Tax refund text from 'HMRC' — link looked very legit
SMS: 'HMRC: You are entitled to a tax refund of £284.50. Please claim within 48 hours at hmrc-refund-portal[.]com'.
Link goes to a near-perfect clone of the gov.uk design. It asks for your name, address, date of birth, NI number, sort code, account number, and online-banking login. Everything you need for a full account takeover.
Real tax refunds are paid into the bank account on file with HMRC, automatically, without a 'claim' step. Forward the text to 7726 (free) and report the lookalike domain to report@phishing.gov.uk.
1 reply
- Tom A.10 days ago
I've seen at least four variants of this domain in the last month — hmrc-refund-portal, hmrc-refunds-uk, hmrcrefund-2026, etc. NCSC's takedown service does eventually kill them but new ones spin up daily.
Add a reply
Anonymous replies are moderated and usually published within a few hours. Please don't include personal data or links.