Is a text saying I have unclaimed tax money waiting for me real?
Unexpected tax refund texts are almost always phishing scams. Tax authorities communicate through your tax account or by post — not via SMS links.
Last reviewed: 1 August 2026
Explanation
Tax rebate phishing is perennially popular because tax refunds are a genuine occurrence. A convincing SMS claims you are owed a refund and provides a link to claim it. The link leads to a fake government tax portal that captures personal and banking details. Real tax refunds from HMRC, the IRS, or equivalent agencies are calculated and issued automatically. When a refund is due, you are notified through your tax account or official correspondence. You are never required to click an SMS link to trigger or receive a tax refund. If you believe you may genuinely be owed a rebate, check your tax account directly at the official government website.
Tax rebate phishing clusters around the times of year when refunds are plausible — after filing deadlines and year-end reconciliations — which is precisely when a refund message feels expected rather than suspicious. The fake portals are close copies of the real thing and typically ask for far more than a refund would ever require: full card numbers, online banking credentials, your national identity number, sometimes your mother's maiden name. That over-collection is the tell. A genuine refund needs nothing from you at all, because the tax authority already holds your details and pays through established channels.
If you clicked and entered information, act on the assumption it will be used. Contact your bank to protect the card or account, change any passwords you entered (and anywhere else you reuse them), and consider a fraud alert on your credit file if identity numbers were shared. Report the message to your tax authority's phishing address so the domain can be taken down — these campaigns are run in waves, and the page that caught you is catching others the same day.
Common red flags
- Unsolicited SMS about unclaimed tax money
- Link to a site that is not the official government tax domain
- Requires bank details to receive the refund
- Urgency — rebate expires within a short timeframe
What to do now
- Delete the message and do not click the link
- Log into your tax account directly through the official government website
- Report tax phishing texts to the relevant tax authority
- If you shared bank details, contact your bank immediately
Frequently asked questions
How will I know if I genuinely have a tax rebate?
Your tax authority will notify you through your account portal or by post. In the UK, HMRC sends a P800 letter. In the US, the IRS issues a refund notice. You do not need to act on an SMS.
Why does the fake refund site ask for so many details?
Over-collection is the point — card numbers, banking logins, and identity numbers are each valuable separately. A genuine refund requires nothing from you, because the tax authority already has your details and pays automatically.
I entered my details on the linked site — what should I do?
Contact your bank immediately, change any passwords you typed (everywhere you reuse them), and consider a credit-file fraud alert if identity numbers were shared. Report the message to your tax authority so the fake site can be taken down.