A real story that could happen to anyone. Read for awareness, and what to do if it ever happens to you.
We recently had something scary happen to one of our brilliant clients, and it won’t be the first or last time it happens, so we’re sharing this with you.
It’s clever, convincing, and needs your attention.
First and foremost, please do not give away your Government Gateway details to anyone. Your genuine accountants, us, may ask for this, but it is very important to be wary of anyone else that asks.
Let’s get into the story…
Our client, let’s call them Wonda, she was approached by a company who claimed they offered VAT and tax services. She was told that they could use a specialist process to review her VAT records and identify expenses she hadn’t yet claimed back from HMRC. A friendly and what seemed a professional conversation.
She gave them her Government Gateway details to allow them to investigate her account using an AI software.
After a review, they informed Wonda that they could claim somewhere between £50,000 and £58,000! This would be submitted in the first week of May.
Wonda was a little skeptical at this amount so asked to check.
“Wow, really?? Is there any correspondence from HMRC that I can see confirming this? Sorry, I’m still dubious. It just sounds too good to be true!!”
The response: “You will see on Tuesday when the funds arrive”.
On Tuesday morning, a whopping £63,000 landed in her bank account, appearing to come directly from HMRC and logged in the legitimate system as a repayment.
Wonda messaged back, excited, and even joked about getting the champagne ready!
But…
Then then invoice came.
Within hours of the money arriving in Wonda’s account, the company were back in touch, chasing payment to be completed same day. Following up with “What time will this be done?”
The invoice was for £31,635, half of the amount that had landed in her account.
If that weren’t an alarm bell in itself, the invoice wasn’t from the original company, the one she has supposedly been speaking to all along, but an entirely different company (with a name related to trading). And the invoice didn’t describe VAT reclaim services. It described “Marketing and Advertising campaign services”, for billboards, bus advertising, social media campaigns… services Wonda had never requested, agreed to, or received.
It would seem this was deliberately done to make it harder to trace and dispute.
What Wonda did next:
- She contacted us straight away, before paying anything. That was absolutely the right call.
- We checked this over, and had second and third checks with any of the team that would have been dealing with Wonda’s accounts, and confirmed this was a scam.
- Wonda immediately took action, changing her Government Gateway password and removing all external VAT access authorisations.
- She called HMRC directly to report the situation and arranged for the money to be returned. And worked to block and report the company completely.
- After reporting to HMRC, the scammers called approximately eight times that same day, continuing to push for payment of the invoice. When Wonda finally answered, she told them she had received a call from HMRC and was under investigation. Their response was telling: they suggested her accountant must have reported her, and insisted that the invoice still be paid by close of business that day. Wonda held firm, telling them she has been instructed by HMRC to set the money aside and not touch it until the investigation was complete. She had not heard from them since. She moved the funds into an empty savings account to keep them separate and out of the way.
- The speed at which she acted is what will protect her (present tense as at the time of writing this is being investigated with HMRC). Had she paid that invoice first and ask questions later, she would have been in serious trouble.
You might be asking why it’s so dangerous, even though money went in to her account:
This is what seems to make the scam so harmful. It doesn’t feel like a scam because at no point does money leave your account without your knowledge. In fact, it arrives! And you didn’t give away your bank details either.
You might think: even if something’s not quite right, you’re still over £30,000 up after paying the fee.
BUT
The money that arrived was either obtained fraudulently using your Government Gateway information. Or it is a payment that HMRC will investigate and recover. HMRC will come for it. And when they do, you will be expected to repay the full amount, not just what’s left after you’ve paid the scammers their cut.
In the worst-case scenario, you could,
- Pay out £30,000+ to the scam company
- Be required to repay the full £63,000+ to HMRC
- Face penalties and interest on top
- Have your VAT account flagged for investigation
The company (whatever they actually claim their name to be) knew exactly what they were doing. They submitted something through her account, almost collected half the proceeds, and left her to face the consequences.
Red flags
With hindsight, the warning signs were there throughout:
- They were contacting her through WhatsApp and not through any official channel or through her actual accountant.
- They weren’t showing her the claim before it was submitted.
- When Wonda asked to see what was being claimed on her behalf, the company said “I can give you the amount but the full report is provided once the claim is fully completed.” No legitimate advisor would submit a claim on your behalf without your informed sign-off.
- They told her the report would come directly from HMRC, another deflection designed to stop her asking too many questions before the money had arrived.
- The invoice came from a completely different company to the one she had been dealing with, describing services she had never agreed to. There was something off about the email address used on the invoice too!
- The chased a huge payment amount urgently the same morning the money had arrived, before she had any time to think, verify, or speak to anyone.
- When confronted, they attempted to turn it back on Wonda by implying her accountant had done something wrong by reporting it. A classic pressure tactic designed to make you doubt the people actually trying to help you.
What not to do in this situation
- Do not share your Government Gateway username or password with anyone, not a third part company, not someone claiming to work on your behalf, not even someone who sounds authoritative and professional.
- Do not allow anyone access to your HMRC account unless they are a properly authorised agent (your accountant will handle this through HMRC’s official agent authorisation process).
- Do not agree to a claim being submitted on your behalf without seeing and approving exactly what is being claimed.
- Do not pay an invoice the same day if being pressured, take time to verify first.
- Do not assume money in your account is yours to keep just because it came from HMRC. If it seems too good to be true, and there hasn’t been more legitimate contact, it’s probably not yours.
If this has already happened to you, act now!
If you recognise any part of this story, please don’t panic, but act quickly.
Here’s what to do:
- Change your Government Gateway password immediately at gov.uk. Do this first, before anything else.
- Remove external authorisations. Log in to your Government Gateway account, check which agents or third parties have access, and remove any you don’t recognise.
- Do not transfer any money to the company, regardless of how much pressure they apply.
- Call HMRC directly on 0300 200 3300. Explain that your credentials were accessed and that a claim may have been submitted without your proper understanding or consent. Ask for guidance on next steps and how to return any funds that have been incorrectly paid.
- Report the scam to Action Fraud at actionfraud.police.uk or by calling 0300 123 2040. You can also report it to HMRC’s fraud line at gov.uk/report-tax-fraud.
- Contact your accountant straight away. If you are a Whyfield client, please call us immediately. We can help you understand your position, liaise with HMRC if needed, and make sure you are properly protected.
Wonda told us that she felt something wasn’t right, as she said in her messages. But the combination of a friendly, confident contact, the promise of a significant sum of money, and then actually seeing the money arrive in her account was enough to almost override that instinct.
The scammers are sophisticated, patient, and built trust over time (this was over a few weeks).
The single most important thing to take from this is that your Government Gateway login is the key. Guard it like you would your bank pin. No legitimate company will need it, apart from your genuine accountant.
If something feels off, please call us before you do anything else. It costs nothing and could save a lot!
Keep this post in mind for the future, and feel free to share to warn others of what’s possible with scammers these days. The more people that are aware of this kind of scam, the harder it becomes for the people behind it.
What’s next for Wonda?
HMRC have forwarded her email to the Fraud Investigation Team and have frozen the account while they investigate the case.
We will update with more information when we hear more!
As always, if you have any questions, we’re here to help.
You can give us a call on 01872 267 267, message us via WhatsApp on 0777 49 39 111, or email us at [email protected].
And, keep an eye on our socials for more tools, tips, and updates:
