Skip to main content

HMRC calls on universities to protect students from tax scams

Press release   •   Sep 21, 2019 00:01 BST

New students starting university this year could be the likely targets of a fresh wave of tax scams, HM Revenue & Customs (HMRC) warns.

HMRC is writing to UK universities advising them to warn new students about tax scams sent by fraudsters to steal students’ money and personal details.

Over 620,000 tax-related email scams were reported to HMRC last year – up by 20,000 on the previous year – including thousands of reports the department received about scam emails targeting students.

HMRC wants to ensure all students new to university this year are cyber aware for when repeat attacks hit their inboxes.

Fraudsters can use a range of methods to target students, most commonly by sending fake tax refunds using seemingly legitimate university email addresses (often ending in ‘ac.uk’) in order to avoid detection.

Depending on the details a criminal is able to obtain from a student, they could steal money, set up direct debits, make purchases for valuable goods on online sites or even take control of their computer – being able to access functions such as their webcam.

Jesse Norman MP, Financial Secretary to the Treasury, said:

“Cyber criminals use every means they can to steal money and personal data from students. That’s why HMRC is asking all UK universities to make sure students know how to protect themselves.

“HMRC is doing everything they can to clamp down on online fraud, but students and their families need to be vigilant, especially amid all the stresses and strains of going to university. I would urge university principals to take a lead in helping to protect students from these cyber thieves.”

Alistair Jarvis, Chief Executive at Universities UK, said:

“This action will help to raise awareness of the risks of tax scams. The security and welfare of students is always a top priority for universities. The message to students is to remain vigilant and question anything that seems unusual. We would encourage any student who fears their account may have been misused to speak to either their university support services, banks, or to the police.”

Chris Skidmore MP, Universities Minister, said:

“As hundreds of thousands of new students start their life-changing journey at university this month, it is absolutely right that they are made aware of the risks of tax scams.

“University should be one of the most enjoyable times in a student’s life, and I want everyone to know how they should react in an instance where they are targeted. I welcome the work by HMRC and Universities UK who are encouraging institutions to inform students about this issue.”

The letters to universities, authored by HMRC’s Head of Cyber Security, encourage colleges to raise awareness of tax-related scams at the start of this academic year and to integrate scam advice into guidance for new students if not already established.

HMRC advised university leaders that students are “more likely to be taken in” by tax scams because students may have “had little or no interaction with the tax system”. This could make the offer of a tax refund from a scammer seem attractive, especially when on a budget.

Often HMRC-related email scams spoof the branding of GOV.UK and well-known organisations in an attempt to look authentic. The recipient’s name and email address may be included several times within the email itself.

As well as email tricks, phone scams have also been used increasingly by criminals in an attempt to threaten taxpayers into handing over cash – HMRC had over 100,000 reports of such scams last year, compared to 400 in 2016. HMRC has since introduced defensive controls with Ofcom and mobile networks to curtail these scams.

If students receive an email offering money sent to them by someone claiming to be HMRC and it seems too good to be true, then they should report it to phishing@hmrc.gov.uk.

Notes for editors

Text of letter sent to universities

Dear all,

Last year HM Revenue and Customs (HMRC) issued a warning to students to be vigilant about tax scams targeting them from seemingly legitimate email addresses (which often end in ‘ac.uk’).

While it was great to see a number of universities and student unions share our phishing advice in response, we are concerned that another wave of email scams – which offer fake tax refunds – could occur from the start of this new academic year. New university students who may have had little or no interaction with the tax system might as a result be more likely to be taken in.

As I’m sure you will agree, university should be a time for students to learn, meet lifetime friends and to lay foundations for their careers. This is why we are asking each university to join us again in raising awareness of HMRC scams as early as possible in this academic year, and encouraging university leaders to ensure phishing advice is integrated into their guidance for new students if not done so already, to help prevent potential financial loss.

I have copied to this letter HMRC’s phishing advice for avoiding tax scams, including links to examples of current scams that we are of. Students should also be very alert to other scams, such as those by fraudsters pretending to be the TV licensing authority and also the DVLA.

Thank you in advance.

Mike Fell, Head of Cyber Operations at HM Revenue and Customs

HMRC’s advice for students

How can you spot a scam?

  1. Recognise the signs – genuine organisations like banks and HMRC will never contact you out of the blue to ask for your PIN, password or bank details.
  2. Stay safe – don’t give out private information, reply to text messages, download attachments or click on links in emails you weren’t expecting.
  3. Take action – forward all suspicious emails claiming to be from HMRC to phishing@hmrc.gov.uk and texts to 60599.
  4. Check GOV.UK for information on how to avoid and report scams and to recognise genuine HMRC contact.
  5. If you think you have received an HMRC related phishing/bogus email or text message, you can check it against the examples shown in this guide.
  6. Contact your bank immediately if you believe you’ve submitted card details to a scammer and report to Action Fraud if you suffer financial loss.

HMRC action tackling scams

  • HMRC introduced breakthrough controls in April 2019 which put an end to fraudsters being able to spoof HMRC helpline numbers.
  • In the last year, HMRC identified 3,441 phishing scams before they were reported thanks to proactive intelligence work. During the same period, HMRC requested the takedown of 12,366 malicious websites linked to phishing scams.
  • From June 2019, callers paying tax or debts over the phone to HMRC will enter their payment details via their telephone keypad instead of supplying this verbally over the phone. The operator will remain on the call throughout while the card details are processed via the system but will not be privy to the customer’s secure information.
  • HMRC has deployed technical controls since 2016 that have so far stopped around half a billion phishing emails from ever reaching our customers' inboxes and reduced reported instances of HMRC-branded phone text scams by 90%.

Issued by HM Revenue & Customs Press Office

HM Revenue & Customs (HMRC) is the UK’s tax authority.

HMRC is responsible for making sure that the money is available to fund the UK’s public services and for helping families and individuals with targeted financial support.