Essential Tips Alerting you that your email from HMRC is a fake

Whilst online be wary of Dick’s a trying to defraud you

In January, many accountants, including yours truly, were left confused by HMRC’s lack of communication about the demise of the payslip paper self-assessment reminder. Every day we were getting plaintive phonecalls from clients anxious to pay their tax, but who hadn’t had there reminders that included the payslip with all their details on.

So I phoned the Revenue and asked why no reminders had been sent out in January and I was told that at the beginning of January 2015 they’d decided to send emails instead. This arbitrary decision to change the system with only 2 to 3 weeks to go to the end of the tax season was as much nonsensical as it was arbitrary. It was also done without any publicity, not even any form of communication with the various accounting bodies.

Before I ended the conversation with the taxman, I asked him what they had done with regard to the many thousands of taxpayers that HMRC doesn’t have an email address for. All I got was an embarrassed silence and a lame “Sorry, but I’m not sure about that”.

I am also worried that increasing use of email might provide a new opening for “phishing” attempts, which I’ve covered in past Blogs. Accountants have been calling for years for HMRC to enter the digital age and use email to communicate more efficiently. But as HMRC has finally started to move in this direction, it does highlight an underlying data security issue: how can you tell what is a genuine HMRC digital communication, and what’s a potential scam?

This is the story so far on HMRC’s electronic communications with accountants and taxpayers:

Annual tax summary emails

HMRC has been sending some taxpayers email alerts, telling them their Annual Tax Summary is available to view.

Self-assessment email reminders

The Revenue began sending these from 16th January. If you’ve opted in to get digital instead of paper contact for Self-Assessment all communications in future will be by email alerts. These will not ask for personal of financial information.

HMRC will send two different types of email: Firstly, a verification email directly after you have signed up to its message service, and a second email which will tell you when there is a new message.

The Revenue advises that if there is a delay in getting the verification email, or you aren’t sure about its origins, log into HMRC Online Services and ask for a new verification email. Any other reminder messages won’t contain any personal information or links to login pages.

Tax credits letters from Concentrix

From November 2014, a company called Concentrix has been working on behalf of HMRC to check that taxpayers receive the correct amount of tax credits. Some will get a joint letter from HMRC and Concentrix telling them what they need to do. The company may also make contact via phone but any communications via this method won’t ask taxpayers to disclose any personal or payment info by text or email.

Tax credits text messages

Texts or voice texts prompts are now being sent to a number of tax credits claimants where income details to HMRC differ from information shown on employer records. The Revenue is asking taxpayers to call them on an 0300 number and these messages won’t ask for bank details or information not relating to tax credits income

Employer email alerts

HMRC sends informational emails several times a year to employers who have registered to receive them. These emails never ask you to provide personal or financial information.

PAYE notices and reminders

If taxpayers have set up email reminders and notifications using one of the options available in HMRC’s PAYE Online Service, they will automatically get an email when there’s something new to view.

HMRC has also started to send electronic reminders if your payroll submissions aren’t sent in on time, or if you’re late making payments.

Email warning notice may also be sent if HMRC holds records for taxpayers, and where they have yet to submit PAYE reports to HMRC in real time. These messages will inform the employer that they need to act now to avoid incurring penalties, and they should either advise HMRC if they no longer employ anyone, or start reporting in real time.

Educational emails

HMRC will periodically send emails to taxpayers which include links to online digital education material used to offer help. These will be from: [email protected].

So how do you tell an email is fake?

Be wary of dastardly practices

The Revenue has outlined some common characteristics fake emails tend to have:

✘ Poor spelling and grammar

✘ An email address that is similar to but not the same as HMRC’s email addresses. Fraudsters often have email accounts with HMRC or revenue names in them (such as ‘[email protected]’). In addition, fraudsters can falsify the ‘from’ address to look like a legitimate HMRC address (for example ‘@hmrc.gov.uk’)

✘ HMRC won’t ever send notification of a tax rebate via email or ask taxpayers to disclose personal or payment information via email

✘ Fake emails usually want urgent action. Be wary of emails containing phrases like ‘you only have three days to reply’ or ‘urgent action required’

✘ Fake emails will may have links to websites that look like HMRCs, but aren’t. This is to trick taxpayers into disclosing confidential information. Bogus webpages often contain links to banks/building societies, or display fields and boxes requesting your personal information such as passwords, credit card or bank account details

✘ False emails may sometimes even include genuine links to HMRC web pages to make their emails look real

✘ Use of generic greeting such as ‘Dear Customer’ and not your own name is something to watch out for

✘ Always be very wary of attachments as these could contain viruses designed to steal personal information.

✘ Other simple measures to take include having the latest version of any web browser and operating system you are using. Remember, on some systems like Windows XP, you may not have the latest security features. Ensure you have a good quality anti-virus and keep this up to date too.

There are some steps to take if you are unsure of an email. First check out these examples of fake and scam emails and communications on the HMRC website. Second, check for any of the above characteristics – and third, if you determine it is fraudulent, report it to the HMRC phishing team.