Council Tax Refund Phishing Scam via Email
Emails claiming a council tax overpayment refund is due direct recipients to a fake council portal that captures banking details rather than issuing any refund.
Part of: Council Tax Refund Phishing Scam
Last reviewed: 5 July 2026
Councils do issue genuine refunds when tax bands change or accounts fall into credit, and this scam times itself to real annual review periods. An email mimicking council branding, with a fabricated reference number, announces an overpayment, and its 'claim your refund' button leads to a lookalike site asking for full bank details or a card number and CVV to 'verify identity.' Some versions invert the flow, requesting an 'administration fee' before the refund is 'released.' The distinction that matters most is the route: genuine refunds are arranged with the council, never through bank details typed into an emailed link.
How this scam works on email refund links
An email arrives styled to look like it is from the local council, stating that a review of council tax band or payment history found an overpayment and a refund is due. It includes a 'Claim your refund' button linking to a page that mimics the council's website, asking for full bank account and sort code details, or in some versions, a card number and CVV under the pretext of 'verifying identity for the transfer.'
A more aggressive variant asks the recipient to pay a small 'administration fee' via card before the refund can be 'released', reversing the direction of payment entirely. The email often includes a fabricated council tax reference number and the recipient's approximate address (scraped from public or leaked data) to appear personalized and credible.
Common red flags
- Email claims a council tax refund is due and requires clicking a link to claim it
- Sender email domain does not match the official council's domain exactly
- Request for full bank details or card information to 'process' or 'release' a refund
- Request to pay a fee before receiving a refund
- Generic greeting or slightly wrong address details despite claiming personalization
- Urgent deadline claiming the refund will be forfeited if not claimed immediately
How to protect yourself
- Contact your local council directly using the phone number on their official website to verify any refund claim
- Never enter bank details into a page linked from an unsolicited email
- Check the sender's email address carefully for domain spoofing or lookalike characters
- Remember that councils never require a fee to release a genuine refund
- Report suspicious emails to your council's fraud team and delete without clicking links
- Use your council's official online account portal directly rather than any emailed link
How to report it
- Forward the phishing email to your national reporting address (e.g. [email protected] in the UK)
- Report to Action Fraud (UK) or the FTC (US)
- Notify your local council directly so they can alert other residents
Frequently asked questions
How can I tell if the sender's email address has been spoofed?
Look closely at the full domain after the @ symbol, not just the display name — scammers often use a domain that looks similar to the council's but with an extra word, hyphen, or different ending. When in doubt, compare it directly against the email address published on the council's official website.
I already entered my bank details on the fake council site — what should I do now?
Contact your bank immediately to explain what happened and ask them to monitor or freeze the account, then change your online banking password if you also entered login details. Report the incident to Action Fraud or your national fraud reporting service as soon as possible.
Do councils ever charge a fee to release a tax refund?
No — a genuine council tax refund you're owed is never conditional on paying a fee first. Any email asking for payment before a refund can be 'released' is a scam, regardless of how official it looks.
How would I know if I'm actually owed a council tax refund?
Check your council tax account directly through your council's official online portal or by calling them using a number you look up independently — never one provided in the email.
Is it safe to click the link just to look, without entering details?
It's safest not to click at all, as some phishing links can attempt to harvest device information or deliver malware even before you enter data.