Gone phishing – 75,000 fake tax refund emails reported

HM Revenue and Customs (HMRC) is warning taxpayers to be on their guard against fraudulent
phishing emails, after almost 75,000 fake emails were reported to the taxman over the last six months.

Some 74,743 scam emails were reported to HMRC’s dedicated phishing email account between
April and September – a 70% increase on the same period in 2013. Over the same six month period, HMRC worked with other law enforcement agencies to help close down more than 4,000 websites responsible for sending out the emails.

The emails promise a tax refund, and often ask for a recipient’s name, address, date of birth, bank and credit card details – including passwords and their mother’s maiden name. Once the victim has provided the information, money is stolen from their bank account and their details are sold on to other criminal gangs, which can lead to identity theft.

Steve Singh, Deputy Head of Operations, HMRC Digital Security, said:

“HMRC never contacts customers who are due a tax refund by email – we always send a letter
through the post.

“If you receive an email which claims to be from HMRC, and which offers you a tax refund, we recommend you send it to phishing@hmrc.gsi.gov.uk and then permanently delete it. We can, and do, close these websites down and we continue our efforts to work with law enforcement agencies around the world to bring down the criminals behind these scams.”

HMRC asks people to:

• Check http://www.hmrc.gov.uk/security/advice.htm for its online security advice  
  
• Check to see examples of phishing emails online at http://www.hmrc.gov.uk/security/examples.htm
  
• Forward suspicious emails to HMRC at phishing@hmrc.gsi.gov.uk and then delete them
  
• Avoid clicking on websites or links in suspicious emails, or opening attachments.

Further advice can also be found at http://www.getsafeonline.co.uk/  

Notes for editors

1. The scam email often begins with a sentence such as ‘we have reviewed your tax return; according to our calculations of your last year’s accounts a tax refund of XXXX is due’.
       
2. Other HMRC related scams carry attachments which may contain viruses. We recommend that customers do not open the attachment and forward the suspicious email to HMRC and then delete it.
   
3. Legitimate tax rebate forms (P800s) from HMRC will contain a payment order and will never ask for credit or debit card details.
   
4. HMRC published its updated Digital Strategy in September 2014:  https://www.gov.uk/government/publications/hmrc-digital-strategy-2014
   
5. Follow HMRC’s Press Office on Twitter @HMRCpressoffice
   
6. HMRC’s Flickr channel www.flickr.com/hmrcgovuk