An Organisation for all
Accountants in Practice

Genuine HMRC contact and recognising phishing emails

hmrc logo

By HMRC

Contents

  1. 1. Current list of digital and other contact issued from HMRC
  2. 2. How to tell if an email is fraudulent
  3. 3. HMRC SMS text messages
  4. 4. Report HMRC related phishing or bogus emails

1. Current list of digital and other contact issued from HMRC

1.1 Businesses’ views towards HMRC’s digital transformation

You may get a letter from IFF Research telling you about the research, and a telephone call inviting you to take part. You can either:

  • request further information about the research project
  • tell IFF Research that you do not want to take part

We encourage you to take part in the study, as it will help us understand how your business will deal with changes to tax administration that make it easier to use and more efficient.

1.2 Basic PAYE Tools survey

Between November 2018 and February 2019 HMRC will be emailing customers to invite them to take part in an online survey. The email will come from no.reply@advice.hmrc.gov.uk.

The Google Forms survey will help us evaluate changes made to the Basic PAYE tools software including the relevant guidance.

The survey is voluntary and anonymous, it will not request any personal or financial information. All information given will be used for research purposes only.

1.3 Debt Enforcement ADT letter

The letter from HMRC Debt Enforcement ADT titled ‘Immediate action required – please pay’ is genuine.

If you want to verify the letter search for the telephone number given on the GOV.UK website.

Should you require any more information speak to an advisor about the details in the letter to make sure it is genuine.

This advice applies to any correspondence from HMRC which you are unsure about.

1.4 Electronic Point of Sales Research

Between November 2018 and January 2019, HMRC will be working with an independent research agency called IFF Research.

HMRC and IFF will contact some stakeholders who have an interest in the Electronic Point of Sale (EPOS) market in the UK.

Businesses involved in the development or distribution of EPOS systems will receive a letter directly from IFF. This letter will display IFF’s logo, inviting you to take part in the research. Contact names at IFF will be on the letter, in case you want more information about the research project or want to opt out from taking part.

Businesses who may use EPOS systems will receive a letter from HMRC. This letter will display HMRC’s logo, inviting you to take part in the research. Contact names at HMRC will be on the letter, in case you want more information about the research project or want to opt out from taking part.

The research will help HMRC to understand how businesses make decisions about using EPOS systems and help build HMRC’s understanding of the prevalence and drivers of the use of Electronic Sales Suppression (ESS) involving EPOS systems in the UK.

1.5 Mid-size Business Customer Compliance Survey

Between November 2018 and January 2019 HMRC will be emailing customers to invite them to take part in an online survey.

You may also receive a call or a letter from us to tell you about the research.

The survey is voluntary and anonymous and you will be given the option to opt out should you not want to take part.

The research will help us improve the compliance service journey for customers to make it easier, more convenient and a faster process. Your feedback will be used to help shape the service we offer all our customers.

1.6 Secure Data Exchange Service customer survey

Between November 2018 and February 2019 HMRC will be emailing customers to invite them to take part in an online survey about their experience of using the Secure Data Exchange Service.

You may also receive a call or letter from us to tell you about the research.

This survey is voluntary and anonymous and you will be given the option to opt out, should you not want to take part.

The research will help us understand how the service works for both us and our customers and will help shape the service we offer.

1.7 Compliance checks for midsized businesses, charities or public bodies

HMRC may contact customers to arrange a compliance check interview to take place by telephone.

When calling to arrange telephone interviews, we may also ask for business records to be sent by post or electronically, by a secure platform.

You can check if requests are genuine by asking the HMRC staff member to send an email while you are on the call to confirm their identity. Their email address should have their name and end in @hmrc.gsi.gov.uk.

You can also call the relevant general enquiry helpline to check requests for:

  • VAT for businesses
  • tax for employers
  • Corporation Tax for limited companies

When you call, you’ll need to have either your:

  • VAT registration number
  • employer reference
  • 10 digit Unique Tax Reference

1.8 Stakeholder engagement research

Between September and December 2018 HMRC will work with Populus, an independent research agency. The agency will contact a sample of stakeholders who have contacted HMRC, or expressed an interest in receiving information about the department (for example, the media, MPs and business and agent representatives). First contact will be by email, follow up contact will be by email and telephone.

The research will help HMRC understand the views of its stakeholders, and help shape how we engage and communicate with them in future.

1.8 .1 Emails and phone calls requesting stakeholders to take part in an online interview

In October and November 2018, stakeholders may get an email from HMRC inviting them to take part in an in-depth telephone interview. The email will include:

  • contact details for HMRC and Populus, an independent research agency
  • information about the research
  • how to opt out of the interview

Populus may send further emails to stakeholders or telephone them to encourage them to take part in the research.

