A Familiar Phish Preludes The New Tax Season

“Automated Tax Refund Notification” spam…

We’re seeing multiple copies of the below spam dropping into mailboxes at the moment, all of which claim to be an automated tax refund of £796.86 for UK tax payers.

copies of tax spam

The email reads as follows:

Automated Tax Refund Notification

After the last annual calculations of your fiscal activity , we determined that you are aligible to receive a tax refund of 796.86 £ . Please submit the tax refund request and allow us 10-14 days in order to process it. To access your tax refund, please follow the steps bellow:

- Download the Tax Refund attached to this email - Open it in a browser - Follow the instructions on your screen

NOTE: A refund can be delayed a variety of reasons , for exemple submitting invalid records or applying after deadline.

Revenue and Tax Administrator

fake tax refund mail

The emails come with a HTML attachment:

fake tax attachment

The attachment opens up a phishing page which asks for the usual personal information, including name, email, DOB, city, phone number, full card details and sort code / account number.

fake hmrc phish page

Hitting the submit button sends the data to the scammers.

The official HMRC site has a number of pages [1], [2], [3], on tax themed scams and how you can spot them. Forewarned is forearmed, and nobody wants to lose a small fortune to tax-scam phishers – if in doubt, give those advice links a read and be careful where you send your data.

Christopher Boyd


Christopher Boyd

Former Director of Research at FaceTime Security Labs. He has a very particular set of skills. Skills that make him a nightmare for threats like you.