Self Assessment Tax Return Spam

It is the time of year when millions of people are sending their self-assessment tax returns to HM Revenue and Customs (HMRC). In fact, they should have been sent by now.

As with so many e-mail spam attacks, they are designed to coincide with major events and this years self-assessment has attracted a new wave of spam e-mails.

In one of my other domains, I counted 201 separate messages sent to different aliases. They were all sent from alerts@hmrc.gov.uk.

It was easy enough to do a quick lookup to find out from where in the world the messages were sent. Here is a selection of the IP addresses that were used:

83.58.17.143 – Spain
69.157.31.168 – Canada
85.71.135.24 – Czech Republic
79.100.141.133 – Bulgaria
190.68.226.50 – Colombia
123.20.125.100 – Vietnam

I don’t think it would be paranoid to assume that these messages are spam as I really doubt that HMRC would be using mail relays all over the world.

If you see a message from alerts@hmrc.gov.uk, please don’t open it, and whatever you do, DO NOT open any attachments!

From the HMRC website:

Phishing examples
(emails, letters, bogus callers, SMS text messages)

1. Tax rebate / tax refund – email scam

HM Revenue & Customs (HMRC) will never send notifications of a tax rebate / refund by email, or ask you to disclose personal or payment information by email.

Do not visit the website contained within the email or disclose any personal or payment information.

A selection of fake email addresses used to distribute the tax rebate emails can be seen below:

  • services@hmrc.co.uk
  • noreply@hmrevenue.com
  • service@hmrc.gov.uk
  • service.refund@hmrc.gov
  • secure@hmrc.co.uk
  • hmrc@gov.uk
  • taxes@hmrc.co.uk
  • taxrefund-notice@hmrc.gov.uk
  • taxrefund@hmrc.gov.uk
  • refund-help@hmrc.gov.uk
  • service@online.com
  • email@hmrc.gov.uk
  • refund.alert@hmrc.gov.uk
  • refunds@hmrc.gov.uk
  • customs@hmrc.gov.uk
  • srvcs@hmrc.gov.uk
  • alertsonline@hmrc.co.uk
  • info@hmrc.gov.uk
  • rebate@hmrc.gov.uk

HMRC does not use any of the above email addresses.

http://www.hmrc.gov.uk/security/

This entry was posted in Anti Virus, E-mail, IT Security and tagged , , , , . Bookmark the permalink.