When I’m calling you

Recognising genuine and bogus HMRC contact

HMRC have recently updated their guidance, ‘Genuine HMRC contact and recognising phishing e-mails’, which will help taxpayers in sifting out the wheat from the chaff.

The guidance provides information on…

1. Current list of digital and other contact issued from HMRC
2. How to tell if an e-mail is fraudulent
3. HMRC Short Message Service (SMS) text messages
4. Report HMRC related phishing/bogus e-mails

Current and future contact from HMRC

Tax credits

From 24th October, HMRC will be sending letters to those receiving tax credits advising that they will be invited to take part in a short telephone survey about how they report changes. Calls will be made from a private number and will be completed by 9th December.

HMRC may telephone new or existing self-employed taxpayers receiving tax credits to ask about their self-employment. During this call, HMRC will ask what trade, vocation or profession the individual is involved in and also questions about the number of hours they work. At no point during the call will the individual be asked to provide personal details such as bank account numbers.

A company called Concentrix is working on behalf of HMRC to check that people are receiving the correct amount of tax credits. Some individuals will receive letters that display both HMRC and Concentrix logos. Concentrix may also make contact by telephone.

Neither HMRC nor Concentrix will ask individuals to disclose any personal or payment information by text or e-mail.

Employer Bulletin

Those who have registered to receive the Employer Bulletin via e-mail will receive the message, ‘Important information for employers’ and refer to the Employer Bulletin. These e-mails will never ask a person to provide personal or financial information.

Educational e-mails

Periodically, HMRC will send e-mails to taxpayers to support their business life events. These messages will include links to relevant online digital education material used to offer help in relation to a person’s business and will appear in the address bar as no.reply@advice.hmrc.gsi.gov.uk. Again, no personal or financial information will be asked for.

VAT

HMRC will send traders e-mails to remind them when their VAT return is due if they have registered to receive such reminders. These e-mails are titled ‘Reminder to file your VAT Return’.

Reminder e-mails will also be sent to those businesses who are overdue with VAT payments. HMRC will only use e-mail addresses that have been provided by traders and will recommend that outstanding payments be made online to avoid further action.

Those who have registered for VAT using HMRC online services will also receive e-mails from HMRC.

None of these e-mail messages will ask for personal or financial information.

Debt management

HMRC is sending text messages to some taxpayers, whilst others may receive voice prompts to their landline or mobile phones, explaining what they need to do if they are behind with tax payments. These messages will provide details for paying HMRC or a helpline number for people to contact.

As with other messages, personal or financial information will never be requested.

Fraudulent e-mails

Fraudsters often use e-mail addresses that are similar to but not the same as HMRC addresses and have e-mail accounts with HMRC or revenue names in them, such as ‘refunds@hmrc.org.uk’. They will also falsify (spoof) the ‘from’ address to look like a legitimate HMRC address, e.g ‘@hmrc.gov.uk’.

Rule of thumb is if you’re not 100% sure that the message is from HMRC, then don’t open it.

Be wary of e-mails that ask for immediate action, such as ‘you only have three days to reply’ or ‘urgent action required’.

High volumes of phishing e-mails are often sent out in one go by fraudsters, so even though they have a person’s e-mail address, they seldom have the person’s name. Be cautious therefore of e-mails that use a generic greeting such as ‘Dear Customer’. E-mails from HMRC will always:

• use the name provided to HMRC, other than where someone has signed up to HMRC subscription services
• include information on how to report phishing e-mails to HMRC

Another common tactic used by fraudsters is to include links to web pages that look similar to the HMRC home page. This is to trick a person into disclosing personal/confidential information. Bogus web pages often contain links to banks/building societies or display fields and boxes requesting personal information such as passwords, credit card or bank account details.

Sometimes they will include genuine links to HMRC web pages to attempt to make their e-mails appear genuine.

E-mails from HMRC will never:

• notify someone of a tax refund or offer a repayment
• ask a person to disclose personal information such as their full address, postcode, Unique Taxpayer Reference or bank account details
• give a non-HMRC personal e-mail address to send a response to
• ask for financial information such as specific figures or tax computations, unless a taxpayer gives their consent and formally accepted the risks
• have attachments, unless the person has consented in advance
• provide a link to a secure log-in page or a form asking for information. Instead HMRC will ask a person to log on to their online account to check for information.

HMRC Short Message Service (SMS) text messages

Step Verification is an additional security feature which helps to prevent someone else from accessing a person’s digital tax account, even if they have their user ID and password. When activating 2-Step Verification HMRC will send an access code via SMS to customers’ nominated mobile phone number. SMS messages will never ask for personal or financial information.