As the self-assessment tax return deadline looms this week, the pressure is on for millions of self-employed workers and business owners. Getting the paperwork in on time is an annual headache – and that pressure may make them more susceptible to scams.
In the last year, HMRC has received 900,000 reports of suspicious phone calls, texts and emails – most promising tax rebates. And they are becoming more sophisticated and increasingly convincing.
With a galling similarity to official communications – using the same logo and seemingly official reference numbers – emails from fraudsters ask recipients to click on a PDF attachment, which then requires them to fill in their bank details.
Calls from numbers which look identical to HMRC are also increasing. They can even include Government Gateway account numbers – which makes them very easy to fall for, and infuriating for those who succumb.
“We are human, so we can make mistakes. Even cautious people click on malicious attachments or links,” says Jake Moore, a specialist at internet security company ESET. As the scams spread to social media, where many people may not be expecting to be contacted about tax details, and via direct messaging through Facebook and WhatsApp, there is one simple rule to remember – HMRC stresses it never uses any social media to offer a tax rebate, or ask for personal or financial information.
The scams do not always come in the enticing form of a promised rebate. Calls can be far more threatening, telling their target they owe money and will be arrested for tax fraud or have their bank account frozen within hours if they don’t pay.
Be on the alert for automated calls. Ray Walsh from ProPrivacy.com particularly warns about accepting so-called “robocalls”, which aim to trick people into pressing a key on their keypad to connect to a caseworker to make a payment. Some have succeeded in adding charges to a victim’s phone bill simply by making them press a key.
Matthew Singleton, a Manchester-based finance professional, was targeted by scammers shortly before Christmas. He received a call from an 020 number and was taken through security. The scammer knew his name and address and told him he had underpaid his income tax.
When Singleton said it was a scam, he was told to Google “HMRC” and go to the contacts section of the site. The scammer said he would ring back from an 0300 number listed there. “My phone then came up with this 0300 number – the exact same number as on the HMRC website,” says Singleton. He was told he could pay the amount owed – more than £4,800 – over the phone. “There was no way I was doing that. I had not had any documentation. But I was told an arrest warrant would be issued within two hours of the call ending.”
Singleton reported the scam to Action Fraud but believes HMRC could do more to increase awareness. “When you Google HMRC, why can’t it put a warning under its link to explain that this could happen? The safest thing is to warn people that even calls from recognised HMRC phone numbers may not be legitimate.”
Joel Lewis, consumer policy manager at Age UK, agrees. “I think HMRC should do a bit more to promote the fact these scams exist. We hear a lot about self-assessment deadlines, but not that you need to watch out because there are people pretending to be HMRC,” he says.
The chief executive of cyber-security firm DynaRisk, Andrew Martin, says scammers can spoof any number – new or old. “In the case of text messages, scammers can alter the caller ID field to say ‘HMRC’. For phone calls, they alter it to show a number that’s the same as another HMRC number.”
The problem has led HMRC to work with the telecommunications industry and regulator Ofcom to prevent the cloning of genuine contacts. HMRC says it has seen a 94% reduction of phone scams spoofing genuine numbers since controls were introduced in April 2019. “We have put in place pioneering new controls such as DNO [Do Not Originate] to prevent spoofing of the most used inbound helpline numbers,” it says. “During the past year, the team’s work also instigated the removal of 1,921 unique numbers being used by scammers.”
It says it is also working to raise awareness of scams via the media: “We have a reporting channel which responded to nearly 200,000 calls from customers in the last year, and we maintain dedicated information on HMRC scams on the gov.uk educational pages.”
Consumers are advised that if they receive a phone call from someone purporting to be from HMRC, they should end the call and phone back on a verified number. Check the HMRC website or use the number on a letter you have received in the past.
Be aware, however, that scammers can keep phone lines open, which means the original connection remains active even if the consumer has hung up. So always use a different phone to call back or wait 10 minutes if it’s the same line.
Crucially, HMRC will only contact customers due a refund by post. It will never be by phone, text or email, nor will consumers be asked for their PIN, password or bank details. Its advice is to watch out for spelling mistakes and grammatical errors in emails, as well as the use of threatening and urgent language such as “you only have three days to reply”.
Lewis says the tactics scammers use can be very effective and well-honed, and that it is important not to rush into anything. “They know what the trigger points are for people and that if a call or email is out of the blue you can start to get flustered and make a rushed decision, rather than taking a moment to consider what it is you are being asked to do,” he says. “Don’t respond immediately. There is never a need to do that. Ask for a second opinion from a family member or friend or someone else you trust.”
Many phishing emails avoid using a person’s name and opt for a generic greeting such as “Dear customer”. Check the “from” email address carefully, too. Some use random characters and can be easier to spot, but others may end in “hmrc.gov.uk” and appear more convincing.
Avoid opening the message and do not click on any links or PDF attachments.
Forward suspicious emails to firstname.lastname@example.org and texts to 60599. You can also contact Action Fraud on 0300 123 2040 Monday to Friday 8am to 8pm or use its online fraud reporting tool, particularly if you have lost money