Introduction
If you get a text claiming to be from HMRC about a tax refund or an unpaid bill, forward it to 60599. That is HMRC’s own number for reporting scam texts. Then forward the same message to 7726 as well, so your mobile network can investigate the sender. If it was an email instead, forward it to phishing@hmrc.gov.uk. Reporting takes less than a minute, and it helps HMRC and the networks shut the scam down for everyone else.
7726 or 60599: which number do you use?
This is the part that confuses people, because both numbers are correct, but they do different jobs. Use 60599 for HMRC scam texts. HMRC asks you to forward any suspicious text that claims to be from HMRC to 60599, then delete it. Your network may charge you its normal rate for the text, so check your plan if that matters to you.
Use 7726 for any suspicious text, whatever it claims to be. 7726 spells SPAM on a phone keypad. It is free on all UK networks, and it reports the message to your mobile provider, which can then block the sender. HMRC scam texts qualify twice over: they are both an HMRC scam and a spam text. So the safest routine is to forward the text to 60599 first, then forward it to 7726 as well. You cover both HMRC and your network in under a minute.
For emails, the split is similar. Forward HMRC phishing emails to phishing@hmrc.gov.uk. Forward any other suspicious email to the NCSC Suspicious Email Reporting Service at report@phishing.gov.uk. Do not reply to the message, and do not click any link in it before you report it.
How to forward a scam text to 60599
Do not reply to the scam text. Forwarding is different from replying, and it is the only thing you need to do. On an iPhone, press and hold the message, tap More, tick the message, tap the share arrow, then type 60599 as the recipient and send. On most Android phones, press and hold the message, tap the three dots or the forward option, choose Forward, then type 60599 and send. The exact menu wording varies by phone, but every modern phone has a forward option in the long press menu.
If the message came from a sender name such as HMRC rather than a number, forwarding still works. The forward carries the message content, which is what HMRC needs. Include the sender number if it is visible and your phone asks for it. After you send the forward, delete the original message from your phone so you cannot tap its link by mistake later.
Then do the same for 7726. Forward the message again, this time to 7726. This step is free, and it is the one that helps your network block the number. You can forward to 7726 first and 60599 second if you prefer. The order does not matter. What matters is that both get it.
Why you should also forward it to 7726
60599 tells HMRC about the scam. 7726 tells your mobile network. The network can then investigate the sender, block the number, and stop the same text reaching other people on that network. Every text forwarded to 7726 helps the networks spot patterns and shut down the senders faster.
7726 is run for the UK mobile networks, and forwarding to it is free. Your network may reply asking for the number the text came from, so keep the message until you have finished reporting. If the text arrived from a sender name instead of a number, say so in your reply. After that, delete the message.
Think of it this way. 60599 is the HMRC report. 7726 is the network report. One helps the tax authority track the scam. The other helps stop the text itself. Do both, and you have done the whole job.
How to report an HMRC phishing email
Forward the whole email to phishing@hmrc.gov.uk, then delete it. Do not click any link or open any attachment in the email first. If your email app lets you forward as an attachment, use that option, because it keeps the original headers, which help HMRC trace the sender. If not, a normal forward still works.
Check the sender address before you forward. A genuine HMRC email about a refund will only come from an address ending in hmrc.gov.uk. Anything else, such as hmrc-refunds.com or a Gmail address, is fake. HMRC will never ask you for personal or financial details by email, and it will never send you a tax refund notification by text.
If the message arrived in an app such as WhatsApp, take a screenshot and email it to phishing@hmrc.gov.uk. Include the sender details in the screenshot if you can. Then delete the message from the app.
How to report a scam call or fake social media account
If you get a call from someone claiming to be from HMRC, do not give them any details and do not call back on a number they give you. HMRC will never leave a voicemail threatening legal action or arrest, and it will never ask you to pay with gift cards or vouchers. Report the call through the “Report a suspicious HMRC phone call” service on GOV.UK. If money was lost, also report it to Report Fraud, formerly Action Fraud, online or on 0300 123 2040. In Scotland, report fraud to Police Scotland on 101.
For a fake HMRC account on social media, report it on the platform itself using its report option, and do not engage with the account. You can also report it to HMRC through the same GOV.UK service. Screenshots help, so take one before you block the account.
How to tell a real HMRC text from a fake one
HMRC does send some genuine texts, so a text from HMRC is not automatically fake. Genuine texts follow up on a call to a helpline, confirm something you asked for, or tell you a Self Assessment refund is being processed. What HMRC never does by text is ask for personal or financial information, or tell you that you are due a tax refund with a link to claim it.
