It’s the phishing season again. Since lots of people filed their tax returns in recent weeks, the criminal fraternity is out to benefit. They are sending out emails suggesting people are due refunds.
Should you read no further, get this – HMRC NEVER EMAILS TO SAY YOU ARE DUE A TAX REFUND.
Read on if you want some background.
We all see these emails which purport to come from our bank and to alert us to something. It’s great when we know we don’t have an account with that bank – we know it’s fake. The situation is less clear where the supposed sender is your own bank, or some ‘trusted’ organisation like HMRC.
What these people want to do is have you read the email and click on some link. Therein lies the problem. Click on the link and you might be downloading something nasty to your computer. It might start telling someone what keys you press (hence revealing your passwords and indeed all correspondence). This is called key-logging.
The other thing the email will try to trick you into doing is entering your security details or bank / card details. The surprising thing then is that rather than nice stuff happening, you find your bank account has been cleared out, or charges put on your card.
So what’s the tax angle on all of this?
At various times of the year, but especially in February and March, emails arrive saying they are from HMRC. They can have convincing email addresses, HMRC logo, all the right colours etc. These generally say that having reviewed your tax affairs you are eligible for a tax rebate. Sometimes they talk about your ‘fiscal activity’ – not even the most nerdish civil servant would use such a phrase. They invite you to click a link and/or download a form to process your rebate. They will also say exactly how much you are due. Bit like PPI texts – putting an amount of money in the email makes the thing seem attractive.
I received one of these emails this week and it was better than many at trying to trick me. It quoted what looked like a legit HMRC email – I won’t give the address the oxygen of publicity! It was even signed off by a named member of staff, with a Western sounding name. My email did however have some clues:
- The day was spelled incorrectly
- I know that HMRC email addresses (used only by the chosen few) have .gsi in them
- It talked about ‘fiscal activity’
- It quoted a rebate number which was not my tax ref
- The amount was shown as J123.45 rather than £123.45, and, most importantly,
- I know that HMRC never emails about refunds.
By the way I predict these fraudsters might move onto threatening emails about tax bills. Again I stress HMRC will not email you about a tax demand. Only if your specific tax debts are the subject of ongoing correspondence might a named HMRC officer give you their email address. Then it would be OK to use email, but this would be extremely rare. Correspondence about tax debts will come by post. (Or in person if you are really naughty!)
ACTION PLAN
- If you receive one of these emails then forward it to HMRC (who are daily closing these things down). Simply forward the email to phishing@hmrc.gsi.gov.uk
- If you have received an email and may have entered personal details like User ID, national insurance details or tax reference then you must contact a different part of HMRC at security.custcon@hmrc.gsi.gov.uk
- If you have supplied bank details for your ‘refund’ then contact the bank asap.
So in summary:
- HMRC never ever emails about tax refunds.
- HMRC will not email you about tax debts.
- If you get such an email report it as above.
- Never click on a link in an email supposedly from HMRC about your tax position.
Adrian Huston, a former tax inspector, is a director of Belfast tax and accountancy firm Huston & Co – www.huston.co.uk or 028 9080 6080.