The September 2026 Facebook Live was a crucial, security-focused session. It educated business owners on the latest tactics used by fraudsters, such as phishing emails pretending to be from HMRC, fake penalty notices, and invoice redirection scams. It provided clear red flags to look for and practical steps to take to verify communications and protect the business’s finances.
The Scammers Are Getting Smarter
Fraud is a huge threat to small businesses. Scammers use fear and urgency to make you act without thinking. This session is about learning to PAUSE, how to recognise a potential phishing email, and what to do if you are a victim of being scammed.
Phishing is a scam using fraudulent emails, texts or websites to trick you into giving away personal information or money.
HMRC Scams: They Will Never…
Over the years, more and more scams are appearing, and businesses are being targeted specifically with HMRC scams. Emails, or even texts, may state that you are due a tax rebate or have received a penalty, or ask for personal information.
There are things that HMRC will never do that can help you to spot a scam:
- HMRC will NEVER use texts or emails to tell you about a tax rebate or penalty. They will send you a letter, or a message will appear in your Government Gateway account.
- HMRC will NEVER ask for personal or payment information by email or text.
- HMRC will NEVER call threatening you with immediate arrest for non-payment of tax.
Other clues that will point to the messages being part of a scam are poor grammar, generic greetings such as “Dear Taxpayer”, links to non-gov.uk websites, and threatening language.
If you receive any communication that looks like it comes from HMRC, asking you to click on a link to provide personal information or access the messages, do NOT click on those links. You should log into your Government Gateway account by going directly to the website on your browser and logging in. Clicking on links in suspicious emails can cause your email or device to be hacked, and the scammers then have access to all of your personal data, as well as data relating to any of your contacts.
You can contact HMRC to report suspicious communications, including emails, texts, social media accounts and phone calls. HMRC have also published a list of genuine HMRC contacts to help you decide if the communication is real. You can visit the gov.uk website to get that information.
Invoice & Mandate Fraud: The Biggest Threat
This type of scam is becoming more common, and as people move to invoicing customers only electronically, it is going to be very important to make sure you are aware of what to look for. This type of fraud involves a fraudster tricking a business into paying a legitimate invoice to a criminal’s bank account.
For example, a fraudster impersonates one of your regular suppliers and emails you with new bank details for payment. You pay your legitimate bill to the fraudster’s account.
There are ways to prevent this sort of thing from happening:
- ALWAYS verify any change in bank details with your known contact at the supplier, using a phone number you have on file (not one from the email).
- Instil a clear process for changing supplier details in your business
- Be suspicious of emails with a sense of urgency or a change in the tone of language
Scammers are being very clever, and I have had clients contact me to query whether emails from Ihelm Enterprises are genuine, and have even had a client inform me that one of his suppliers had been scammed by receiving an email that looks like it genuinely came from one of their own suppliers, but it turns out it wasn’t.
Things to look out for that indicate the email is a scam include:
- The email address is not the usual email address your supplier emails you from
- The email doesn’t follow the same format as previous emails ie, the colours or logo are not the same
- Poor grammar
- Stating the payment must be made immediately, instead of it being for the agreed terms you have with the supplier
- If you hover over the links, they do not point to your supplier’s website
Your suppliers will not have any issues with you contacting them to verify if an invoice you have received from them is genuine.
What To Do If You Suspect A Scam
It can be really hectic trying to run your own business when you are dealing with customers, paying suppliers, marketing, HR, and just the day-to-day tasks. We all get busy and sometimes don’t necessarily take the time to read emails from suppliers that closely, or we flag them for looking at later. However, this is what scammers are counting on – that business owners are too busy to pay close attention to their emails, and will just pay the invoices or click on the links.
To help ensure you are not getting scammed, there are some very simple steps you can take.
- PAUSE – take the time to read the email properly.
- If you think the email may be a scam – STOP – do not reply, click any links or download any attachments.
- CHECK: If it claims to be from HMRC, go to the link I mentioned earlier to check if the contact details are on the list of genuine contacts. Also, log into your Government Gateway account directly to check if there are any messages from HMRC relating to the email you have received. If it’s a supplier, call them.
- REPORT: If you suspect the email is suspicious, you can report it, and it will get investigated. If the email pretends to be from HMRC, you can forward it to phishing@hmrc.gov.uk. You can also report phishing emails to the National Cyber Security Centre by forwarding them to report@phishing.gov.uk. If it is a text message, you can forward it to 7726 (it’s free to do so), and it will report the message to your mobile phone provider.
The government website provides guidance on how to report other types of scams and phishing emails.
If the email turns out that it was genuine, that’s fine; there are no repercussions if you report an email as a potential scam, and it isn’t.
If You’ve Been Scammed
If you have clicked on links in a scam email and made payments to the scammers, it is very important that you contact your bank or credit card company immediately to let them know you have just made a payment and been scammed. They may be able to stop the payment or recover it. Your bank or credit card company will provide you with instructions on how to submit the information to them.
You should also contact the police on 101 to report that you have been scammed. They will take various details from you about what has happened, and it will be logged.
The next step is to report the scam to Report Fraud. Report Fraud can also help with getting it reported to the police. If you visit their website, you can click on the red button that says “Make a report” to start the process. Report Fraud is the UK’s national reporting centre for fraud and cybercrime.
You must keep records of all communication you have had with the scammer. It will be useful when you ask your bank or credit card provider to reimburse you.
Important Note about HMRC VAT Scam
I wanted to share some information about a scam that has been happening to VAT-registered businesses over the last 18 months.
Business owners have had issues with submitting VAT returns, and when they have gone onto the Government Gateway account to check things, they have discovered that a fraudulent VAT return has been submitted using their Government Gateway details, but not using their software. It often creates a large refund due to the business owner. However, in some cases, the scammers have managed to change the bank account details on the account to their own bank account.
HMRC have not shared much information about this scam, and in most cases, they simply close down the Government Gateway account and set up a new one, all without notifying the business owner until after the fact.
In some cases, the business owner has then had to submit documentation to HMRC to get the fraudulent VAT return removed from their records, so they are able to submit their true VAT return, but this can take time, meaning the correct return is often late being submitted.
This is something that has been posted across numerous business groups on social media, as well as groups for bookkeepers and accountants. It isn’t something that’s been publicised by the government. I do have first-hand experience in dealing with this scam due to two of my own bookkeeping clients who have had this occur. It is extremely important that you stay vigilant and keep a close eye on your Government Gateway Account. If you see anything suspicious, report it to HMRC straight away and change all your passwords.
Protecting your business’s money is just as important as earning it. Make sure your team knows these rules. For more tips on financial security and internal controls, check out the blog section on my website. Stay vigilant!
If you want to have a chat about other ways you can protect your business from potential HMRC scams and invoice fraud, just contact me and we can have a chat.