COVID-19 HMRC scams are on the rise! What should you do?

Edward Parker FCCA discusses what you should be on the look out for when it comes to new, fraudulent communications during COVID-19.

With the world struggling to cope with a new way of life brought on by coronavirus, and one that could change the way we live and do businesses, some people are seizing the opportunities available! Unfortunately some are using this innovation for deceptive means.

The UK’s National Cyber Security Centre has reportedly taken down over 2,000 online coronavirus scams in March 2020, and so far a massive £1.6m has been lost to fraudulent claims. These numbers are likely to increase as time progresses, and this does not necessarily account for the other scams we have seen throughout the year.

Coronavirus (COVID-19) HMRC scams

There are digital criminals posing as HMRC looking to benefit from an individual's lack of knowledge on newly introduced schemes by the government. These include:

1. The Coronavirus Job Retention Scheme

It was reported that just 24 hours after the government launched the Coronavirus Job Retention Scheme, fraudsters had exploited the scheme by sending phishing emails targeting businesses offering help to prepare for the claim process.

2. Self Employment Income Support Scheme

As the government worked to structure a system to help the UK's self employed, fraudsters took advantage of the situation to lure in unsuspecting individuals during their time of urgent need.

HMRC has since stated that, “You will only be able to claim using the GOV.UK online service. If you receive texts, calls or emails claiming to be from HMRC, offering financial help or a tax refund and asking you to click on a link or to give personal information, it is a scam.”

3. Charity sector support

There has been an increased risk of fraud against charities particularly procurement fraud, such as the sale of personal protective equipment. There have also been reports of a mandate or CEO scam requesting a change in bank details or making payments.

COVID-19 email phishing scams

Tax refund email phishing scams have always been popular with scammers and can evoke an immediate reaction to respond by those on the receiving end. This is especially the case during difficult times. The newly created COVID-19 tax rebate fraud attempts to emphasise to customers that they can help protect themselves from the coronavirus outbreak. It includes links, which should not be clicked, and can come in various formats.

HMRC shared this example below:

COVID-19 SMS scams

The introduction of text messages in the government's protocol for contacting individuals for specific circumstances has meant there's another door open for criminals to reach out and bait people into various scams. 

Two of the most widely mentioned SMS scams are addressed by HMRC:

Goodwill payment

This communication tells customers they can claim a ‘goodwill payment’. HMRC shared an example of the scam wording on their phishing emails and bogus contact webpage which reads as follows:

'As Part of the NHS promise to battle the COV-19virus, HMRC has issued a payment of  £250 as a goodwill payment. Follow link to apply.'

Does this look familiar to you? If you have received a similar communication be cautious, it's very likely to be a scam!

£250 lockdown fine

Fraudsters have also taken the lockdown as an opportunity to catch individuals at home off-guard. Their outdoors based fine states you are being fined £250 for leaving the house. Do not call or click any links on this type of communication.

As lockdown and government help schemes continue to develop it is likely that fraudulent communications will continue to increase. These will either reach more people or new scams will be created and sent out as a flurry of emails, text messages, phone calls and other forms of communication.

8 Signs to help you recognise a fraudulent communication:

• Check the sender email address - scammers will often create an address that includes ‘HMRC’ or ‘revenue’; however it will not usually have the correct ‘@hmrc.gov.uk’ address (but this is not fool proof with new ways of spoofing genuine emails)
• Asking for personal, payment or financial information – a red flag that it is not a genuine communication
• HMRC will never send notification of a tax rebate by email
• Fraudsters want you to act quickly - genuine communications will not contain phrases such as ‘you only have 3 days to reply’ or ‘urgent action required’
• Fraudulent communication will often contain links to webpages that may look like the homepage of HMRC but is in fact a fake website. Telltale signs include links to bank/building society pages or display fields requesting personal details
• Generic greetings such as ‘Dear customer’ - also a sign of a fraudulent communication, usually email
• Attachments - may contain viruses or malware designed to steal your personal information
• Spelling and grammar – will often have visible spelling and grammar errors

Please note that this is not an exhaustive list.

It's important to remember that scammers are always looking for ways to 'look genuine', it's essential that you stay up-to-date with news on fraudulent communications.

HMRC also provides the following guidance on their website regarding email and SMS scams, as well as other communication outlets:

• Email Addresses - "HMRC will never send notifications by email about tax rebates or refunds"
  • The art of spoofing a genuine email address or changing the ‘display name’ to make it appear genuine is increasingly problematic. Although it may look like an email has been sent from HMRC, this is not always the case. If you are unsure, forward it to HMRC and then delete the email from your inbox.
  • Do not:
    
    •  Visit the website
    • Open any attachments
    • Provide any personal or payment information
• Test messages - "HMRC will never ask for personal or financial information when we send text messages"
  
  • Do not:
    
    • Reply to a text message claiming to be from HMRC offering a tax refund which requires you to send personal or financial details
    • Open any links

What if I receive a suspicious HMRC communication?

HMRC scams can be quite convincing, and are typically aimed at those who are more vulnerable and less likely to be aware of the latest government information. In light of COVID-19 communications which have been released fast and furious to ensure people across the UK are being supported, this is likely to affect even more of the population!

If you receive a suspicious email, or if you're unsure if it is genuine, do not respond. Instead, take a minute to think about what you have received and contact your bank or the police.

You can also:

• Visit the HMRC or Action Fraud website to see if it is a known scam and for more information on reporting fraudulent communications.
• Use the National Cyber Security Centre (NCSC) reporting service where you can forward suspicious emails to report@phishing.gov.uk.
• Report suspected fraudulent messages and phone calls to phishing@hmrc.gov.uk. then delete the message.

We urge our clients to avoid falling into these traps by staying informed by HMRC and looking for the red flags.  In many cases we have clients contact us to either ask if the communication is genuine, or to inform us that they have received something fraudulent.

When in doubt, you can contact your accountant or business advisor for advice. Do not reply or give any personal or financial information to unknown contacts.

What if I have responded to a fraudulent HMRC communication?

Fraudsters wait for opportune times to unleash their traps, so what could be a better time then when many are feeling worried and looking for help? Coronavirus became a perfect scenario for people to be taken advantage of, it is an unfamiliar situation with uncertain outcomes which leave many in financial fear.

If you think you have fallen victim to a scam contact your bank immediately and report it to Action Fraud.

Using technology for business and communication

The increasing infiltration of technology in our business and personal lives comes with implications. It is therefore important to take steps to stay safe online during coronavirus and beyond.

HMRC has published a helpful guidance on staying connected and staying safe online which you can find here.

Remember, there have to be genuine reasons why HMRC would contact you via email, message, telephone. Unfortunately these are also easy modes of communication for criminals to contact you.

The content of this post was created on 27/04/2020.

Please be aware that information provided by this blog is subject to regular legal and regulatory change. We recommend that you do not take any information held within our website or guides (eBooks) as a definitive guide to the law on the relevant matter being discussed. We suggest your course of action should be to seek legal or professional advice where necessary rather than relying on the content supplied by the author(s) of this blog.