov.uk or using the HMRC app, forward the scam to 60599, and move on.

The same tricks appear in other scams. Read our guides on the fake digital identity verification link scam, the fake QR code verification scam, and the fake AI customer support chat scam. Our earlier guide on fake income tax refund messages covers India, so use the UK contacts above if you are in the UK.

Got a text you are unsure about? Paste it into our free checker for a quick first read.

Frequently asked questions