Breakthrough controls stop phone fraudsters spoofing HMRC

New defensive controls deployed by HM Revenue and Customs (HMRC) have put an end to fraudster’s spoofing the tax authority’s most recognisable helpline numbers.

Fraudsters have increasingly mimicked legitimate HMRC helpline numbers (often beginning with 0300) in order to dupe taxpayers and steal money. Last year alone, HMRC received over 100,000 phone scam reports.

The ‘spoofing’ scam worked as taxpayers would receive calls and, on checking the numbers online, would find they appeared to belong to HMRC. This often led people to believe fake calls were real and enabled fraud.

The new controls, created in partnership with the telecommunications industry and Ofcom, will prevent spoofing of HMRC’s most used inbound helpline numbers and are the first to be used by a government department in the United Kingdom.

Criminals may still try and use less credible numbers to deploy their scams – but that means they will be easier to spot.

Financial Secretary to the Treasury, Jesse Norman MP, said:

“This is a huge step forward in the fight against phone fraud.

“HMRC’s new controls will help to protect thousands of hardworking taxpayers and their families from these heartless criminals.

“Vigilance will always be important but this is a significant blow to the phone cheats.”

Head of Action Fraud, Pauline Smith, said:

“Phone calls are one of the top ways for fraudsters to make contact with their victims. Between April 2018 and March 2019, one in four phishing reports made to Action Fraud were about fraudulent phone calls.

“It is encouraging to see that these newly developed controls by HMRC have already achieved a reduction in the number of calls spoofing genuine HMRC numbers. If you believe you have fallen victim to a fraudster, please report it to Action Fraud”

Since the controls were introduced in April this year, HMRC has reduced to zero the number of phone scams spoofing genuine inbound HMRC numbers. This has resulted in the tax authority already receiving 25% fewer scam reports against the previous month.

HMRC will continue to work with network providers to eradicate fraudulent numbers that are reported, and during the last 10 months has requested the removal of over 1050 numbers from being used by scammers.

Criminals often target the elderly and vulnerable using HMRC’s brand as it is well-known and adds credibility to a fraudster’s call, though this will now be significantly harder to do.

HMRC will only ever call you asking for payment on a debt that you are already aware of, either having received a letter about it, or after you’ve told us you owe some tax, for example through a Self-Assessment return. Changes the department makes this month also mean you will never have to read aloud your card details to an operator.

If anyone is ever in doubt about who they are speaking to, check the number and end the call. You can contact HMRC using one of the helpline numbers or online services available from GOV.UK

Notes for editors

Statistics on HMRC phone scams

HMRC has seen an increasing number of phone scams against UK taxpayers hence its urgent action.

2016/17 – 407 reports

2017/18 – 7,778 reports

2018/19 – 104,774 reports

How can you spot a scam?

Thanks to HMRC’s controls, scammers will now be forced to use much less credible looking numbers but you should still be vigilant as scammers may try spoof other numbers. Our advice for avoiding phone scams:

• Recognise the signs - genuine organisations like banks and HMRC will never contact you out of the blue to ask for your PIN, password or bank details.
• Stay safe - don’t give out private information, reply to text messages, download attachments or click on links in emails you weren’t expecting.
• Take action - forward details of suspicious calls claiming to be from HMRC to phishing@hmrc.gov.uk and texts to 60599, or contact Action Fraud on 0300 123 2040 or use their online fraud reporting tool if you suffer financial loss.
• Check GOV.UK for information on how to avoid and report scams and recognise genuine HMRC contact.
• Listen to an example of what a phone scam sounds like on Twitter
• If you think you have received an HMRC related phishing/bogus email or text message, you can check it against the examples shown in this guide.

More of HMRC’s other action against scams

• In the last year, HMRC identified 3,441 phishing scams before they were reported thanks to proactive intelligence work. During the same period, HMRC requested the takedown of 12,366 phishing websites
• From June 2019, callers paying tax or debts over the phone to HMRC will enter their payment details via their telephone keypad instead of supplying this verbally over the phone. The operator will remain on the call throughout while the card details are processed via the system but will not be privy to the customer’s secure information.
• In 2016 HMRC identified a significant increase in customers receiving malicious ‘HMRC’ branded texts in 2016, and with the phone industry, piloted controls that resulted in a 90% reduction in reports of these scams. The evidence from that pilot provided the basis for Mobile Ecosystem Forum introduce a product that could be used by other mobile phone network operators.
• HMRC has deployed technical controls that have so far stopped around half a billion phishing emails from ever reaching our customers' inboxes and reduced reported instances of HMRC-branded phone text scams by 90%.

Who has HMRC worked with on developing these controls?

• Mobile UK - the trade association for the UK’s mobile network operators.
• Mobile Ecosystem Forum – global trade body for mobile networks.
• Telecommunications UK Fraud Forum (TUFF) – telecom industry body identifying and addressing issues in tackling fraud and crime.
• Ofcom – official regulator for broadcast, telecommunications, postal services and airwaves