Enter Your E-mail

HM Revenue & Customs (HMRC) have issued examples of ‘phishing’ emails, letters, text messages, and bogus calls used by fraudsters to get your personal information.

Introduction

‘Phishing’ is a crime and unfortunately most people do not realise it is happening to them until it is too late. The Low Incomes Tax Reform Group (LITRG) is aware that people continue to get caught out by phishing, so here the group tells you more, and what can you do to protect yourself.

What is ‘phishing’?

‘Phishing’ involves a communication from an apparently legitimate organisation such as HMRC asking the recipient to update or to verify their personal information, including date of birth, login information, account details, credit card numbers, PIN numbers, etc. These communications frequently appear to be totally genuine. However, anyone providing their details is at serious risk of having unauthorised transfers made from their bank accounts/payments made from their credit cards. They also risk having their personal details sold on.

HMRC examples

HMRC do communicate with taxpayers in many different ways, which makes them an easy target for fraudsters. However they are very particular in how they ask for personal information and they will NEVER ask you to provide personal information by email or text.

HMRC provide guidance explaining how to tell when a written communication is genuine and when it is not, for example by looking for bad spelling and phrases such as ‘urgent action required’. They advise that phishing emails often include links to webpages that look official to trick you into disclosing confidential information or contain attachments which contain viruses designed to steal your personal information.

This latest publication provides actual examples of the different methods that are used to get you to disclose personal information, to try and raise further awareness of the problem. It includes a list of the typical email addresses used by the fraudsters as well as screen prints of phishing website homepages and text message contents.

Checklist of things to do if you receive a suspicious contact

• Check the current list of genuine HMRC contacts published here to see if the communication you have received is there.

• Forward suspicious emails to HMRC at phishing@hmrc.gsi.gov.uk and then delete them permanently from your computer/mail account. Email details of text messages/letters/phone calls to the same address.
• Do not click on websites, links contained in suspicious emails or open any attachments.

What if I have fallen victim?

• If you have reason to believe that you have been the victim of a scam, contact HMRC at security.custcon@hmrc.gsi.gov.uk. Include a brief outline of what you disclosed (e.g. name, address, HMRC User ID, password) but do not give your actual personal details in the email.
• You should also monitor your bank/credit card statements for unusual transactions and notify your bank/card issuer of any breach or unauthorised activity as soon as possible.

For more information on staying safe online go to ‘Get Safe Online’.

Useful links

HMRC guidance on phishing scams
HMRC examples of phishing scams 
HMRC contact page to help recognise phishing scams
Get safe online free guidance