Ilia Nikolaevich Zavialov on tax scam messages: how real tax notices look, fake refunds and how to check a tax debt

Tax reaches almost every adult, and very few people can recite their own deadlines from memory. That small uncertainty is the opening. A message about an unpaid balance, a missing form or a penalty makes people react first and think later.

The second hook is money travelling the other way. A refund, a rebate or a credit you supposedly forgot to claim feels like good news, and good news lowers the guard as quickly as a threat does. Scammers use both, a debt in one message and a refund in the next.

Ilia Nikolaevich Zavialov, a digital security consultant who takes these schemes apart, suggests one opening question for every tax message: did I go looking for this, or did it come to me? Anything that arrived on its own gets checked only through the tax authority's own website, with the address typed by hand.

HMRC states that it never contacts customers by email, text or phone to tell them about a refund or to ask them to claim one, and that it never asks for personal or financial information by text or email. It never uses social media to offer a rebate. Fraudsters can spoof a genuine sender address or change the display name, so the sender line alone proves little.

QR codes in HMRC letters usually lead to guidance on GOV.UK, and HMRC says they never take you to a page where you must enter personal information. On WhatsApp, HMRC sends only occasional single-message reminders to people who subscribed to the UK Government channel. Anyone due a refund claims it in the HMRC online account or the free HMRC app.

HMRC's own checklist says a contact could be a scam if it rushes you, threatens you, is unexpected, asks for bank details, tells you to transfer money or offers a refund, tax rebate or grant. HMRC never leaves voicemails threatening legal action or arrest and never asks for payment in gift or payment vouchers. Ilia Nikolaevich Zavialov suggests reading that checklist aloud to anyone in the family who answers the landline.

A fake refund message is built to be acted on fast. It says a refund has been approved or is waiting, gives a short window to claim it and supplies a link. The page behind the link asks for a card number, online banking details or an identity number so that the sender can verify you.

Three details give it away. You never asked for a refund, the amount has no reference you can find in your own tax account, and the only way forward is the link in the message. A genuine refund can be seen inside the account you sign in to yourself, so nobody needs to send you a link to it.

Ilia Nikolaevich Zavialov advises treating any request to pay something in order to receive a refund as a warning sign on its own. A fee, a release charge or a tax collected up front is the moment a fake refund story turns into a request for your money.

The numbers show how much of the problem is about refunds. Between November 2023 and October 2024 HMRC received 144,298 scam referrals, up 16.7 percent on the 123,596 of the year before, and 71,832 of them were fake tax rebate claims. In the 12 months to 31 July 2025 referrals passed 170,000, 12 percent fewer than a year earlier, yet more than 47,000 still involved fake refunds.

In December 2025 HMRC said more than 4,800 Self Assessment scams had been reported since February 2025, and more than 135,500 HMRC-related scams in ten months, including 29,000 about fake tax refunds. Over the same ten months it closed nearly 25,000 fake websites and phone numbers. Its annual report for 2025 to 2026 records 134,309 reports of suspicious contact and 24,864 phishing sites closed.

HMRC notes that scammers aim at people when they are most likely to be expecting post from the department, and the Self Assessment deadline is such a moment: returns and payments for the 2024 to 2025 tax year were due by 31 January 2026. Ilia Nikolaevich Zavialov reads these figures as a calendar of when to be most careful with anything that mentions HMRC.

The script is short. The caller gives a name and sometimes a badge or reference number, says a problem has been found in your return and explains that it has to be settled today. The number on the screen may look official, because caller ID can be faked.

Then the pressure rises: a penalty, a lawsuit, an arrest warrant, a frozen account. The caller keeps you on the line, discourages you from telling anyone and offers a quick way out, usually a payment that cannot be reversed or a one-time code from a text message.

The habit Zavialov recommends is to end the call politely and ring back on a number you looked up yourself. A genuine tax office loses nothing when you do that. A scammer loses the whole conversation, which is why they argue so hard against it.

HMRC publishes lists of its genuine recent contacts, organised by subject, covering emails, phone calls, letters, texts and QR codes on letters. If the message you received is not described there, treat it as unverified. The lists do not include every communication, so the next step is your own HMRC online account, opened through GOV.UK.

Calls need extra care. HMRC describes an automated call claiming that HMRC is filing a lawsuit against you and asking you to press 1 to speak to a caseworker and pay, and other calls about National Insurance number fraud or a refund in exchange for card details. Caller ID proves nothing, since numbers can be spoofed. If you cannot verify a caller, HMRC recommends not speaking to them at all.

