How to check whether a message from HMRC or the DWP is real

How to check whether a message from HMRC or the DWP is real

"HMRC: you are due a tax refund of £342.18. Confirm your bank details here." Or the opposite: "Final notice: you have unpaid tax. Pay now to avoid enforcement action." Or the benefits version: "You are eligible for a cost of living payment. Apply here before it expires." Government departments make an excellent disguise for fraud: everyone knows them, nobody wants trouble with them, and their real procedures are complicated enough that a fake message seems plausible.

These campaigns come in waves and repeat the same skeleton as the fake DVLA vehicle-tax text and the fake parcel text: well-known organisation + money pending (in your favour or against you) + urgency + link. Learn to check one and you can check them all.

The key rule: don't deal with government departments through links in texts

Remember two things:

1. HMRC says it will never send a notification of a tax rebate, or ask for personal or payment information, by text message. HMRC and the Department for Work and Pensions (DWP) run their online services through GOV.UK, where YOU sign in with your own details (GOV.UK One Login or Government Gateway), or through official apps such as the HMRC app.
2. A genuine refund doesn't need you to "confirm your details" through a link. If HMRC owes you money, you should be able to see it when you sign in to your personal tax account or the HMRC app yourself, and HMRC won't ask for your card details by text.

Any message pushing you to tap a link to claim, pay or "settle" something with a government department is suspicious by default. Not because these departments never contact people, but because you never need a link in a message to deal with them: you can always go to GOV.UK and sign in yourself.

What the fake message looks like

• The tax refund. The most effective hook, especially in the run-up to the Self Assessment deadline on 31 January: "you're due a refund", with a specific, believable amount. It takes you to a fake site imitating GOV.UK, where you enter your personal and bank details.
• The debt or enforcement threat. "Final warning", "unpaid tax", "court action". It plays on fear rather than hope, but the destination is the same: your details and your card.
• The benefit payment. Texts offering a "cost of living payment", a "winter payment" or a benefit increase that you supposedly have to apply for through a link. The DWP pays Universal Credit, the State Pension and other benefits, which is exactly why scammers borrow its name.
• The account update. Variants asking you to "verify your National Insurance number" or "update your details" through a link. Less urgent on the surface, just as fake.
• Lookalike domains. Links containing "hmrc", "gov", "refund" or "dwp" plus hyphens and extra words, on a domain that doesn't end in gov.uk. Genuine government services are on GOV.UK: check that the site name in the address (the part before the first single "/") ends in gov.uk.
• A sender that proves nothing. As with every text: the sender can be faked and proves or disproves nothing.

How to check whether anything is real

The method is the usual one: close the message and go to the official channel yourself. With government departments it's even clearer, because the official channels are unique and well known:

1. Don't tap the link. Close it.
2. Go to GOV.UK yourself. Type gov.uk into your browser, or open the official HMRC app. Don't arrive via the link in the message or a hurried search.
3. Sign in and check. If there's a refund, a debt, a letter or a claim, you should find it in your personal tax account, the HMRC app or, if you claim benefits, your online account, such as your Universal Credit account. If nothing shows up, the message was fake.
4. If you're not comfortable online, call HMRC or the DWP on the official numbers you look up yourself on GOV.UK (never the one in the message).

If something genuine exists, you deal with it inside your official account. Never through a link in a message. It's exactly the same habit we recommend for checking whether a call or text from your bank is real (see our step-by-step guides). The official pages for HMRC's reporting routes and for the DWP are both on GOV.UK.

What to do if you've already tapped or given details

• You only tapped and closed it: almost certainly nothing happened. Forward the message as explained below, then block the sender and delete it.
• You entered card details: call your bank now, block the card and ask for a new one. Keep an eye on your statements over the following weeks.
• You entered your GOV.UK One Login or Government Gateway sign-in details: change your password as soon as possible by going to GOV.UK yourself, and check for activity or changes you don't recognise.
• Report it: forward suspicious texts that use HMRC's name to 60599 (charged at your network rate) and emails to [email protected]. Forward other scam texts, such as fake DWP messages, to 7726, which is free on most networks, and scam emails to [email protected] (GOV.UK guidance). If you've lost money, report it to Report Fraud (formerly Action Fraud) on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101.
• Report the sender's number in the spam numbers directory.

Quick questions

Can a text from HMRC about a refund be genuine? No. HMRC says it will never send a notification of a tax rebate, or ask for personal or payment information, by text message. If a text talks about a refund or asks for your details, treat it as fake and check by signing in to your account yourself.

And the DWP? The same principle applies: don't deal with anything through a link in an unexpected message. If you claim benefits, check your online account or call the DWP on a number you've looked up yourself on GOV.UK.

Are they more dangerous at certain times of year? Yes, because the context helps the scammer: in January, with the Self Assessment deadline on the 31st, lots of people are thinking about their tax and a "refund due" fits right in. At that time of year, be doubly suspicious of any tax message that includes a link.

Is an email with the official logo more trustworthy than a text? No. A logo can be copied in a minute and an email sender can be faked too. Apply the same rule: no incoming links; go to GOV.UK yourself.

If you've received one of these messages, report it in the NoCall spam numbers directory: these campaigns change their disguise with the season, and your report helps the next person spot the pattern in time.