Beware this new tax scam

by Donna Ferguson on 01 February 2010  |  15 comments
Tweet

If an email comes into your inbox today promising you a tax refund, don't get too excited - it's likely to be fake.

Fraudsters are sending out thousands of tax refund 'phishing' emails following the 31 January tax deadline, according to HM Revenue & Customs.

The email asks you to input your credit card or bank details into an online form, so that the rebate can be paid to you. But if you provide your details, your account will be emptied and your credit cards will be used to their limit, and you may also become a victim of identity fraud.

The massive upsurge in these emails could catch out many people waiting to hear about genuine tax refunds following the end of the tax-year yesterday.

What the email looks like

From: 'HM Revenue & Customs' <tax.refunds@hmrc.gov.uk>

Subject: You are eligible for tax refund

Following a review of your fiscal activity, you are due a tax refund of XXX. Please submit the tax refund request and allow us 2 -5 working days in order to process it.

To access the form for your tax refund, please click here. [This will open up a fake phishing website, such this one (PDF) or this one (PDF).]

Best regards

HM Revenue & Customs

You can view a fascinating, real example of this email reported to the HMRC here. As you can see, the email looks very real, complete with its fake HM Revenue & Customs logo, and 'tax refund ID'.

Often, the email addresses look genuine too, often ending in 'hmrc.gov.uk'. Here are some of the reported email addresses used to distribute the tax rebate emails, according to HMRC:

• tax.refunds@hmrc.gov.uk
• attached.form@hmrc.attached.gov.uk
• service@hmrc.gov.uk
• hmrcrefunds@hmrc.gov.uk
• refundsdept@ir-efile.gov.uk
• noreply@hmrk.co.uk
• customers@hmrc.gov.uk
• taxcredits@hmrc.co.uk
• officer.robinson@hmrc.co.uk
• securemail@hmrc.gov.uk
• hmrc@tax-revenue.uk

The fake phishing website you click through to can also look genuine, as this example demostrates.

How you can tell the email is a fake

Simple: HMRC never contacts customers who are due a refund by email. It only ever sends such a letter by post.

So even if the email looks as genuine as this one, it's likely to be a fake.

Similarly, it's worth knowing that HMRC never contacts taxpayers about refunds by telephone, and never uses external companies regarding refunds.

Basically, if it doesn't come in the post from HMRC, it's fake. End of story.

What to do if you receive an email

If you do get an email like this, you should send it to HMRC for investigation before deleting it. Forward all suspicious emails to HMRC at phishing@hmrc.gsi.gov.uk.

And if you have reason to believe you have been the victim of an email scam, report the issue to your bank/card issuer as soon as possible. If in doubt, please check with HMRC at http://www.hmrc.gov.uk/security/fraud-attempts.htm.

Get safe online

Remember, phishing emails are common for all sorts of issues. As a rule of thumb, never click on links contained in suspicious emails or open attachments. You can get more help via the Get Safe Online website or read our top 12 tips to keep you safe online. If you use online banking, you may also want to read Online banking: how to stay safe.