HMRC has revealed it received more than 135,000 reports of suspicious contact in under a year, forcing the closure of around 25,000 phishing websites and phone numbers. What’s changed isn’t just the volume — it’s the sophistication. Alongside the usual fake emails and texts, HMRC is now warning about WhatsApp impersonation campaigns, AI-generated voice calls convincing enough to sound genuinely official, and fake letters carrying QR codes designed to route victims straight to a phishing page. The timing isn’t a coincidence: the self-employed second payment on account for 2025/26 falls due on 31 July, and scammers consistently ramp up activity around real HMRC deadlines because urgency and confusion work in their favour.
For sole traders and small business owners handling their own tax affairs, this is exactly the moment scammers are counting on you being distracted, mid-deadline, and willing to act fast on anything that looks official.
What these scams sound like now
The traditional advice — “check for spelling mistakes and dodgy links” — is no longer enough on its own. AI voice cloning means a phone call can now sound exactly like a professional HMRC representative, with none of the tell-tale awkwardness of older scam calls. Combined with WhatsApp messages that mimic official formatting and QR codes on physical letters that route straight to convincing fake payment pages, the visual and audio cues people used to rely on are far less reliable than they were even a year ago. The one constant that hasn’t changed: HMRC will never ask you to share sign-in details, click an unexpected link, or pay by unusual methods like gift cards or crypto, regardless of how the request arrives or how official it sounds.
How to verify before you act
If you get a call, message, or letter that claims to be HMRC and asks for payment, personal details, or login information, stop before responding. Hang up and call back using a number you find independently on gov.uk — never one given to you in the message itself, since scam callers can spoof caller ID and provide “verification” numbers that just route back to them. Never click a link or scan a QR code from an unsolicited message claiming to be HMRC; go directly to gov.uk and log in from there instead. Genuine tax refunds are never issued by text message.
Protecting your business, not just yourself
If you employ staff who handle finance or admin, it’s worth a two-minute conversation reminding them that this applies to business accounts too — invoice fraud and HMRC impersonation scams increasingly target whoever in a small team is responsible for payments, not just the owner. A short, plain policy of “any unusual payment request gets verified by phone through a known number before it’s actioned” stops the vast majority of this kind of fraud outright, AI voice or not. If you want ongoing visibility into whether your business’s details are circulating in scam databases or breach dumps, KeepSafe monitors for exactly that kind of exposure, so you can act before it’s used against you.
The takeaway
The 31 July payment deadline is real — but so is the flood of scam activity riding on the back of it. Treat every unexpected HMRC contact as unverified until you’ve confirmed it independently, especially calls, since AI voice cloning has quietly removed one of the easiest ways people used to spot a fake. When in doubt, hang up, go to gov.uk directly, and check your account yourself rather than trusting anything a message tells you to click.
None of this means avoiding HMRC contact altogether — genuine reminders, letters, and account messages are a normal part of running a business, and ignoring real ones causes its own problems. The goal is simply to build a habit of verifying independently before acting, so that whether a message is genuine or not, you’re never the one caught out by how convincing it sounds.