Newer Scam Tactics Layered on Top of Letters in 2026
Letters are rarely the whole story any more. HMRC-themed fraud has increasingly moved onto channels that would not have appeared in older scam guidance, and it is worth knowing what to watch for alongside the postal warning signs above.
- WhatsApp impersonation: messages arriving from a number with an HMRC-style display name, sometimes paired with an official-looking profile picture, claiming a penalty is owed or a refund is due, with a link or callback number attached.
- AI-generated “deepfake” voice calls: automated or AI-assisted calls that sound convincingly official, often used to follow up a letter and pressure a quick payment or disclosure of details.
- Fake HMRC social media accounts: profiles set up to look official, sometimes used to add credibility to a letter or message by appearing to confirm it.
HMRC does not initiate contact about tax owed or refunds due over WhatsApp, and it will not ask for banking details or security codes through any messaging app. If a WhatsApp message, deepfake-style call or social media account is used to reinforce a suspicious letter, treat the whole approach as unverified until checked independently through GOV.UK.
How to Check Whether an HMRC Letter Is Genuine
One of the most useful resources is HMRC’s Check if a letter you’ve received from HMRC is genuine service.
HMRC maintains information about recent genuine letters and campaigns. As of September 2026, this includes correspondence covering areas such as Self Assessment, National Insurance, Corporation Tax, tax repayments and outstanding amounts.
However, HMRC makes clear that not every genuine communication will necessarily appear on its published list.
A sensible verification process is:
- Do not make an immediate payment. Take time to verify what you have received.
- Check the details against your records. Compare the tax period, liability, reference numbers and payment history with your accounting records.
- Check your HMRC online account. Access it independently through GOV.UK rather than through a link or QR code in the letter.
- Search HMRC’s genuine contact guidance. See whether the type of letter or campaign is listed.
- Speak to your accountant or tax adviser. They may already have received correspondence or be able to reconcile the alleged liability.
- Contact HMRC independently. Use contact information obtained directly from GOV.UK rather than relying solely on the telephone number printed on a suspicious letter.
HMRC also publishes a broader list of genuine HMRC contacts, covering letters, emails, phone calls and text messages.
Do Not Ignore a Letter Just Because You Think It Is a Scam
This is an important distinction.
A suspicious letter should not be acted upon until it has been verified, but it should not simply be thrown away either.
If the correspondence turns out to be genuine, ignoring it could cause a relatively straightforward tax issue to become more serious.
Depending on the circumstances, failing to respond to genuine HMRC correspondence could result in additional interest, penalties, debt recovery action or escalation of a compliance check.
For example, HMRC may genuinely write to a company if it believes there is an issue with a Company Tax Return or an outstanding liability. Some letters specifically require the taxpayer to check previous returns, correct an error or explain why the return is accurate.
If an HMRC letter looks suspicious, the safest approach is neither to ignore it nor to comply with it immediately. Verify it independently first.
What Should You Do If You Receive a Suspicious HMRC Letter?
HMRC’s guidance says that if you receive a suspicious letter, you should contact the HMRC team that the letter claims to be from. Importantly, find the appropriate contact details independently through GOV.UK.
Keep the original letter while you investigate. It may be useful when reporting the scam and can help HMRC understand how its identity is being misused.
If the letter is followed by a suspicious email, text, WhatsApp message, social media account or telephone call, those contacts can also be reported.
HMRC says suspicious emails can be forwarded to [email protected], while suspicious HMRC text messages can be forwarded to 60599. Fake HMRC social media or messaging-app accounts can be reported to [email protected]. Suspicious HMRC phone calls can be reported using HMRC’s online reporting service.
Full reporting instructions are available on the GOV.UK HMRC scam reporting service.
What If You Have Already Paid a Fake HMRC Demand?
If you realise that you may have sent money to a fraudster, act quickly.
Contact your bank or payment provider immediately and explain that you believe the payment was made as a result of fraud. Depending on the payment method and circumstances, they may be able to take action to try to recover or stop the funds.
You should also report the fraud through the appropriate official channels. GOV.UK provides guidance on reporting scams and phishing.
Keep copies of the letter, envelopes, payment details, bank transactions, emails, phone numbers and any other communications associated with the incident.
What If You Have Given Away Your HMRC Login Details?
A scam does not necessarily need to involve an immediate payment to cause financial damage.
Fraudsters may be trying to obtain access to your HMRC online account or collect enough information to commit identity fraud later.
If you think someone has gained access to your HMRC account, HMRC advises reporting the suspicious activity immediately and changing your password if you still have access.
Warning signs can include receiving access codes when you have not attempted to sign in, being unable to log in because your password has changed, unexplained changes to your tax records, or unexpected correspondence and payments.
HMRC provides dedicated guidance on reporting suspicious activity in an HMRC online account.
