TL;DR: Scammers copy tax and government agencies to send fake refund and "verify your details" messages. HMRC asks people to forward suspicious texts to 60599 and emails to phishing@hmrc.gov.uk, and says genuine refunds can be claimed through your HMRC online account or app. The ATO says it and myGov never send an SMS or email with a link to access online services: go to ato.gov.au or my.gov.au yourself and report impersonation to ReportScams@ato.gov.au.

👉 Check my digital footprint — free 30-second check →

Tax season gives scammers the perfect excuse. People expect a refund or a letter, they worry about a deadline, and government sender names are easy to copy. The two agencies below have both published clear rules, and the rules are similar.

United Kingdom: HMRC

HMRC has warned that scammers impersonate it to offer fake refunds or demand urgent payments, and that they may say it is safe to share personal details. It is not, and passwords, usernames and access codes should never be shared, even with someone who helps with your tax, according to an HMRC press release on GOV.UK. It adds that anyone due a refund can claim it securely through their HMRC online account or the free HMRC app, and that scammers target people around Self Assessment filing time.

Which? says HMRC told it that it will never notify you of a tax rebate, or ask for personal or payment details, by email or text. HMRC does sometimes phone people about outstanding tax bills, and automated calls will include your taxpayer reference number. Scammers may spoof the sender name so "HMRC" appears on your phone, and some threaten an arrest warrant.

Australia: the ATO and myGov

The Australian Taxation Office lists lures on its scam alerts page such as "you need to update your details to allow your tax return to be processed", "we need to verify your incoming tax deposit", "refund failed due to incorrect BSB or account number" and "your income statement is ready, click on the link". It says the ATO and myGov will never send you an SMS or email with a link to access online services. Type ato.gov.au or my.gov.au into your browser yourself.

The pattern behind all of them

  1. A link that takes you to a login or "verification" page.
  2. A refund or a threat, either money you are owed or a penalty you must pay now.
  3. A clock: hours or a day to act.

The safe move is identical in both countries: leave the message, type the government address yourself, or open the official app. If you have already entered details, change the password, tell your bank and report the message. Recovery routes are explained in UK Action Fraud reporting and reimbursement rules and the Australian Scamwatch and IDCARE process.

The same script targets other countries: see NZ tax refund scams, the CRA impersonation and Bitcoin ATM scam in Winnipeg and the UK's TV licence direct debit email. For a general checklist, read how to spot and report phishing.

FAQs

Does HMRC send text messages about tax refunds?

HMRC told Which? it will never notify you of a tax rebate, or ask for personal or payment information, by email or text. Anyone due a refund can claim it through their HMRC online account or app.

Where do I forward HMRC scam texts and emails?

Forward suspicious texts to 60599 and suspicious emails to phishing@hmrc.gov.uk. You can report scam phone calls through GOV.UK.

Does the ATO send SMS messages with links?

The ATO and myGov say they will never send an SMS or email with a link to access online services. Type ato.gov.au or my.gov.au into your browser yourself.

How do I report a myGov or ATO scam?

Report ATO impersonation to ReportScams@ato.gov.au and then delete the message. Report other scams to Scamwatch. If you gave your myGov login, change the password immediately.

What should I do if I entered my details on a fake tax page?

Change the password for that account and any account that reuses it, contact your bank if you shared banking details, and report the message to the relevant agency.

How can I claim a real HMRC refund?

HMRC says you can claim a refund securely through your HMRC online account or the free HMRC app, rather than through a link in a message.

To see whether your email or phone number is already circulating in leaks used for these messages, run the free digital footprint checker.

Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.

Sources

Related Reading