What to do if your HMRC account is hacked

HMRC lists four indicators on its unauthorised-access guidance, and the first is the one most people dismiss: account access codes arriving on your phone when you have not tried to sign in. A single stray code is worth checking. A pattern of them means somebody has your user ID and password and is being held out only by the second factor, which is a very thin margin.

The second is being unable to get in because the password has been changed. Distinguish this from the ordinary two-hour lockout that follows repeated failed attempts, which is automatic and resolves itself. If your password is simply rejected and the reset does not reach the email address you expect, treat it as compromise rather than forgetfulness.

The third is a change to your tax records that you did not make. In a personal tax account that could be your address, your name, an employment benefit such as a company car or medical insurance, a Marriage Allowance transfer, or a Self Assessment return filed on your behalf. Any of those alters what HMRC believes about you, and some of them move money.

The fourth is unexpected correspondence or payments from HMRC. A P800 tax calculation letter you were not expecting, a repayment notification for a claim you never submitted, or a Unique Taxpayer Reference issued to you when you have never registered for Self Assessment all belong here. HMRC publishes a collection describing genuine recent contacts by letter, email, text, phone and QR code, which is the sensible first check — with the caveat HMRC itself attaches, that not every genuine communication appears in it, so absence from the list is not proof of a scam.

Two further signs are not on HMRC's list but show up constantly in practice. One is a tax agent appearing on your record whom you did not appoint; the other is the bank account attached to a repayment claim not being yours. Both are the actual mechanics of monetising a hijacked account, and both are visible from the business tax account under 'Manage account'.

Finally, check the sign-in history. HMRC's guidance on keeping sign-in details safe explains that your account shows the date and time you last signed in, and that if that does not match what you did, you should contact the online services helpdesk. Do that check before you change anything, because once you start resetting credentials the record of the intrusion gets harder to read.

Secure your email account before you touch HMRC. Your email is the reset route for everything else, and the National Cyber Security Centre's account-recovery guidance singles out one thing to look for that almost everyone misses: forwarding rules and filters. A criminal who has been in your inbox will often leave a rule that silently forwards or deletes messages from HMRC and your bank, so resets and warnings never reach you. Delete any rule you did not create, then change the email password and turn on two-step verification.

Change the HMRC password if you can still sign in. HMRC's guidance is to change it immediately and then report. If you use the same password anywhere else, change it there too — the NCSC's point is that attackers try a working password across every service they can find you on, so one compromised credential is rarely confined to one account.

Do not correct anything. HMRC's published online security guidance says in terms that you should not attempt to correct anything in the account if suspicious activity is identified. Leave the fraudulent agent, the wrong bank details and the false return exactly where they are. Screenshot them instead, with the date visible.

Report it from the security console. Sign in to HMRC online services, open the security console and report the suspicious activity from there. This is the route HMRC has built for the problem, and it lands with the team that can put a marker on your record rather than with a general adviser reading from a script.

If you are locked out, use HMRC's online reporting form instead. It asks for your email address, a contact number with the times you can take a call, a description of the suspicious activity, and — for a business — the relevant tax reference. HMRC warns that the form does not save your progress, so assemble the dates, reference numbers and screenshots before you open it.

Then call your bank on 159 if any money has moved, or if the bank account details on your HMRC record have been replaced with an account you do not recognise. The 159 line connects you to your own bank's fraud team and cannot be spoofed, which is why it is also the number to use if someone claiming to be your bank has rung you off the back of this.

HMRC frames unauthorised access to your account as identity fraud, not as a technical support issue, and that framing determines the whole process. The report goes to a fraud function rather than a helpline. HMRC says it will conduct an initial review and aims to phone or email you within 10 working days, which is a target rather than a guarantee.

There are two front doors and they lead to the same place. The security console inside HMRC online services is for people who still have access; agents using it must have multi-factor authentication switched on. The standalone online form is for people who are locked out or who cannot reach the console. Nothing is gained by submitting both.

The form is deliberately broad about who can use it. It has fields for a business tax reference and for client authorisation details where someone is reporting on behalf of another person, which means an agent can raise a report for a client and a business can raise one for a scheme it operates. If you are reporting for someone else, have the authorisation details to hand.

