HMRC Self Assessment Scam Warning: What’s New for 2026 and How to Stay Safe
HMRC has received over 135,500 reports of suspected scams in the ten months since February 2025, including nearly 4,800 targeting Self Assessment customers directly and around 29,000 fake tax refund claims. What’s changed for 2026 isn’t just the volume — it’s the method. Alongside the familiar fake refund text, fraudsters are now running WhatsApp impersonation campaigns, using AI-generated voice calls convincing enough to sound genuinely official, and sending fake letters with QR codes that lead straight to a fraudulent login page.
This guide covers the current scale of the problem, the newer scam tactics most guidance hasn’t caught up with, exactly what HMRC will and won’t do, and how to report a scam if you spot one.
Quick Answer
HMRC will never contact you by text, email, or WhatsApp message to offer a tax refund or demand urgent payment, and will never leave a voicemail threatening arrest or legal action. Genuine refunds are claimed only through your HMRC online account or the official HMRC app — never through a link in a message. Scam reports have stayed stubbornly high through the run-up to the 31 January 2026 deadline, and 2026 has brought newer tactics — WhatsApp impersonation, AI-generated voice calls, and QR codes in fake letters — on top of the classic phishing text and phone threat. Filing your return early reduces your exposure, since scammers deliberately target the anxious final weeks before the deadline.
Key Takeaways
- HMRC received over 135,500 scam reports in the ten months to December 2025, including 4,800 Self Assessment-specific reports and 29,000 fake refund claims.
- New for 2026: WhatsApp impersonation, AI-generated voice call scams, and QR codes in fake letters or emails — HMRC has an official WhatsApp channel, but it’s one-way broadcast only and never messages about your personal tax account.
- HMRC will never ask for passwords or personal banking details by text, email, or phone, and will never say it’s “safe” to share them with anyone, including someone helping with your tax affairs.
- Filing early genuinely reduces risk — once you’ve already submitted, a fake “urgent” message closer to the deadline is far easier to recognise as bogus.
- Report suspicious emails to phishing@hmrc.gov.uk and suspicious texts by forwarding to 60599.
- HMRC has closed almost 25,000 fake websites and phone numbers in the same ten-month period — a sign of how large-scale this activity has become.
Table of Contents
- The Scale of the Problem
- New for 2026: WhatsApp, AI Voice Calls and QR Codes
- What HMRC Will Never Do
- The Classic Scam Tactics Still Doing the Rounds
- How to Verify Genuine HMRC Contact
- How to Report a Scam
- Why Filing Early Reduces Your Risk
- A Worked Example: How a Scam Typically Unfolds
- Common Mistakes People Make
- Accountant Insights: What We See in Practice
- What to Do If You Think You’ve Been Scammed
- Checklists
- FAQs
- Sources
- Final Thoughts
The Scale of the Problem
Between February and December 2025, HMRC logged more than 135,500 reports of suspected scam contact — a figure that includes roughly 4,800 reports specifically tied to Self Assessment and around 29,000 fake tax refund claims. HMRC has also shut down nearly 25,000 fraudulent websites and phone numbers impersonating the department in the same window. Reported volumes have stayed roughly flat to slightly down year-on-year rather than sharply rising, but the absolute scale — well over ten thousand reports a month on average — means this remains one of the most common forms of fraud UK taxpayers encounter, and activity reliably intensifies as the 31 January deadline approaches, when people expect genuine HMRC contact and are more likely to lower their guard.
New for 2026: WhatsApp, AI Voice Calls and QR Codes
Older scam-awareness guidance tends to stop at fake texts and phishing emails — but three newer tactics have become common enough in 2026 to need calling out specifically.
WhatsApp impersonation. HMRC does operate an official WhatsApp channel, but it’s a one-way broadcast subscription for general updates — it will never message you directly about a penalty, a refund, or your personal tax account. Scam messages typically arrive from a number with a convincing display name, sometimes paired with an HMRC-style profile picture, claiming a penalty or refund is due and pushing a link or callback number.
AI-generated voice calls. Increasingly sophisticated, AI-generated calls can now sound genuinely official, using pressure tactics — an urgent unpaid tax bill, a threat of imminent enforcement action — to panic the recipient into acting before they’ve had time to check whether the call is real.
QR codes in fake letters and emails. A newer twist on classic phishing: a QR code embedded in a letter or email directs your phone straight to a convincing fake login page designed to harvest your Government Gateway or HMRC online account details. The safest approach is never scanning a QR code from an unexpected message — type gov.uk directly into your browser instead.
What HMRC Will Never Do
Genuine refunds are only ever claimed through your own HMRC online account or the official HMRC app, using your own secure login — never through a link sent to you.