1.9 Emails about using your Tax-Free Childcare account

From August 2018 HMRC may contact some customers by email who have registered for their 30 hours free childcare or opened Tax-Free Childcare accounts.

The emails will remind you about the benefits of using your Tax-Free Childcare account, and explain how your 30 hours free childcare and Tax-Free Childcare may be affected as your child reaches school age.

The emails will direct you to GOV.UK, where you can sign in to your Tax-Free Childcare account. The emails will not request any personal or financial information.

1.10 Research to explore and evaluate large business customers’ interaction with HMRC

From September to December 2018 HMRC will be working with an independent research agency, IFF Research. The agency will carry out research on large business customers’ interactions with HMRC.

IFF Research and HMRC will send a joint letter to businesses eligible for the study. This will display the logos of both organisations, inviting you to take part in the research. Contact names at IFF Research and HMRC will be on the letter, in case you want more information about the research project or want to opt out from taking part.

If you wish to opt out you must phone or email IFF Research and give them your name and the reference number at the top of the letter. You do not have to do anything if you’re willing to take part.

1.11 Mid-size business customer experience survey 2018

During September to December 2018, independent research agency IFF Research will contact a random sample of mid-size businesses about taking part in a customer experience survey.

You may receive a letter or email from IFF Research to tell you about the survey, followed by a phone call inviting you to take part which will take around 20 minutes. You do not have to do anything with the letter or email, unless you wish to opt out.

The research will help HMRC to develop its strategy for mid-size businesses and their perception of dealing with HMRC. Taking part in the survey is voluntary and anonymous.

1.12 Research into overseas trade among VAT unregistered businesses

From August to December 2018 HMRC will be working with an independent research agency, IFF Research.

The agency will carry out a study of VAT unregistered businesses that import goods and services.

The aim of the study is to understand current international trading activity and behaviours, and the impact of Place of Supply rules.

The agency will contact a random sample of VAT unregistered businesses. You may receive a letter from IFF Research to tell you about the research, and a telephone call inviting you to take part in a survey, which will take around 20 minutes.

Taking part in this research is voluntary. If you choose to take part, all of your answers will be confidential.

HMRC will not be able to identify the businesses that take part, or their individual answers. Any information you provide for this study will be used for research purposes only.

1.13 Research on tax agents’ opinions on filing Income Tax Self-Assessment and VAT returns

From July 2018 to April 2019, HMRC will be working with an independent research agency Kantar Public.

The agency will carry out a study to understand tax agents’ views on filing Income Tax Self-Assessment and VAT returns.

You may receive a letter from Kantar Public informing you about the research and a telephone call inviting you to take part.

The letter will not ask you to do anything, the telephone call will ask you if you would like to take part in a short survey. The survey is about 5 to 7 minutes long, about tax agents’ views on filing Income Tax Self-Assessment and VAT returns.

You will not be asked for details of your personal or organisational tax affairs.

You can request further information about the research project or inform Kantar Public that you do not wish to take part.

HMRC would like you to take part in this study to improve understanding of how businesses will respond to the changes to make tax administration more efficient, easier and closer to real time.

1.14 Emails and letters to overseas businesses that sell digital services to UK consumers

HMRC is contacting overseas businesses who sell digital services to UK consumers about their UK VAT obligations by email and post.

This communication will explain why we are contacting them, and ask them to contact us. We will not ask for any personal, business or financial information.

1.15 Emails aimed at businesses selling goods in the UK through online marketplaces

HMRC is contacting businesses who sell goods to customers in the UK through online marketplaces. The emails refer to VAT obligations in the UK. The initial email will explain why HMRC is contacting them, requesting them to get in touch.

1.16 Helping to improve GOV.UK - emails

Customers who sign up to help improve GOV.UK to make government services better, will receive email communications from HMRC.

The first email will include a link which should be followed in order to complete the signing up process. The second email, issued after registration, will include a link to a research blog.

Once customers have signed up, they may receive emails that include links to short surveys about research.

If customers meet the criteria for the research, they’ll receive an email that will invite them to take part. The email will either have a link to take part online or additional details to take part face-to-face.

The emails will not request any personal or financial information. They’ll all contain a link to unsubscribe.

1.17 Emails sent to customers promoting the Personal Tax Account

Customers who contact HMRC helplines will be asked if they wish to sign up to a Personal Tax Account (PTA). For those customers who do not wish to sign up by telephone, they’ll be offered further information by email.

If customers agree to provide an email address, they’ll be sent some information by email while they’re on the telephone. The email provides background information about the benefits of signing up to PTA and how the customer can go about doing it.

The email will not request any personal or financial information.