On HMRC's side, the visible consequence of a confirmed compromise is a credential reset. HMRC's online security guidance for agents describes it sending a temporary password by email where it suspects unauthorised access, which must be changed at the next sign-in. If a message like that arrives out of the blue and you have not reported anything, that is itself a signal — either HMRC has spotted something you have not, or the message is a phishing attempt and belongs in an email to [email protected].

What the report does not do is fix your tax position on its own. The review establishes what happened to the account; unwinding a false return, a wrongly issued UTR or an incorrect tax code is separate work that follows it, and you will usually need to talk to the relevant tax line once the fraud team has confirmed the position. Keep the reference from the report — it is what turns a second conversation into a continuation rather than a fresh start.

Ordinary sign-in trouble is a different queue. If you have simply forgotten a user ID or password, or lost the phone that receives your access codes, HMRC's sign-in help explains how to reset those yourself and how to change the way access codes are delivered — text message, voice call or authenticator app. Lockouts from repeated wrong entries clear after two hours, and helpdesk advisers cannot lift them early.

The HMRC online services helpdesk is on 0300 200 3600, or +44 161 930 8445 from abroad, Monday to Friday from 8am to 6pm and closed on bank holidays. Relay UK users dial 18001 then the number. It handles technical problems with HMRC systems, error messages and online filing. It is the number HMRC's own sign-in security guidance points you to when your account appears to have been accessed without authorisation — but it is not a fraud investigation line, and it will route you rather than resolve it.

For anything about a Self Assessment record — a return you did not file, a UTR you did not ask for, a repayment claim in your name — the Self Assessment line is 0300 200 3310, or +44 161 931 9070 from outside the UK, on the same weekday hours. Post goes to Self Assessment, HM Revenue and Customs, BX9 1AS, United Kingdom, with no street address needed.

For PAYE matters, a tax code that has changed without explanation, or a P800 you did not expect, the Income Tax enquiries line is 0300 200 3300, or +44 135 535 9022 from abroad, again 8am to 6pm on weekdays. Relay UK is 18001 then 0300 200 3300. Post goes to Pay As You Earn and Self Assessment, HM Revenue and Customs, BX9 1AS.

The HMRC fraud hotline on 0800 788 887, or +44 203 080 0871 from outside the UK, Monday to Friday 9am to 5pm, is frequently misused for this. It is for telling HMRC about someone else's tax evasion, and HMRC asks that such reports go through the online form or the hotline and not by post or webchat. It is not the route for reporting that your own account has been taken over.

The phishing routes are separate again and worth using in parallel. Forward suspicious emails to [email protected], suspicious texts to 60599 at your normal network rate, and fake HMRC social media accounts to [email protected]. Suspicious phone calls go through a dedicated online form. HMRC says it may share the email address and phone number you report with other organisations in order to shut the scam down.

One rule cuts across all of them. HMRC will only ever email you about a rebate, or ask for personal or payment information by email, from an address ending hmrc.gov.uk, and it will never notify a rebate or ask for payment details by text message. Any message that breaks either rule is fraudulent regardless of how convincing the rest of it looks.

Understanding why criminals want your HMRC account explains almost everything about what they do inside it. The account is a payment instruction. A repayment claim submitted through it carries a bank account field, and HMRC's published timings for a P800 refund are that an online bank transfer claim is paid within five working days. A requested cheque takes around six weeks, and an automatic cheque arrives within fourteen days of the letter. Only one of those three is fast enough and anonymous enough to be worth a criminal's time, which is why the bank details are the target.

That produces the classic pattern: a repayment claim you never made, paid to an account you have never held, evidenced by a letter that arrives after the money has gone. The equivalent in Self Assessment is a return filed in your name claiming expenses or reliefs you never incurred, generating an overpayment that is then directed elsewhere. In both cases the fraud is complete before you know the account was open.

Where a Unique Taxpayer Reference has been used to submit a repayment claim that HMRC thinks may not be genuine, HMRC's practice is to write before paying anything and require the claim to be verified. That letter is genuinely alarming to receive when you have done nothing, and the important thing is that it is a security check on the claim rather than an accusation against you — but it does carry a response window, and a letter ignored has consequences for the record and the reference it relates to. If a letter of this kind arrives, ring the Self Assessment line on 0300 200 3310 rather than waiting.