The Classic Scam Tactics Still Doing the Rounds
Alongside the newer methods, the long-running favourites remain common: phishing emails and texts offering a fake tax rebate, usually linking to a convincing but fraudulent login page; phone calls and voicemails claiming unpaid tax is owed, often threatening arrest or bailiff action if you don’t pay immediately; and messages asking for banking details under the guise of processing a refund or resolving an issue. All of them rely on the same core mechanic — creating urgency so you act before checking whether the contact is genuine.
How to Verify Genuine HMRC Contact
If you receive a message or call claiming to be from HMRC and you’re not sure, don’t click any link, don’t call any number given in the message, and don’t reply. Instead, log into your HMRC online account or the HMRC app directly — typing gov.uk into your browser yourself rather than following a link — to check your actual tax position independently. Search “HMRC scams advice” on GOV.UK for the current list of known scam formats, which HMRC updates as new tactics emerge.
How to Report a Scam
Suspicious emails claiming to be from HMRC can be forwarded to phishing@hmrc.gov.uk. Suspicious texts can be forwarded free of charge to 60599. Suspicious phone calls or WhatsApp messages can be reported through HMRC’s suspicious contact reporting form on GOV.UK. Reporting doesn’t just protect you — it feeds directly into HMRC’s ongoing effort to identify and close down fraudulent websites and numbers, which has already removed nearly 25,000 in the past ten months.
Why Filing Early Reduces Your Risk
HMRC’s own advice, and independent commentary from personal finance specialists, converges on one practical point: filing your Self Assessment return well before the 31 January deadline genuinely reduces how vulnerable you are. Once your return is already submitted, a message claiming you urgently need to act on your tax affairs is far easier to recognise as suspicious, since you know your filing is already done. Scammers deliberately target the final stressful weeks before the deadline precisely because last-minute filers are more likely to act on impulse under pressure.
A Worked Example: How a Scam Typically Unfolds
Illustrative Example: Say you’ve just filed your Self Assessment return in mid-January. A few days later, a text arrives saying you’re due a £312 refund, with a link to “claim it now.” The message uses an HMRC-style sender name and looks convincing at a glance. Because the message arrives right after filing — exactly when a genuine communication might plausibly follow — it’s a moment scammers deliberately exploit. The safe response: don’t click the link. Log into your HMRC account directly to check whether any refund is genuinely due, and forward the text to 60599 to report it. If a refund is real, it will already be visible in your account without needing to follow any link.
Illustrative Example: A different scenario: an automated voicemail claims you owe £1,240 in unpaid tax and threatens bailiff action within 48 hours unless you call back immediately. The urgency and threat of imminent enforcement are themselves the giveaway — HMRC does not operate this way. Checking your actual tax position through your online account, rather than calling the number left in the voicemail, is the safe next step.
Common Mistakes People Make
1. Clicking a link in an unexpected “refund” message
Why it happens: A refund claim feels like good news, lowering natural suspicion.
Consequence: Landing on a fraudulent login page designed to harvest your HMRC account details.
How to avoid it: Always check your HMRC account directly rather than following a link in any message.
2. Panicking at a threatening voicemail and calling back immediately
Why it happens: Threats of arrest or bailiff action are designed to trigger an immediate, unthinking response.
Consequence: Providing personal or financial information to a scammer under pressure.
How to avoid it: Remember HMRC never leaves threatening voicemails — treat any such call as a scam by default.
3. Assuming a WhatsApp message from “HMRC” could be genuine
Why it happens: HMRC does have an official WhatsApp presence, so the channel itself feels plausible.
Consequence: Engaging with a scam that impersonates a real, if limited, official channel.
How to avoid it: Remember HMRC’s WhatsApp channel is one-way broadcast only — it never messages you individually about your tax account.
4. Scanning a QR code from an unexpected letter or email
Why it happens: QR codes feel like a normal, modern way to access information quickly.
Consequence: Being directed straight to a convincing fake login page.
How to avoid it: Type gov.uk into your browser directly instead of scanning a QR code from an unsolicited message.
5. Not reporting a scam attempt because nothing was lost
Why it happens: If you didn’t fall for it, it can feel unnecessary to report.
Consequence: HMRC has less data to identify and shut down the fraudulent website or number involved.
How to avoid it: Report every suspicious contact, even ones you correctly ignored.
Accountant Insights: What We See in Practice
- Clients who’ve already filed their return are noticeably less likely to fall for a scam message in the final weeks before the deadline, exactly as HMRC’s own advice suggests.
- The newer WhatsApp and AI-voice scam formats catch out even generally cautious people, since they don’t match the “obviously fake email” pattern most people have learned to spot.
- Genuine urgency from HMRC almost never arrives by voicemail or text — real communication about a serious issue typically comes through your online account or a formal letter, not a rushed phone threat.
- Clients who check their HMRC account directly, rather than engaging with the message at all, resolve any confusion fastest.
- Reporting scam attempts, even unsuccessful ones, is something we actively encourage clients to do — it’s a small action that measurably helps HMRC close down fraudulent operations.
What to Do If You Think You’ve Been Scammed
Step 1: Stop all contact immediately. Don’t reply, click further links, or call any number provided by the suspicious message.
Step 2: Check your HMRC account directly. Log in independently (typing gov.uk yourself) to see your actual tax position.
Step 3: If you’ve shared personal or financial details, contact your bank immediately. Report the compromise and follow their fraud procedures.
Step 4: Report the scam to HMRC. Forward emails to phishing@hmrc.gov.uk or texts to 60599.
Step 5: Consider a password/security review. Change your Government Gateway or HMRC account password if you’re at all unsure whether it was compromised.
Checklists
Checklist 1: Spotting a Scam
- ✓ Does it ask for a password, PIN, or banking details? — Scam.
- ✓ Does it threaten arrest or bailiffs by voicemail? — Scam.
- ✓ Does it offer a refund via text, email, or WhatsApp link? — Scam.
- ✓ Does it pressure you to act immediately? — Treat with suspicion.
- ✓ Does it include a QR code from an unexpected source? — Don’t scan it.
Checklist 2: Staying Protected
- ✓ File your Self Assessment return early where possible
- ✓ Use the official HMRC app or gov.uk directly, never a link in a message
- ✓ Never share your Government Gateway login with anyone
- ✓ Report suspicious contact even if you didn’t engage with it
- ✓ Check “HMRC scams advice” on GOV.UK periodically for newly emerging tactics
FAQs
Will HMRC ever text me about a tax refund?
No. HMRC will never announce a refund by text, email, or WhatsApp, or ask you to click a link to claim one — refunds appear in your HMRC online account or app directly.
Does HMRC use WhatsApp?
HMRC has an official WhatsApp channel, but it’s a one-way broadcast for general updates only — it will never message you individually about your personal tax account, a penalty, or a refund.
How many Self Assessment scams has HMRC reported for 2025/26?
Over 135,500 suspected scam reports in the ten months to December 2025, including around 4,800 specifically tied to Self Assessment and 29,000 fake refund claims.
What should I do if I get a threatening voicemail claiming to be HMRC?
Treat it as a scam — HMRC never leaves voicemails threatening arrest, court action, or bailiffs. Don’t call the number provided; check your HMRC account directly instead.
How do I report a suspicious HMRC text or email?
Forward suspicious emails to phishing@hmrc.gov.uk and suspicious texts to 60599, both free of charge.
Are QR codes in HMRC letters safe?
Be cautious — QR codes in unexpected letters or emails can lead to fraudulent login pages. Type gov.uk into your browser directly instead of scanning an unsolicited QR code.
Does filing my tax return early actually reduce scam risk?
Yes — once you’ve already filed, urgent “action needed” messages closer to the deadline are much easier to recognise as fake, since you know your filing is already done.
What information will HMRC never ask for by text or email?
Your password, PIN, full banking details, or Government Gateway login — genuine HMRC contact never requests these through text, email, or WhatsApp.
Can scammers make calls sound genuinely official using AI?
Yes — AI-generated voice calls are an emerging tactic in 2026, capable of sounding convincingly official while using the same urgency and threat tactics as older scam calls.
What happens after I report a scam to HMRC?
Reports feed into HMRC’s ongoing effort to identify and shut down fraudulent websites and phone numbers — nearly 25,000 have been closed in the past ten months as a direct result of public reporting.
Sources
- GOV.UK — Scams warning as Self Assessment customers targeted
- GOV.UK — Recognise the signs of phishing emails, texts and phone calls
- ICAEW — Taxpayers told to watch out for self assessment scams
- HMRC — How to report tax scams
Scam tactics and reporting channels are updated by HMRC as new threats emerge — always check current guidance on GOV.UK (“HMRC scams advice”) before relying on this information.
Final Thoughts
The core HMRC scam playbook hasn’t changed much in years — urgency, a fake refund or threat, and a request for information HMRC would never actually ask for. What’s changed for 2026 is the delivery: WhatsApp impersonation, AI-generated voice calls, and QR code phishing sit alongside the classic fake text and threatening voicemail. Filing early, checking your HMRC account directly rather than following links, and reporting anything suspicious remain the most reliable protection — regardless of which channel a scammer chooses next.
Want help getting your Self Assessment filed early and safely? Get in touch for a fixed-fee quote, or see our full pricing guide.