HMRC Scam Letters Targeting Limited Companies
Company directors need to be particularly careful because information about UK limited companies is publicly available through Companies House.
A fraudster does not necessarily need to hack your business to find its company name, registered office address, incorporation date or directors. Much of this information can legitimately be obtained from the public register.
That means a letter containing your correct company name and director details is not automatically genuine.
Scammers may also imitate organisations other than HMRC. Limited companies can receive misleading correspondence relating to company registers, renewals, business directories, domain names and other services.
When correspondence relates to your limited company, check information directly using the official Companies House service and GOV.UK where appropriate.
What About Genuine HMRC Debt Letters?
HMRC does genuinely contact individuals and businesses about overdue tax.
A real tax debt should not be ignored simply because you cannot afford to pay the full amount immediately.
First establish that the liability is genuine and that the amount agrees with your records. If it does, deal with the issue as soon as possible.
Depending on your circumstances and the tax involved, HMRC may be able to discuss payment arrangements. GOV.UK provides a dedicated service for taxpayers who owe money to HMRC.
Businesses experiencing cash-flow problems should speak to their accountant before allowing tax liabilities to accumulate. VAT, PAYE, Corporation Tax and Self Assessment debts can become more expensive once interest and applicable penalties are added.
Can HMRC Letters Contain Deadlines and Penalties?
Yes. The presence of a deadline, penalty or warning of further action does not by itself mean that a letter is fraudulent.
HMRC administers statutory filing and payment deadlines across the UK tax system. Genuine correspondence may therefore explain penalties, interest or further action that could result from failing to meet an obligation.
The key is to verify the underlying tax liability or compliance requirement independently.
If a letter refers to a missed Self Assessment deadline, for example, check your tax return submission record and Self Assessment account. If it concerns Corporation Tax, compare it with the company’s accounting period, Company Tax Return and payment records.
If you disagree with a genuine HMRC penalty or tax decision, do not simply ignore it. There may be a formal review or appeal process with a specific deadline.
How Businesses Can Reduce the Risk of HMRC Scams
HMRC fraud should form part of your wider financial controls, particularly if several employees have access to company email, post or banking.
Practical precautions include:
- requiring unexpected tax payment requests to be independently verified before payment;
- restricting access to Government Gateway and HMRC online accounts;
- using strong, unique passwords and available account security measures;
- keeping bookkeeping and tax records up to date so unexpected liabilities are easier to identify;
- making sure staff know who normally deals with HMRC correspondence;
- checking changes to bank details or payment instructions independently;
- never sharing security codes or passwords with someone simply because they claim to represent HMRC;
- keeping your accountant informed of unexpected HMRC correspondence; and
- regularly reviewing HMRC online accounts for unfamiliar activity.
Good accounting records provide an additional layer of protection. If your bookkeeping, VAT returns, payroll records and tax payments are reconciled regularly, an unexpected demand is much easier to question.
A Practical Example
Imagine a limited company receives a letter stating that £4,750 of Corporation Tax is overdue and must be paid within 48 hours.
The letter looks professional and includes the company’s correct name, registered office and company number. It also provides a telephone number and QR code for immediate payment.
Rather than scanning the code, the director checks the company’s accounting records and sees that the Corporation Tax payment was made several weeks earlier.
The director then signs into the company’s HMRC account independently through GOV.UK and speaks to the company’s accountant. Finally, they use official HMRC contact information from GOV.UK to verify the position.
This process establishes whether the letter is genuine without making another payment or providing information to a potential fraudster.
The same principle applies even where the amount shown on a suspicious letter happens to correspond with a real tax liability. Correct information does not prove that the person asking for payment is HMRC.
Final Thoughts on Scam HMRC Communications
HMRC scam letters can be convincing because they imitate the type of correspondence businesses genuinely receive every day. A professional-looking logo, correct company details or an official-sounding tax reference should never be the only reason you trust a request for money or information.
At the same time, genuine HMRC correspondence should not be ignored. Tax debts, compliance checks, filing requirements and penalties can carry real deadlines and consequences.
The safest approach is simple: stop, check your records and verify the contact independently through GOV.UK before taking action.
If the letter is genuine, you can then deal with the tax matter properly. If it is fraudulent, you may have prevented a potentially costly scam.
Need Help With an Unexpected HMRC Letter?
Tax correspondence can be confusing, particularly when you are trying to work out whether a demand is genuine, whether a payment has already been made or whether HMRC’s records match your accounts.
If you receive an unexpected HMRC letter, avoid acting purely on the information contained within the letter. Check your records, verify the correspondence through official HMRC channels and speak to your accountant where appropriate.
At Accounting Wise, we help UK businesses, company directors and self-employed individuals manage their tax obligations, accounting records and HMRC correspondence. Having accurate, up-to-date accounts makes it much easier to identify when something does not add up.
