HMRC Warns of Surge in Tax Scams as Filing Deadline Looms

More than 135,500 scam reports have been filed with the UK tax authority since February 2025, including nearly 5,000 specifically targeting Self Assessment taxpayers as the January 31 deadline approaches. HM Revenue & Customs (HMRC) has warned that fraudsters are intensifying efforts to impersonate the tax office, using sophisticated tactics to harvest personal information and financial data from millions of taxpayers completing their annual returns.

Background and Context

The surge in scam attempts coincides with the annual Self Assessment filing period, when millions of UK taxpayers must submit their income tax returns by the January 31, 2026 deadline. According to HMRC, this timing is no coincidence: criminals exploit the natural urgency and anxiety surrounding tax compliance to increase their success rates. The tax authority has already been forced to shut down 25,000 malicious websites and phone numbers linked to these schemes over the past ten months, demonstrating the scale of the criminal operation targeting UK taxpayers.

Key Figures and Entities

HMRC's Chief Security Officer, Lucy Pike, has emphasized the organized nature of these criminal enterprises. "Millions of people file a tax return each year and scammers mimic HMRC to try and catch unsuspecting victims out," Pike warned in an official statement. The agency's response involves coordinated action across multiple enforcement channels, with dedicated teams monitoring and taking down fraudulent infrastructure as quickly as it appears.

Cybersecurity experts at Proofpoint, including EMEA cybersecurity strategist Matt Cooke, have analyzed the techniques employed by these criminal networks. According to Cooke's assessment, tax-themed scams prove particularly effective because they leverage both the trusted HMRC brand and the legitimate concerns taxpayers have about meeting their obligations. "Criminals are exceptionally skilled at crafting convincing lures that look legitimate, and because many of us expect to receive HMRC communications during tax season, we can be caught off guard," Cooke noted in his analysis of the threat landscape.

Legal and Financial Mechanisms

The fraudulent schemes typically follow well-established patterns designed to bypass normal security measures. Scammers impersonate HMRC through phone calls, emails, and text messages, often employing classic social engineering tactics such as threatening language about supposed tax debts or offers of bogus refunds. The ultimate objective ranges from direct financial theft through payments to criminals, to the installation of malware that enables ongoing exploitation of victims' devices and accounts.

Criminals frequently employ multiple channels in coordinated attacks, such as sending an initial phishing email followed by a voice phishing (vishing) call to increase credibility. According to security researchers, these operations increasingly use sophisticated techniques including spoofed caller ID systems and convincing replicas of official government websites. Payment demands often involve unusual methods like gift cards or cryptocurrency, designed to avoid detection and enable rapid fund transfers.

International Implications and Policy Response

The HMRC scam wave reflects a broader global challenge in securing public-facing government services against sophisticated criminal networks. While HMRC maintains robust defensive measures and actively pursues fraudulent operators, the sheer volume and persistence of attacks highlight systemic vulnerabilities in digital public services. The situation underscores the tension between making government services accessible and protecting citizens from increasingly sophisticated criminal enterprises that operate across international borders.

HMRC has emphasized that genuine communications will never ask for personal or financial information via text or email, request individuals to claim refunds through these channels, or leave threatening voicemails. The tax authority advises taxpayers to report suspicious communications through official channels and to exercise particular vigilance when receiving unexpected messages purporting to be from HMRC.

Sources

This report draws on official HMRC statements, cybersecurity analysis from Proofpoint, and public information about tax-related fraud prevention measures. The statistics referenced were released by HMRC as part of their ongoing public awareness campaign targeting Self Assessment taxpayers.