The instinct to pay something back is strong and usually wrong. Nothing has been paid to you. A repayment issued to a criminal's bank account on a claim you did not make is money that left HMRC, not money that reached you, and the tax position it purported to correct is unchanged. The correct posture is to establish, through the unauthorised-access report, that the claim was not yours — not to negotiate over a sum you never received.

One important distinction sits next to this and is regularly confused with it. A claim submitted by a repayment agent you did sign up to — often through an online form, a social media advert or a high-street stand, sometimes with a deed of assignment attached — is a claim made on your authority, however little you understood it at the time. If HMRC later decides that claim was overstated, it can come back to you for the tax, and it is not the same situation as an account takeover. Check any correspondence carefully to work out which of the two you are actually in.

Keep everything. The date you noticed, the screenshots taken before you changed anything, the reference from your HMRC report, the crime reference number, the letters, and a note of every call with the date and the adviser's name. A repayment fraud can take months to unwind across the tax record, and the paper trail is what stops you re-explaining it from scratch each time the file moves to a new person.

A fraudulent agent authorisation is one of the more damaging things a criminal can leave behind, because it survives you changing your password. An authorised agent can deal with HMRC on your behalf and see your record, and it persists until it is actively removed. You can see who is authorised from your business tax account: 'Manage account', then 'Add, view or change tax agents' under the tax agents heading.

Removal is per tax rather than global, which catches people out. You select the tax the agent is authorised for — Self Assessment, employer PAYE, VAT or Corporation Tax — then 'manage agents', then 'remove', then confirm. HMRC's guidance adds that removing an agent from Self Assessment does not remove them from Making Tax Digital for Income Tax, which has to be done separately, and that for PAYE and VAT the online removal stops digital access but you must also write and telephone to stop the agent dealing with HMRC in writing or over the phone.

There is a postal route to the Central Agent Authorisation Team where the online one will not work, and what you enclose depends on the tax: your personal UTR for Self Assessment, the employer scheme reference for PAYE, the VAT number for VAT, or the company's UTR for Corporation Tax. Send the correct reference or the request will not be actioned.

Sequencing here is a genuine judgement call rather than an obvious one, because HMRC's security guidance says not to correct things yourself while its own agent guidance explains how to remove an authorisation. The reconcilable reading is that you report first, mention the fraudulent authorisation explicitly in the report, and remove it once HMRC has acknowledged it — unless it is actively being used, in which case stopping the access wins and you record what you did and when.

A Self Assessment record opened in your name is a different kind of problem, because it creates obligations. A UTR issued fraudulently generates filing expectations and, eventually, penalties for returns nobody intends to file. Do not simply ignore it and do not file a nil return to make it go away — say plainly in the unauthorised-access report that the registration was not yours, and follow it up on the Self Assessment line. HMRC has a route to close a record and the reference attached to it where the registration was fraudulent, and it is HMRC's job to unwind it rather than yours to comply with it.

Then sweep the rest of the record for things that are quieter but still costly. In a personal tax account a criminal can change your address, your name, your Marriage Allowance and reported employment benefits such as a company car or medical insurance, any of which distorts your tax code and your take-home pay for the rest of the year. Check your National Insurance record and your reported income for the last few years while you are there, and confirm your address is yours — a changed correspondence address is how future letters get intercepted.

Tax is reserved across the whole United Kingdom, so the HMRC side of this is identical wherever you live — the same account, the same security console, the same helplines, whether you are in Cardiff, Coleraine, Carlisle or Cumbernauld. Scottish Income Tax is paid to the Scottish Government but is collected by HMRC through the same record, so a compromised account carries exactly the same exposure for a Scottish taxpayer.

The criminal reporting side is where the map changes. In England, Wales and Northern Ireland, fraud and cyber crime are reported to Report Fraud, the national reporting service that succeeded Action Fraud, online at reportfraud.police.uk or by phone on 0300 123 2040. In Scotland, Report Fraud does not operate and fraud is reported directly to Police Scotland on 101, or 999 if a crime is in progress.

