Guide Scams and phishing
Tax refund scam texts and emails: how to spot them and what to do if you clicked
A text or email says you're due a tax refund and just need to claim it through a link, often within a few days. Sometimes an automated call comes first. The link leads to a page dressed up as the tax authority or your bank, and it asks for your online banking login or card details. Tax authorities don't pay refunds this way: they send the money to the account they already have on file, or by post, with no link to click. Here's how to spot the scam and what to do if you've already entered your details.
Key points
- Tax authorities don't send links to claim a refund or log in. The UK's HMRC never sends refund notifications by text; the Czech and Slovak tax offices say the same about links in texts and emails.
- Warning signs: an automated call, a deadline like 'claim within 3 days', a QR code to a 'secure portal', and a sender address that isn't the authority's official domain.
- Entered your bank login or card details? Call your bank now on the number on your card or its website, have access and the card blocked, and report it.
- A follow-up call from your 'bank' asking you to move money to a 'safe account' or install an app is part of the same scam. Hang up.
What the scam looks like
The scammer promises money the government supposedly owes you. Tax authorities in the UK, the Czech Republic and Slovakia describe the same pattern; only the channel changes:
- An automated call. A recorded voice says you're due a refund (or owe tax), for example 30,000 Czech crowns (about €1,200), and asks you to press a key. A text with a link follows (Czech Financial Administration, 2024).
- A text with a link. No call needed, just the tax authority's logo and a link to a page that mimics its online portal (Czech Financial Administration, 2024). HMRC says it never sends refund notifications by text at all.
- An email from a "citizen portal". It reports a refund "ready to be paid", pushes a deadline ("claim within 3 days"), and offers to "start verification" or a QR code to a "secure portal" (Czech Financial Administration, December 2025).
- The flip side: a demand to pay. Instead of a refund, a debt that must be settled at once, with threats to block your account (Czech Financial Administration, July 2025; Slovak Financial Administration, February 2026).
Every version aims for the same thing: your online banking login, your card details or your personal data.
Real cases
Hradec Králové region, May 2022. A woman (32) and a man (23) received a text about a tax refund, opened the link and entered their online banking login. The woman lost €200, but she told her bank straight away and it cancelled the payment. The man lost almost 23,000 crowns, roughly €900 (Czech Police, 11 May 2022).
Prague, March 2024: text, fake banker and an ATM. Police described a follow-on scam. After a text, for example about a tax refund, and the victim entering bank details, a "bank employee" calls to say the account has been compromised and asks the victim to "change the PIN" through an app sent by link. The fake app relays the card's contactless signal when the card is held to the phone, and an accomplice withdraws cash at an ATM (more in the "hold your card to your phone" scam). One victim lost nearly 40,000 crowns, about €1,600 (Czech Police, 28 March 2024).
How to spot a fake tax refund message
Any one of these is enough:
- A link or QR code to claim the refund. The Czech tax authority says it "never asks people to log in or pay through links sent by email or text". HMRC never sends refund notifications by text.
- A request for your bank login or card details. To pay you, a tax office only needs your account number, which it already has. Police: refunds come only by post or to the account you provided yourself.
- An automated call. The Czech tax authority says it doesn't use voice robots to chase payments and advises hanging up on them.
- Urgency. "Claim within 3 days", "within 24 hours", or you'll lose the money or have your account blocked.
- The sender. HMRC only emails about refunds from addresses ending in hmrc.gov.uk; Czech tax emails end in @fs.gov.cz. Lookalike domains and free webmail addresses are a giveaway.
- A refund you never applied for, spelling mistakes and garbled agency names.
Clicked or entered details?
- Your bank, now. Call the number on your card or on the bank's official website, not one from the message. Have online banking access and the card blocked, change your login details and go through recent payments. Speed matters: the woman in Hradec Králové got her money back only because she called straight away.
- Don't trust a follow-up call "from your bank". Anyone who calls after the theft to say your account is compromised and you must move money to a "safe account" or install an app is a scammer. Hang up and call your bank yourself. More in Bank impersonation scam call.
- Installed an app from the link? Disconnect the phone from the internet, stop using the app and tell your bank. Further steps are in Entered your details on a phishing site.
- Report it to the police if you lost money, and bring the message, the page address and your bank statement.
- Gave personal details or an ID number? Mention it when you report, and be wary of later calls or messages that quote those details back to you.
How to check a refund safely
- Go to your tax authority's website by typing the address yourself (in the UK, GOV.UK), and sign in to your official account from there to see what you're owed.
- If you filed a return showing a refund, the money arrives on its own, in the account you gave or by post. Nothing more is asked of you.
- Still unsure? Call the tax authority on a number from its official website.
How to avoid it next time
- Don't tap links or scan QR codes in messages "from the government". Open the official site yourself.
- Never type your bank login or card details into a page you reached from a message.
- Hang up on automated calls and on any "bank" caller who's in a hurry.
- Warn parents and grandparents – tax authorities specifically ask people to tell their families.
- Parcel delivery scam texts work the same way.
Where to report it
- Lost money or entered details: your bank, then the police.
- UK: forward emails to phishing@hmrc.gov.uk and texts to 60599; report suspicious calls through HMRC's online service (GOV.UK). You can also forward any scam text to 7726.
- US: send unsolicited emails claiming to be from the IRS to phishing@irs.gov and report fraud to the FTC at ReportFraud.ftc.gov.
FAQ
I got a text saying I'm owed a tax refund and need to claim it via a link. Is it real?
No. HMRC says it will never send a tax rebate notification or ask for personal or payment information by text. The Czech tax authority says it never asks people to log in or pay through links sent by email or text, and pays refunds automatically based on your tax return. Don't click. If you're unsure, contact the tax authority using details from its official website.
How do tax refunds actually get paid?
To the bank account you gave the tax authority, or by post. Czech police put it plainly: tax offices return overpayments only by payment slip or straight to the account you provided yourself. No tax office needs your online banking login or card details to pay you.
An automated call said I'm owed a refund and told me to press a key. What should I do?
Hang up. The Czech tax authority advises ending such calls straight away; pressing the key typically triggers a text with a link to a fake site. In the UK, you can report a suspicious HMRC call through HMRC's online service.
I entered my bank login on the page. What now?
Call your bank immediately on the number on your card or its official website. Have your online banking access and card blocked and go through recent payments with them. In one Czech case a woman lost nothing because she called her bank at once and it cancelled the payment. Then report it.
Where do I report a fake tax refund message?
In the UK, forward emails to phishing@hmrc.gov.uk and texts to 60599. In the US, the IRS asks for unsolicited emails claiming to be from it to be sent to phishing@irs.gov, and you can report fraud to the FTC at ReportFraud.ftc.gov. Elsewhere, use your tax authority's official reporting channel and your national cybersecurity centre.
Sources
- GOV.UK – Report suspicious HMRC emails, text messages and phone calls (updated 24 November 2025)
- IRS – How to know it's really the IRS calling or knocking on your door (FS-2017-7, historical)
- Czech Financial Administration – Warning about another wave of fraudulent emails (17 December 2025, in Czech)
- Czech Financial Administration – Warning about fraudulent calls and texts (13 March 2024, updated 20 February 2025, in Czech)
- Slovak Financial Administration – Another wave of fraud in its name (6 July 2026, in Slovak)
- Czech Police – Beware of fraudulent text messages (Hradec Králové Region, 11 May 2022, in Czech)
- Czech Police – Fraudsters have come up with a new scheme (Prague, 28 March 2024, in Czech)
- FTC – Report fraud (ReportFraud.ftc.gov)
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
I sent a photo of my ID to a scammer: what to do now
Scammers ask for a copy of your ID under all sorts of pretexts: “identity verification” for a loan, a flat you want to rent, a prize you've supposedly won, a job offer or a message that claims to be from a government agency. If you've already sent it, money won't vanish from your account because of the photo alone. But a document image with your name, date of birth and document number can be used to open credit or accounts in your name, and makes the next scam aimed at you far more convincing. Here's what to do, step by step.
Guide
SIM swap scam: your phone suddenly has no signal – what to do
Your phone suddenly shows “No service” or “SOS only”, maybe right after someone called claiming to be your mobile carrier and asked for a code from a text message. That's the classic sign of a SIM swap: a criminal has moved your phone number to a SIM or eSIM they control. From then on, your calls and verification texts go to them – including codes from your bank and email. The FBI's Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021 alone, with more than $68 million in losses. Here's how to spot it, what to do in the first minutes and how to protect your number.
Guide
A "hotel" message asks you to verify your card or pay a balance: how to spot the scam and what to do
The message knows your name, your dates and your booking number. It says your payment failed, or that the reservation will be cancelled unless you verify your card within the hour. It can still be a scam – and police have described travellers who lost thousands this way. Here's how to tell, and what to do if you've already entered your card.