HMRC self-assessment WhatsApp scam uses AI voice notes and QR codes to steal tax refunds

What is this scam?

With the 2025/26 self-assessment period ongoing, HMRC has warned of a fresh wave of fraudulent WhatsApp messages and AI-generated voice notes falsely claiming recipients are owed a tax refund and must claim it through an urgent link. Some variants arrive as physical letters containing QR codes that link to fake HMRC portals designed to steal personal, financial, and National Insurance details. The scam is distinct from the earlier Winter Fuel Payment clawback phishing (April 2026) — it targets a broader population using self-assessment as the hook. HMRC does not contact taxpayers via WhatsApp and never requests bank details through an unsolicited link or QR code.

Example scam message

Red flags to look out for

• The message creates urgency — threatening a fine, missed delivery, or account closure.
• Links lead to unofficial domains that don't match the real company's website.
• You weren't expecting this message and can't verify the event it references.
• It asks you to confirm payment details or personal information via a link.
• The sender's number or email address doesn't match the company's official contact.

What to do if you receive this

1. Do not click links or call numbers provided in the message.
2. Contact the organisation directly using details from their official GOV.UK page.
3. Forward the message to 7726 or email report@phishing.gov.uk.
4. Report it to Action Fraud at actionfraud.police.uk.