Taxpayers in the UK should be wary of emails claiming they’re owed a tax refund to the tune of 100.60 GBP.
Earlier examples have offered up 323 GBP and 438 GBP, so maybe the fake bank they’re getting all the non-existent money from is having their very own pretend banking crisis.
The mail reads:
Dear customer,Tax Refund Notification!
A tax refund of 100.60 GBP – Still Pending. Due to invalid account record, we were unable to credit your account. Please submit a verified tax refund request. A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline. Click the “Refund Me Now” link below and follow the on screen step in order to have process your request.
They also mention that for “security reasons” they log some of your details, and that “Deliberate wrong inputs are criminally pursued.” [sic]
Clicking the Ow.ly link in the email sends potential victims to a .zip download hosted on what appears to be a compromised German bicycle shop website. Inside is a .html file containing a fake refund form. As a sidenote, it’s a little unusual to see scammers making use of Ow.ly shortening links for a HMRC phishing scam.
The fake refund form asks for name, DOB, address, postcode, account number, full card details…all the usual bits and pieces of information required to swipe the payment information.
Curiously, the refund amount pre-filled on the form is 100.65 GBP. I’m not sure where the extra five pence comes from, though given that this is all a massive work of fiction anyway I don’t think it matters besides helping to tip off recipients that this isn’t a real refund.
Feel free to report these missives to HRMC directly, and remember: HMRC will never ask for payment information or notify taxpayers of refunds by email.
Christopher Boyd
