HMRC Tax Rebate Texts: The UK Scam Targeting Over-60s

The UK tax year ended on 5 April. Within 48 hours, my mobile pinged with this text:

"HMRC: You are eligible for a tax rebate of £274.90. Claim within 72 hours at [link]. After this period funds will return to the Treasury."

It looks official. The amount is oddly specific. The deadline creates urgency. And the link goes to a page that looks exactly like GOV.UK — right down to the crown logo and the black-on-white Transport typeface. I have been writing about this scam for years and I will admit the 2026 version is the best-made yet.

Here is the single sentence that defeats every HMRC scam text, email, or WhatsApp message:

HMRC will never tell you about a tax rebate by text, email, WhatsApp, or direct message. Rebates are issued automatically by cheque in the post or by direct credit to a bank account they already hold. There is nothing to click.

Say it out loud. Write it by the phone. That one rule protects you against every variation of this scam, no matter how polished the message looks.

Why the scam is everywhere in April and May

Two things converge every spring.

The UK tax year runs 6 April to 5 April. In early April, HMRC begins issuing genuine P800 tax calculations and refund notifications to people whose PAYE tax was over- or under-paid.
Scammers know this and flood the country with fake rebate messages in the same window, betting that the sheer volume of real HMRC activity will make their fakes blend in.

Action Fraud and HMRC's own data show tens of thousands of phishing reports per month during April and May, with seniors disproportionately targeted because over-60s are more likely to have multiple pension streams, PAYE adjustments, and the sort of mixed tax picture where a rebate genuinely makes sense.

The scammer is not guessing you have a rebate coming. They are betting that even if you don't, the message plants enough doubt to make you tap.

How the fake rebate message works

The scam has four stages.

Stage 1 — The text or email. You receive a message claiming you are owed a specific, oddly precise amount. Common amounts I've seen in 2025–2026: £227.40, £274.90, £312.85, £481.60, £512.30. The precision makes it feel computed rather than invented.

Stage 2 — The deadline. "Claim within 72 hours or funds return to the Treasury." This is a lie. HMRC does not claw back rebates on a 72-hour timer.

Stage 3 — The fake GOV.UK page. The link takes you to a site that looks identical to GOV.UK. The URL is often something like gov-uk-refunds.com, hmrc-rebate.co.uk, tax-refund-gov.net — close-sounding domains that are not the real gov.uk.

Stage 4 — The data grab. The fake page asks for your full name, date of birth, address, National Insurance number, bank account and sort code, and sometimes debit card details and online banking login "to verify the refund destination." Every field is used within hours to raid your account or sell on your identity.

7 red flags to spot the scam instantly

Red flag 1 — Any text or email claiming HMRC is giving you money. HMRC does not do this. Real refunds arrive as a P800 paper letter first.
Red flag 2 — A link in the message. Real HMRC communications never include a link for you to "claim" a rebate.
Red flag 3 — Urgency ("72 hours", "48 hours", "claim today"). HMRC does not work on sub-week deadlines for rebates.
Red flag 4 — An oddly specific amount. Scammers use precision to feel real. Ignore it.
Red flag 5 — Requests for your full bank login, card PIN, or 3-digit CVV. HMRC never asks for these.
Red flag 6 — A URL that is not gov.uk. The real HMRC sites all end in .gov.uk, never .com, .net, or .co.uk with extra words.
Red flag 7 — WhatsApp or Messenger messages claiming to be HMRC. HMRC does not use messaging apps. Block and delete.

What real HMRC actually does

The real HMRC will:

Send a P800 tax calculation letter in the post if you are owed a refund through PAYE, with clear instructions for claiming it through your Personal Tax Account on GOV.UK or by cheque.
Send occasional emails only if you have opted in through your Personal Tax Account — and those emails never ask for money or banking details.
Use the GOV.UK domain for all official services. The URL always ends in .gov.uk.

The real HMRC will never:

Text or email you about a rebate out of the blue.
Include a link for you to "claim" a refund.
Ask for your full bank details, card PIN, or online banking login.
Use WhatsApp, Messenger, Instagram, or any social media DM.
Threaten arrest, court action, or a National Insurance number suspension over the phone.
Demand payment by gift card, cryptocurrency, or iTunes voucher. (If you are reading this thinking "surely no one falls for that" — thousands do each year.)

What to do with a suspicious message

Do not tap the link. Even opening the page can fingerprint your device.
Forward the text to 7726 (the free UK mobile phishing-report number, which spells "SPAM" on a keypad). Your network provider feeds this into national takedown lists.
Forward the email to phishing@hmrc.gov.uk — HMRC's dedicated phishing report address. You do not need to write anything; just forward it.
Report to Action Fraud at actionfraud.police.uk or 0300 123 2040. This is the UK's national cybercrime-reporting centre.
Delete the message after forwarding it.

If you already clicked the link or entered details

Move quickly. In the UK, many banks can freeze a transaction if reported within hours.

Call your bank's fraud line immediately — the number is on the back of your debit card and is free from any UK mobile. Tell them you have been phished and ask them to block any pending transactions and issue a new card.
Change your online banking password from a different device — your laptop, a family member's phone, anything that is not the phone where you tapped the link.
Report to Action Fraud at 0300 123 2040 (Monday to Friday 8am to 8pm). You will receive a crime reference number, which the bank will need.
Report to HMRC at phishing@hmrc.gov.uk so HMRC can track the scam pattern.
If you gave your National Insurance number, check your Personal Tax Account at gov.uk/personal-tax-account for anything unusual, and consider signing up with Cifas Protective Registration (£30 for 2 years) which flags your identity as at-risk across UK financial institutions.

Check a suspicious message before you act

Not sure if a message is real? Paste the text into our free scam message checker — it flags phrases and link patterns used in HMRC impostor texts.

And if the fake site tricked you into entering a banking or GOV.UK password, run it through our password checker to see if it has appeared in any known data breach before you reuse it.

Older relatives, in particular parents living alone, are the prime target. Spend five minutes next visit:

Show them a real P800 letter if you have one, so they know what genuine HMRC post looks like.
Save phishing@hmrc.gov.uk in their contacts as "HMRC Phishing Report."
Save 7726 as "SPAM Report (Text)."
Agree one rule: "Any HMRC message on a phone, we forward to 7726 and delete. We never tap the link."

Frequently Asked Questions

Does HMRC ever send text messages?

HMRC occasionally sends informational texts (for example, appointment reminders), but never about a rebate, refund, or any message that contains a link for you to claim money. Any such text is a scam.

I am owed a real rebate — how will I find out?

HMRC sends a P800 tax calculation letter in the post if you are owed a refund through PAYE. You can then claim it through your Personal Tax Account at gov.uk/personal-tax-account or wait for a cheque.

Is phishing@hmrc.gov.uk a real address?

Yes. It is HMRC's official phishing-report inbox. Forward suspicious emails with no commentary needed.

What is 7726?

7726 is the free UK phishing-report number for mobile phones. It spells SPAM on a keypad. Forward any scam text to 7726 — your network provider uses the reports to block the sender.

Can I get my money back if I already gave bank details?

Often yes, if you move fast. UK banks can recall many fraudulent transactions if you report within hours. Call your bank's fraud line immediately — the number is on the back of your card.

Keep reading

Reviewed by Eleanor Shaw — techfor60s editorial desk, last verified 2026-04-18.