Daily Archives: Wednesday, May 14, 2014

This morning I discovered the fake HMRC email below in one of my inboxes.

I’m disappointed to note that the senders of this one are only offering me a refund of £830.99; the previous bunch of scammers were offering £1,400.

TAX RETURN FOR THE YEAR 2014
RECALCULATION OF YOUR TAX REFUND
HMRC 2010-2011
LOCAL OFFICE No. 3819
TAX CREDIT OFFICER: Jarrett Horn
TAX REFUND ID NUMBER: 9896077
REFUND AMOUNT: 830.99 GBP

Dear Applicant,

The contents of this email and any attachments are confidential and as applicable, copyright in these is reserved to HM Revenue & Customs.

Unless expressly authorised by us, any further dissemination or distribution of this email or its attachments is prohibited.

If you are not the intended recipient of this email, please reply to inform us that you have received this email in error and then delete it without retaining any copy.

I am sending this email to announce: After the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 830.99 GBP

You have attached the tax return form with the TAX REFUND NUMBER ID: 9896077, complete the tax return form attached to this message.

After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

Our head office address can be found on our web site at HM Revenue & Customs: http://www.hmrc.gov.uk

Sincerely,

Jarrett Horn
HMRC Tax Credit Office
Preston<br /.
TAX REFUND ID: UK9896077-HMRC

This email was delivered from a Korea Telecom server and came with an attachment -Refund-Form-ID_9896077.zip (the number in the zip file varies).

Some of the language used – e.g. ‘fiscal activity‘ – is also a clue to its bogus nature. HMRC is supposed to use simpler English than that. Furthermore, note that the title seems to suggest the tax return concerned is for 2014, but the refund relates to 2011-2012. Not even HMRC is that slow in refunding money.

If you’re on a Windows machine, opening that zip file is fraught with danger as the archive contains a Trojan which, when run, attempts to drop cryptolocker, ransomware and loads of other malware on your computer.

As stated in an earlier post, HMRC never sends notifications of a tax rebate by email or asks taxpayers to disclose personal or payment information by email.

As before, if you receive one of these emails, you are advised to forward it to phishing@hmrc.gsi.gov.uk and then delete it.

Once again, consult HMRC’s website for comprehensive advice on phishing and bogus emails.