Make the crime report even if no money left your own bank account, and even if you think HMRC will handle it. It produces a reference that banks, lenders and insurers ask for, it feeds the national intelligence picture that links your case to others using the same accounts and methods, and it is the document that makes the difference months later when you need to prove to a third party that you were the victim of a specific crime rather than someone with an untidy tax record.

The offences are real ones. Section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform any function with intent to secure unauthorised access to programs or data, knowing the access is unauthorised, and it extends across the whole United Kingdom with a maximum of two years' imprisonment on indictment. Section 2 of the Fraud Act 2006 covers fraud by false representation — dishonestly making a representation known to be untrue or misleading, with intent to make a gain or cause a loss — and it expressly catches a representation submitted to any system or device designed to receive communications, which is precisely what an online repayment claim is.

The wider campaign infrastructure is worth knowing about because it consolidates the routes. Stop! Think Fraud is run by the UK government with City of London Police, the National Cyber Security Centre and the National Crime Agency, and its reporting page lists the whole set in one place: Report Fraud and Police Scotland for the crime, 159 for your bank, [email protected] for phishing emails, 7726 for suspicious texts, and the HMRC-specific routes alongside them.

Report the phishing that got them in, if you can identify it. Most HMRC account compromises start with a convincing message rather than a technical attack, and the message you nearly fell for — or did — is useful intelligence. Forward it to [email protected] if it impersonated HMRC, or to [email protected] if it impersonated anything else.

Treat a compromised HMRC account as a data breach against you rather than an isolated login problem. Whoever got in had enough of your identity to satisfy HMRC that they were you, which means they hold a usable set of your details and can try the same trick elsewhere. Cifas Protective Registration places a marker requiring lenders and other Cifas members to carry out extra verification before granting credit in your name; Cifas prices it at £30 for two years and is candid that it will slow down your own genuine applications as well.

The credit-file work that follows — which agencies to check, how to dispute an account you did not open, how a notice of correction works — is covered in full in our guide on what to do if your identity is stolen in the UK, and there is no sense in doing it twice. Read that alongside this one; the two problems overlap almost completely once the HMRC-specific steps are done.

Protect the National Insurance number specifically. HMRC's unauthorised-access guidance flags safeguarding it as a protective step, and it is worth understanding why: the number is effectively permanent, it is the key that links your employment, tax and benefit records, and unlike a card number it cannot be reissued because it was misused. It is one of the few identifiers you cannot replace, which makes controlling where it goes from here the only available defence.

Turn multi-factor authentication into something that actually protects you. Most HMRC accounts already use a single-use access code after the user ID and password, and HMRC's own guidance is that this protects the account even if somebody has discovered your sign-in details. The weak point is the 'remember me' setting, which skips the code for seven days on that device — convenient on a laptop only you use, a standing invitation on a shared or work machine. Prefer an authenticator app over text codes, since a code delivered by SMS is defeated by a SIM swap.

If HMRC handles the aftermath badly — the report goes nowhere, a penalty is charged for a return you never had to file, the same explanation has to be given six times — there is a formal route and it is worth using. HMRC operates a two-tier complaints process: a first-tier review of what happened and what should have happened, then a second-tier review by a different person, whose decision is final within HMRC. HMRC may refund reasonable costs such as postage, phone charges and professional fees if you keep the receipts.

After the second tier, the Adjudicator's Office will review the complaint independently. It investigates complaints about HMRC and the Valuation Office Agency, it is free, and it cannot look at anything until both HMRC tiers are exhausted. It is on 0300 057 1111, Monday to Friday 9am to 5pm, with post to The Adjudicator's Office, PO Box 11222, Nottingham NG2 9AD. Beyond that, the final route is asking your MP to refer the complaint to the Parliamentary and Health Service Ombudsman.

Finally, give yourself permission to find this harder than it looks on paper. Being locked out of your own tax record while an unknown person operates it is a specific and unpleasant kind of powerlessness, and the ten working days HMRC allows itself for an initial review is a long time to sit in it. Do the two things that stop further loss — email and bank — file the report properly, keep the paper, and let the rest run at the speed it runs at.