What HMRC actually says: HMRC's SMS-contact policy changed on 27 April 2026 — the old blanket rule that any HMRC text was automatically a scam no longer applies. But HMRC will never ask for personal or financial information in an SMS reply or via a link in a text.
How the fake refund text works
Step 1
The plausible timing
Texts spike right after the tax year closes, when a genuine refund is on many people's minds — the scam exploits that timing deliberately.
Step 2
The specific figure
A precise-looking refund amount makes the message feel individually calculated, not mass-sent.
Step 3
The lookalike site
The link opens a page mimicking GOV.UK, asking for bank details to "process" the refund.
Step 4
The theft
Entering your details there sends them straight to the scammer — HMRC never needed a link to pay a genuine refund.
How to spot it
- Any request for bank or personal details: This is the one absolute rule — genuine HMRC texts, where they now exist, never ask for this via a reply or a link.
- A link asking you to "claim" a refund: Real refunds are paid automatically into your account on record, or confirmed through your own Government Gateway login — never claimed by clicking a link someone sent you.
- Urgency around a filing deadline or penalty: A common pressure tactic layered onto the refund bait.
What to do if you get this text
- Don't click, don't reply with any information.
- Report it: Forward the text to 60599 (standard network rates apply), or forward phishing emails to phishing@hmrc.gov.uk.
- Check the real way: Log into your Government Gateway account directly at gov.uk, typed manually, to check any real refund status.
Egidio: your automatic phishing detector
These texts work because they land exactly when a real refund is plausible. Egidio catches the fake link before it can do anything.
Egidio screens incoming calls and scans links arriving through your messaging apps in real time. When it recognises a fake HMRC or government site, it blocks the page before it loads.
Install Egidio