1.18 VAT EU emails

Customers that use the VAT EU refunds service may receive an email if their claim has failed validation. The email will provide details explaining why the claim has failed.

The emails will not request any personal or financial information.

1.19 Trade statistics import and export data emails

HMRC’s Trade Statistics Unit regularly sends emails to business customers regarding import and export statistical data, and the related services accessed from HMRC’s trade statistics website.

These include business alerts, service updates, deadline reminders, data quality reviews and survey requests. These messages may include links to further information, educational or survey content on the HMRC’s trade statistics website.

They will not request any personal, payment or tax related information.

1.20 Debt management

1.20.1 Text messages

HMRC is sending text messages to some customers, explaining what you need to do if you’re behind with your payments. These messages will also give details for paying HMRC or a helpline number for you to contact.

HMRC is also sending messages that’ll give advice about the importance of making payments using the correct information.

The messages will not request any personal or financial information.

1.20.2 Voice prompts to landline and mobile phones

HMRC is sending voice prompts to some customers, explaining what you need to do if you’re behind with your payments. Customers will receive these as an inbound phone call giving details for paying HMRC or a helpline number for you to contact.

HMRC is also sending messages that’ll give advice about the importance of making payments using the correct information.

The messages will not request any personal or financial information.

1.21 VAT emails

1.21.1 VAT returns - email reminders

HMRC will send an email to customers to remind them when their VAT return is due if they’ve registered to receive email reminders. The emails are entitled ‘Reminder to file your VAT return’ and contain links to a further information page and a link to the sign in page on GOV.UK.

These emails will never ask you to provide personal or financial information.

1.21.2 VAT registration - email

HMRC will send an email to customers who have registered for VAT using HMRC online services. HMRC will use the email address customers have provided to advise that they need to log into their online tax account in order to view a message in the secure messaging area.

These emails will never ask you to provide personal or financial information.

1.21.3 VAT debts - email reminders

HMRC may send an email to customers who are overdue with VAT payments. HMRC will use email addresses that customers have already provided and will recommend that customers pay online to avoid further action. These emails will never ask you to provide personal or financial information.

You’ll not be able to reply to the emails, which will be sent from: no.reply@advice.hmrc.gov.uk.

1.22 Help and support emails

HMRC will periodically send emails to customers to support their business life events. The emails will sometimes include links to relevant online digital education products, used to offer you help in relation to your business and the email will appear in your address bar as: no.reply@advice.hmrc.gov.uk.

These emails will never ask you to provide personal or financial information.

All emails issued from this address, are sent via Granicus (GovDelivery) our trusted email service provider.

1.23 Employer email alerts - employer bulletins

HMRC sends informational bulletins several times a year to employers, who have registered to receive them. These emails never ask you to provide personal or financial information.

These emails, issued by HMRC is commonly entitled ‘important information for employers’.

The emails include links which direct recipients to HMRC pages on the GOV.UK website, including advice about online security.

1.24 Statutory notices requesting information

HMRC’s Centre for National Information (CNI) regularly issues statutory notices to the holders of certain types of information, asking them to provide relevant details to HMRC. The holders of the information have a legal obligation to provide the data requested.

The notices requesting information can be sent by post or email.

Notices issued by email will also contain a link to this web page so the recipients can see that HMRC is using email for this purpose.

2. How to tell if an email is fraudulent

As well as spelling mistakes and poor grammar, there are a number of things you can look out for to help you recognise a phishing or bogus email.

2.1 Incorrect ‘from’ address

Look out for a sender’s email address that is similar to, but not the same as, HMRC’s email addresses. Fraudsters often have email accounts with HMRC or revenue names in them (such as ‘refunds@hmrc.org.uk’). These email addresses are used to mislead you.

However be aware, fraudsters can falsify (spoof) the ‘from’ address to look like a legitimate HMRC address (for example ‘@hmrc.gov.uk’).

If you’re not 100% sure that the message has come from us, do not open it. If you do open the email and you’re in doubt, do not click on any links or downloads.

Read examples of phishing and bogus emails for more information.

2.2 Personal information

Emails from HMRC will never:

  • notify you of a tax rebate
  • offer you a repayment
  • ask you to disclose personal information such as your full address, postcode, Unique Taxpayer Reference or details of your bank account
  • give a non HMRC personal email address to send a response to
  • ask for financial information such as specific figures or tax computations, unless you’ve given us prior consent and you’ve formally accepted the risks
  • have attachments, unless you’ve given prior consent and you’ve formally accepted the risks

2.3 Urgent action required

Fraudsters ask for immediate action. Be wary of emails containing phrases like ‘you only have 3 days to reply’ or ‘urgent action required’.

