City of London Police warned on Friday that fraudsters are impersonating HM Revenue and Customs in SMS refund lures timed to the October self-assessment rush, with reported losses on authorised push-payment routes climbing through September.
The messages typically promise a few hundred pounds in overpaid tax and instruct recipients to follow a link to "claim" funds. The URL leads to cloned HMRC pages that harvest gateway credentials and bank details. Investigators said the copy often references case numbers formatted like genuine PAYE notices, a tactic designed to survive quick glances on commuter trains.
Why October is peak season
HMRC opens registration for new self-assessment filers in October, and millions of taxpayers begin gathering P60s and dividend statements ahead of the January deadline. Scammers exploit the anxiety of missing penalties. HMRC reiterated it never requests banking data by text and that refunds appear automatically in online accounts.
Banks participating in the Confirmation of Payee programme have flagged mule accounts receiving micro-deposits from victims testing the fake portal. Police urged anyone who entered credentials to call their bank immediately and report to Action Fraud, even if no money left the account yet.
How to verify contact
Taxpayers should sign in only via gov.uk/hmrc and compare message sender IDs with published HMRC guidance. For businesses, payroll teams were told to brief contractors who recently moved to self-employment — a cohort less familiar with HMRC's digital channels.
The campaign is separate from romance fraud tallies Action Fraud published last month, but it shares the same infrastructure of burner SIMs and quickly rotated domains. NCSC advice remains: do not click links in unsolicited texts; forward suspicious SMS to 7726.
What banks are seeing
Major UK banks said Friday that refund-scam reports spike each October when self-assessment marketing emails land in inboxes alongside genuine HMRC reminders. Lloyds and Barclays both published blog posts urging customers to pause before authorising new payees after following text links. The City of London Police National Fraud Intelligence Bureau tracks domains within hours of first complaints, but criminals rotate URLs faster than takedown notices arrive.
Accountants belonging to the Institute of Chartered Accountants in England and Wales asked firms to send a one-page client alert before weekend work begins, noting that many sole traders file for the first time after leaving PAYE employment mid-year.