Watch for these signs of a fake. The text promises a refund or warns of a penalty, and it wants you to act now. It includes a link that does not go to GOV.UK. The link address looks close to GOV.UK but is not quite right. It asks you to reply with bank details, a password, or a code. It uses threatening language about arrest, court, or bailiffs. Any one of these is enough to treat the message as a scam.
When in doubt, do not use any link or number in the message. Go to GOV.UK yourself, or sign in to your HMRC account through the official app or website, and check there. If there is really something to deal with, it will show up in your account. Our guide on how to spot a phishing email explains the same red flags with UK examples, including fake HMRC refunds and supplier bank detail scams.
What happens after you report
You will usually get an automated acknowledgement, and then nothing personal. HMRC and the NCSC do not reply to every report with a result. That is normal. Your report still counts. Reports are used to take down scam websites, block sender numbers, and track which scams are spreading. A single report can help stop thousands of identical texts.
Do not expect a refund or compensation from reporting alone. Reporting is about stopping the scam, not recovering a loss. If you lost money or shared financial details, your bank is the route to stopping payments and recovering what can be recovered. Report the fraud as well, so the crime is recorded, but contact your bank first.
Keep a note of what you reported and when, especially if the message arrived on a work phone or to a business number. If the same scam text keeps arriving, report each one. Repeated reports help the networks see that a sender is still active.
What to do if you already clicked or replied
If you tapped a link in the text, close the page straight away and do not enter any details. If you entered a password, change it immediately from a clean device, then change it on every other account that uses the same password. If you entered bank or card details, call your bank now on the number on the back of your card, not on any number in the message. Tell them exactly what you shared and when.
Run a security scan on the device if anything downloaded, and update the phone software if an update is waiting. Then report the message to 60599 and 7726 as above, and report the fraud to Report Fraud if money was lost. Full recovery steps are in our guide on what to do if you clicked a phishing link, including what to check on your accounts in the days after a click.
If the text arrived on a work phone, or you used a work email address or work account after clicking, tell your IT team at once. They need to know so they can warn colleagues who may have received the same message, and check whether any business system is at risk. Reporting a click quickly is always the right move, and no good IT team will blame you for it.
FAQs
Do I need to report to both 60599 and 7726?
Yes, if you can. 60599 is HMRC’s number, and it tells HMRC about the scam. 7726 is your network’s number, and it helps the network block the sender. Forwarding to both takes seconds, and together they cover the scam from both ends. If you only have time for one, use 60599 for a text that claims to be from HMRC.
Does forwarding a text to 60599 cost anything?
It can do. GOV.UK says you will be charged at your network rate for texts to 60599. Forwarding to 7726 is free on all UK networks. Some networks do not charge for 60599 either, but do not assume that. If cost worries you, forward to 7726 first, which is always free, then to 60599.
Will HMRC reply to my report?
Usually not personally. You may get an automated acknowledgement. HMRC uses reports to track scams and take down fake sites, but it does not send individual updates on each report. That does not mean your report was ignored. It is part of a much larger picture that HMRC and the NCSC build from thousands of reports.
I deleted the text already. Can I still report it?
If you deleted it before forwarding, you cannot forward it, and there is nothing useful to report from memory alone. Do not worry about it. The important thing is that you did not click the link or share details. If a similar text arrives again, forward it to 60599 and 7726 before you delete it. If you lost money, report the fraud to Report Fraud with the details you remember, and tell your bank.
What if the text came from a number, not the name HMRC?
That is common, and it does not change the steps. Forward the message to 60599 and to 7726 as above. Your network may ask for the sender number when you report to 7726, so keep the message until you have finished reporting. Scammers often spoof the name HMRC, and sometimes they use a plain mobile number instead, so either form is worth reporting.
Conclusion
Reporting an HMRC phishing text takes less than a minute, and it is worth doing every time. Forward the text to 60599 so HMRC knows about it, then forward it to 7726 so your network can block the sender. Forward HMRC phishing emails to phishing@hmrc.gov.uk, and report scam calls through GOV.UK. Never click a link or reply with details first. Check your HMRC account directly if you are unsure, and keep the habits that stop the next attempt: unique passwords, two factor authentication, and the rule of going to GOV.UK yourself instead of following a link in a message. Small firms can build these habits into everyday routines with the steps in our cybersecurity tips for remote workers in the UK.
