Watch Out: HMRC‑Style Hacking Scams Are on the Rise
In a nutshell, fraudsters are dressing up as the UK’s tax authority and sending emails that look almost perfect. They convince people to click on a link that leads to a counterfeit login page, grab your credentials, and then turn the tables on your VAT refunds or even steal your identity.
How the Scam Disguises Itself
- Fake email header: HMRC and legit-looking logos.
- Message talks about a “change to your PAYE tax code” – something that would normally trigger a legitimate alert.
- Gets you to a link that promises you can check your tax code quickly.
But the real trick is that the link isn’t to an official HMRC page; it’s a spoof designed to harvest your username and password. Once inside, the scammer can steal your data, tamper with refunds, or use the login details for other nefarious purposes.
Why It’s Easy to Fall for It
Since the message never asks for money or guarantees an immediate benefit, it feels like a routine email you’re expected to heed. The usual “click to update” psychological hit is lower on the list, so users often ignore the warning signs.
Key Tips to Stay Safe
- Never click on links. Real HMRC emails don’t have external URLs.
- Always log in manually. Type the official
https://www.gov.ukinto your browser, not the link in the mail. - Use unique passwords. Reusing the same password across sites makes it a single point of failure.
Recall the Summer VAT Repayment Scam
Last year, a wave of fraudsters targeted businesses with VAT repayments. They hijacked the bank details on file by submitting fraudulent change requests to HMRC. Even though HMRC tightened verification, the lesson still stands: keep a close eye on any changes to your account information.
What Businesses Should Do
- Regularly review your bank details in the HMRC online portal.
- Treat any unexpected changes as a red flag and verify instantly.
- Inform your accountant or business advisor immediately if you suspect tampering.
Stay vigilant, double‑check anything that feels off, and protect your personal and financial data from these cyber tricksters.
