The National Cyber Security Centre briefed major accounting networks on Wednesday about a wave of HMRC clone websites targeting self-assessment taxpayers and the agents who file on their behalf.
Officials said more than 2,400 phishing domains mimicking GOV.UK tax pages have been taken down since September, yet new registrations spike each Sunday night when fraudsters expect stressed filers to click refund links. The briefing coincides with HMRC’s reminder that paper returns for the 2025–26 tax year must reach HMRC by 31 January 2027.
How the scams work
Victims receive SMS or email messages promising rebates if they “confirm bank details” on a site that copies HMRC fonts and colour palettes. Some variants invite accountants to download a malicious browser extension that intercepts agent credentials used for Making Tax Digital software.
The NCSC’s Active Cyber Defence programme has been sinkholing the worst offenders, but criminals rotate hosting through bulletproof providers in jurisdictions with slow takedown cooperation. Clone kits sold on criminal forums now include Welsh-language templates, reflecting fraudsters’ focus on UK-specific lures.
Defensive steps
Practitioners attending the webinar were urged to enforce hardware security keys on all staff who can view client gateways, and to segregate email inboxes used for HMRC correspondence from general office mail. The Institute of Chartered Accountants in England and Wales plans to publish a checklist for smaller firms that lack dedicated security officers.
Consumers should forward suspicious texts to 60599 and emails to the NCSC’s phishing inbox. Action Fraud data show average losses near £3,800 when criminals use stolen agent logins to redirect genuine refunds.
Regulatory context
HMRC is piloting mandatory two-step verification for all agent services accounts by December. The move follows Ofcom’s broader online safety push, though tax phishing sits outside the scope of the Online Safety Act because messages are delivered via SMS rather than regulated platforms.
Banks participating in the Confirmation of Payee programme said they will flag payments to newly opened accounts when the payer name includes “HMRC refund,” a pattern seen in mule recruitment.
What filers should do now
Anyone expecting a rebate should log in only through gov.uk, check the address bar for the crown icon, and call HMRC from the number listed on official correspondence if unsure. With borrowing data dominating headlines, fraudsters are betting that a promised £400 “energy adjustment” will look plausible. Treat every out-of-band message as hostile until verified.