Beware scammy SMS messages claiming to come from HMRC

‘Tis the season for tax scams here in the UK, and it’s no surprise to learn that scammers are spamming out fraudulent messages posing as HMRC.

Unfortunately for the fraudsters, they don’t tend to target these types of attacks – which means that they can be received by people such as Nicola Simpson, of accountancy firm ENF Solutions Limited, who proactively warns her clients and business network when she spots a scam that might put them at risk.

In this case, Nicola received a suspicious SMS message:

HMRC: We are glad to inform you that you are eligible for your tax return, claim now: <LINK>

The intention of the scam message is, of course, to dupe unsuspecting tax payers into taking risky actions – such as entering their login credentials.

“The extension of the deadline for submitting your tax return to 28 February 2022 and the cost-of-living squeeze could make it very tempting for a person to click on this link to get access to their ‘tax refund’,” warned Nicola. “If you think you are eligible for a tax refund speak to your accountant, and if you don’t normally prepare a tax return then check your tax code.”

Nicola advises that HMRC would not contact you like this via SMS, and even if they did get in touch with news about your tax return they would quote your name and tax references in any correspondence.

If you think you’ve received a suspicious text message that might be a phishing scam, here is how you can report it to the NCSC.

In this particular case it looks like the URL has been reported to the authorities, and it is being blocked by leading web browsers. Of course, there’s little to stop scammers trying again – with different URLs and different messages – in their pursuit of the unwary.

It would be good to see more accountancy firms take the lead of Nicola Simpson of ENF Solutions, and proactively warn their clients about the scams they see.

Raising awareness of the problem helps keep the threat of phishing top of mind amongst the general public. You might well forget to file your self assessment tax return on time, but hopefully you won’t forget to be wary of unsolicited SMS messages.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.