How to protect your business from HMRC-related scams

We’ve all become increasingly savvy when it comes to identifying scams, yet this hasn’t deterred fraudsters, who are finding new ways and schemes to trick businesses into parting with their hard-earned profits.

A recent warning from HM Revenue & Customs (HMRC) has highlighted a particularly concerning scam, where fraudsters are sending letters that appear to be from HMRC, demanding sensitive business information and bank statements.

This scam, which uses a fake HMRC letterhead and plausible language, is a reminder of the need for vigilance in safeguarding your business’s financial and personal information.

The growing threat of fraudulent communications

The HMRC scam currently making headlines is just one example of how fraudsters are becoming more sophisticated in their efforts to deceive.

The fake letter is designed to mimic official HMRC correspondence, complete with a counterfeit letterhead and terminology that closely resembles legitimate tax-related communication.

The goal is to trick recipients into providing sensitive documents, such as bank statements, VAT returns, and even personal identification like passports and driving licenses.

This information can then be used to commit identity theft or financial fraud.

The scam is particularly dangerous because it plays on the fear of non-compliance with tax regulations, a concern that every business owner takes seriously.

This ploy allows the fraudsters to create a sense of urgency that can lead even the most cautious individuals to lower their guard.

How to identify fake HMRC correspondence

Spotting a scam can be challenging, especially when the fraudsters go to great lengths to make their communication appear legitimate. However, several red flags can help you identify fake HMRC letters:

• Legitimate HMRC email addresses always end with ‘hmrc.gov.uk’. Any other domain is a clear sign of fraud.
• Correspondence asking for personal documents that seem excessive or irrelevant.
• Spelling and grammatical errors.
• Legitimate HMRC communications often direct you to log in to your online account via the official HMRC website to verify information. Any request to send documents directly via email or mail is suspect.

Steps to protect your business

Protecting your business from scams requires a proactive approach to security.

Here are some best practices to help safeguard your sensitive information.

Verify all correspondence

Always double-check any communication that appears to be from HMRC.

If you receive a suspicious letter or email, contact HMRC directly using the official contact information provided on their website to verify its authenticity.

Secure your data

Ensure that your business’s financial and personal data is protected with strong passwords, encryption, and regular backups.

Consider using two-factor authentication for added security.

Establish verification protocols

Implement procedures within your business for verifying any requests for sensitive information.

This might include requiring multiple levels of approval before any documents are shared.

Educate your team

Regularly train your employees on the latest scams and fraud tactics.

Make sure they know how to identify suspicious communications and understand the importance of verifying requests before responding.

What to do if you’re targeted

If you receive a suspicious letter or email that appears to be from HMRC, take the time to verify the communication with HMRC directly.

Do not use the contact information provided in the suspicious letter; instead, use the official contact details from the HMRC website.

Notify HMRC and Action Fraud (the UK’s national fraud and cybercrime reporting centre) about the scam.

This helps authorities track the fraudsters and prevent others from falling victim.

If you’ve already shared sensitive information, immediately contact your bank and any other relevant institutions to secure your accounts.

Monitor your accounts closely for any signs of suspicious activity.

If you have received correspondence you are unsure is legitimate, our team is here to help. Contact us today for expert advice and support.