Website of the UK government

Spoofs and phishing attempts

Phishing is a fraudulent attempt, usually made through email, to steal your personal information. The best way to protect yourself from phishing is to learn how to recognise a phish.

Phishing emails usually appear to come from a well-known organisation and ask for your personal information — such as credit card number, social security number, account number or password. Often phishing attempts appear to come from sites, services and companies with which you do not have an account.

In order for internet criminals to successfully ‘phish’ your personal information, they must get you to go from an email to a website. Phishing emails will almost always tell you to click a link that takes you to a site where your personal information is requested.

The email usually contains a compelling but bogus reason to send money or personal details to a specific address or to go to a fake site (eg to update your password before your account is suspended). If you receive an email containing an embedded link that asks you to enter any personal details, treat it as suspicious and do not input any personal information.

HMRC is committed to maintaining high levels of security for all personal information it holds for its customers and will NOT send unsolicited emails requesting personal information.

Contact HMRC

If you have an email you believe to be a scam, forward it to HMRC at the following email address:

phishing@hmrc.gsi.gov.uk