2.4 Bogus websites

Fraudsters often include links to webpages that look like the homepage of the HMRC website. This is to trick you into disclosing personal or confidential information. Just because the page may look genuine, does not mean it is.

Bogus webpages often contain links to banks or building societies, or display fields and boxes requesting your personal information such as passwords, credit card or bank account details.

You should be aware that fraudsters sometimes include genuine links to HMRC webpages in their emails, this is to try and make their emails appear genuine.

2.5 Common greeting

Fraudsters often send high volumes of phishing emails in one go, so even though they may have your email address, they seldom have your name. Emails from HMRC will:

  • usually use the preferred name you’ve provided to us, where you’ve signed-up to HMRC subscription services for example
  • always include information on how to report phishing emails to HMRC

2.6 Attachments

Be cautious of attachments as these could contain viruses designed to steal your personal information.

3. HMRC SMS text messages

3.1 SMS text message - activating 2-Step Verification

2-Step Verification is an additional security feature which helps to prevent someone else from accessing a customer’s digital account, even if they have their user ID and password.

When activating 2-Step Verification, HMRC will send an access code via SMS to the customers’ nominated mobile phone number, which the customer will need to complete the set-up.

These SMS messages will never ask the customer to provide personal or financial information.

This means that once customers have activated 2-Step Verification, the only way to access the account will be with the Government Gateway user ID, password and access to the phone which has been registered.

HMRC is planning ways of increasing the number of users who can benefit from 2-Step Verification.

3.2 SMS text message - 2-Step Verification for future log ins

After activating 2-Step Verification, each time the customer logs in, HMRC will send an access code via SMS to the registered mobile phone number, which will be needed to complete the log in process. These SMS messages will never ask the customer to provide personal or financial information.

If a customer no longer has access to the mobile phone registered for 2-Step Verification, they’ll need to ring the Online Services Helpdesk and verify their identity to deactivate it.

The customer can then register their new mobile number for 2-Step Verification when they log in the next time.

3.3 Tax credits - SMS text or voice prompts

HMRC is contacting some customers who claim tax credits by SMS and voice message asking them to update or confirm their circumstances if the details they hold (that is, income or working hours) differ from the information shown on their employer records.

Tax credits customers who send in their renewal or a new claim will receive a SMS text message confirming that HMRC has received their claim or renewal and estimated processing times.

Customers may also receive a SMS text message to remind them to renew their tax credits claim.

These reminder messages will only direct them to the GOV.UK website to renew their claims online. These messages will not request any personal or financial information.

Tax credits customers who report a change in their circumstances using the online service may receive a SMS text message confirming that HMRC has received and processed their change. These messages will not request any personal or financial information.

Tax credit customers who have been selected to have their award checked may receive a SMS if they’ve not responded to our enquiry letter.

The message will ask them to reply in writing or call the number on the letter if they require any help.

The messages will not request any personal or financial information.

3.4 Tax-Free Childcare and 30 hours SMS text reminder to confirm your details in your childcare account

During August 2018 HMRC is contacting customers whose entitlement to 30 hours free childcare or Tax-Free Childcare has lapsed, but who may still benefit from the offers if they confirm their details now.

The SMS will advise you that they risk losing their 30 hours free childcare or Tax-Free Childcare if you do not respond, and will direct you to GOV.UK to sign in to your childcare account.

3.5 National Minimum Wage - Short Message Service (SMS) text message to advise of new entitlement following a recent birthday

HMRC is contacting customers who claim Working Tax Credit by SMS text message to advise when the entitlement to National Minimum Wage has gone up following a recent birthday. 18th, 21st or 25th birthdays see an increased minimum wage entitlement for workers as they move from one age rate band to another.

The SMS texts are being issued on a monthly basis.

These advisory messages direct recipients to seek further information in relation to the minimum wage by searching online the term ‘National Minimum Wage’. These messages do not request any personal or financial information.

The sender of the text will be named as ‘HM Govt’.

3.6 National Minimum Wage - SMS text message to advise of new minimum wage entitlement following a recent rate increase to National Minimum Wage rates

HMRC is contacting customers who claim Working Tax Credit by SMS text message to advise when the entitlement to National Minimum Wage has gone up following the annual rate increase to the National Minimum Wage on 1 April 2018.

These advisory messages direct recipients to seek further information in relation to the minimum wage by searching online the term ‘National Minimum Wage’. These messages do not request any personal or financial information.

The sender of the text will be named as ‘HM Govt’.

The SMS texts are being issued on a monthly basis.

4. Report HMRC related phishing or bogus emails

If you’ve received a phishing or bogus email related to HMRC, or you’re not sure if it’s genuine, you can read about how to report internet scams and phishing to HMRC.