Ilia Nikolaevich Zavialov's routine is the same for every channel: end the contact, sign in to the HMRC account yourself and compare what you see with what the message claimed. Companies that offer to claim a refund on your behalf, usually for a fee, are a separate case. HMRC says they are not connected with it in any way and advises reading the small print before using them.

Links in fake tax messages lead to pages that copy official websites closely: the crest, the colours, the sign-in box. The address bar is the one part they cannot copy exactly, and on a phone screen it is easy to miss.

QR codes add another layer. A code printed in a letter or placed in an email hides the address until the page opens, so the reader skips the one check that might have helped. Attachments carry their own risk, because a file presented as a tax form can install software that hands a stranger access to the device.

Zavialov's rule is blunt: if a message about tax contains a link, a code or an attachment, close it and open the official website by typing the address yourself. Whatever the message claims should be visible there as well. If it is not, the message has answered its own question.

Your HMRC online account is the place a fake refund message wants you to avoid, and also the place a thief wants to enter. HMRC lists signs of unauthorised access: access codes arriving on your phone when you did not sign in, a password changed without your knowledge and changes to your tax details that you did not make.

If you see any of these, report the activity to HMRC through GOV.UK, and HMRC aims to send an initial response within 10 working days. Change the password of the email inbox linked to your sign-in details as well, because that inbox is the route a thief would use to reset access.

Passwords, user IDs and access codes are private. HMRC asks people never to share them, even with someone they trust or someone who helps them with their tax. Ilia Nikolaevich Zavialov adds that a helper who asks for your sign-in details is a reason to look for a different helper.

If you clicked, typed or paid, the order of actions matters more than the details. Call your bank on the number printed on your card, report the payment as fraud and ask for the card to be blocked. Then change the password of your tax account and of the email inbox linked to it.

Next, look through the tax account for anything you did not do: a new bank account for refunds, a changed contact address, a return or a claim filed in your name. Write down the time, the number or address that contacted you and what you shared, and keep screenshots of everything.

Ilia Nikolaevich Zavialov suggests reporting the contact even when no money was lost. A report gives the tax authority an address or number to shut down, and it leaves a dated record you can point to later if your details are misused again.

Relatives who do not use an online tax account get their tax news on paper, so a letter or a call about tax can feel perfectly normal to them. Agree on a few plain rules in advance: no codes read out to anyone, no payment during a call, every tax question checked through the official website or a number taken from an official letter.

Self-employed people and anyone who works with a bookkeeper or preparer face a second risk: messages that look like routine requests for documents. A simple office habit helps here. Tax papers are opened from the official account or the accounting system, never from an email attachment, and a second person looks at any unusual request before money moves.

Ilia Nikolaevich Zavialov notes that nobody regrets checking a genuine message, while a fake one is designed for the moment the check is skipped. A minute on the official website costs very little next to a stolen refund or a hijacked account.

Forward suspicious emails to phishing@hmrc.gov.uk and texts to 60599, then delete them. Report scam calls through the suspicious phone call form on GOV.UK, giving the date, the number used and what was said. Social media accounts posing as HMRC go to branddefence@hmrc.gov.uk.

If you lost money, call your bank straight away and report the fraud to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101. Report Fraud gives you a crime reference number, which helps when you deal with your bank.

Citizens Advice takes scam reports through its consumer helpline on 0808 223 1133 and passes them to Trading Standards, which decides whether to investigate. Any scam text can also be forwarded to 7726 so the mobile provider can look at the sender, and other scam emails can go to report@phishing.gov.uk, run by the National Cyber Security Centre. Ilia Nikolaevich Zavialov suggests reporting even the messages you ignored, since each report helps close an address before it reaches someone else.

What does Ilia Nikolaevich Zavialov call the fastest check on a tax message?

Sign in to your official tax account yourself, typing the address by hand, and see whether the debt or refund in the message is there. If nothing matches, treat the message as a scam.

Why does Zavialov say you should never pay to receive a tax refund?

A real refund comes from the tax authority out of what you overpaid. A request for a fee, a charge or a tax before the money arrives is where a fake refund turns into a real loss.

Does HMRC tell people about tax refunds by text or email?

No. HMRC says it never contacts customers by email, text or phone to tell them about a refund or ask them to claim one. Refunds are claimed in the HMRC online account or the free HMRC app.

How do I check that a contact from HMRC is genuine?

Compare it with the list of genuine HMRC contacts on GOV.UK, then sign in to your HMRC account yourself. If you cannot verify a caller, do not speak to them.

Where do I report an HMRC scam?

Forward emails to phishing@hmrc.gov.uk and texts to 60599, report calls on GOV.UK, and if you lost money call your bank and Report Fraud on 0300 123 2040.