The Fake HMRC Tax Refund Email
Thousands of UK residents received convincing emails claiming they were owed a tax refund — handing over bank details to criminals instead.
Attack Chain
- 1Mass email sent impersonating HMRC
- 2Victims click link to fake Gov.uk site
- 3Bank details entered on fake portal
- 4Funds drained within hours
Background
Every year around self-assessment season, criminals send mass phishing emails disguised as official HMRC communications. In 2022, an unusually convincing campaign targeted people who had recently filed their tax returns. The emails used real HMRC logos, official-sounding language, and even replicated the genuine Gov.uk visual style.
The Attack
The emails told recipients they were owed a tax refund and needed to click a link to claim it. The link led to a fake website that looked nearly identical to the HMRC online portal. Victims were asked to enter their National Insurance number, date of birth, and full bank account details to receive their refund. Within hours of submitting, their bank accounts were drained.
Response
HMRC issued warnings and worked with the National Cyber Security Centre to get the fake domains taken down. Banks that identified fraudulent transactions froze funds where possible. However, by the time most victims realised what had happened, the money had already moved through multiple accounts.
Outcome
Thousands of people lost money. The average loss was around £800 per victim, though some lost several thousand pounds. HMRC now prominently states it will never email you asking for bank details, and that all genuine refunds are handled through your tax account.
Key Takeaways
- HMRC will never email you asking for bank details — legitimate refunds go back through your original payment method
- Always go directly to Gov.uk by typing the address in your browser, never follow links in emails
- Check the sender's actual email address — real HMRC emails come from @hmrc.gov.uk only
- If in doubt, call HMRC directly using the number on the official website
- Enable two-factor authentication on your personal tax account so even stolen passwords aren't enough