HMRC tax refund text: is it a scam?
VerdictTreat a text offering an HMRC tax refund in exchange for personal or financial details as a scam. Do not open its link or reply.
Why this message works
HMRC's current guidance specifically warns against this refund-text pattern. The lure may be a tax rebate, a refund deadline or a request for bank details to release money. HMRC does send some genuine texts and may include links to GOV.UK information or webchat, so the rule is not that every HMRC text or link is fake. Verify the contact through the official service instead.
Warning signs
- An unexpected tax refund that you must claim by entering bank or card details.
- A deadline, threat or urgent instruction to act without checking your tax account.
- A lookalike login page asking for your Government Gateway credentials.
How to check safely
Go to GOV.UK independently and check HMRC's list of genuine contacts. Access your tax account through the official website or HMRC app, not a link in the refund message.
What to do now
- Do not reply or provide personal, tax-account or payment information.
- Check the contact and any refund independently through GOV.UK.
- Report the suspicious message to HMRC, then delete it.
Report it
Forward suspicious HMRC texts to 60599. HMRC says network charges may apply. Its official guidance also explains how to report information you have already disclosed.
If you already responded
If you gave away banking details, contact your bank immediately. If you entered your Government Gateway password, change it through the real service and contact HMRC using details from GOV.UK. Report a disclosure of personal information through HMRC's official reporting route. Do not trust a follow-up caller offering to recover the refund.
How did they get your number?
A scam text cannot tell you exactly where the sender got your number. It may have been guessed, exposed in a breach, shared through a sign-up, or found in a public listing. Evri describes mass messaging rather than targeting a known parcel. Public personal information can also make messages more convincing. Receiving a text is not proof that a particular company or data broker supplied your details.
Review what you share publicly and read how data brokers collect contact details. Removing public listings can reduce one source of exposure, but it cannot erase breach records, stop randomly generated texts or guarantee that scam messages will end.
How data brokers collect contact details →Run the free exposure check →