HMRC warns universities to protect students from tax scams

The tax authority has written to UK universities advising them to warn first-year students about tax scams sent by fraudsters to steal students’ money and personal details.

Over 620,000 tax-related email scams were reported to HMRC last year – up by 20,000 on the previous year – including thousands of reports the department received about scam emails targeting students.

As with the general public and business, fraudsters are likely to use a range of methods to target students, most commonly by sending fake tax refunds using seemingly legitimate university email addresses (often ending in ‘ac.uk’) in order to avoid detection.

Criminals could obtain a range of valuable information from students, and could steal money, set up direct debits, make purchases for valuable goods on online sites or even take control of their computers and their webcams.

Jesse Norman MP, financial secretary to the Treasury, said: ‘Cyber criminals use every means they can to steal money and personal data from students. That’s why HMRC is asking all UK universities to make sure students know how to protect themselves.

‘HMRC is doing everything they can to clamp down on online fraud, but students and their families need to be vigilant, especially amid all the stresses and strains of going to university. I would urge university principals to take a lead in helping to protect students from these cyber thieves.’

The letters to universities were sent out from HMRC’s head of cyber security, and call on colleges to raise awareness of tax-related scams at the start of the academic year and to integrate scam advice into guidance for new students if they do not already do this.

HMRC advised university leaders that students are ‘more likely to be taken in’ by tax scams because students may have ‘had little or no interaction with the tax system’. This could make the offer of a tax refund from a scammer seem attractive, especially when on a budget.

If students receive an email offering money sent to them by someone claiming to be HMRC and it seems too good to be true, then they should report it to phishing@hmrc.gov.uk

Alistair Jarvis, chief executive at Universities UK, said: ‘This action will help to raise awareness of the risks of tax scams. The security and welfare of students is always a top priority for universities. The message to students is to remain vigilant and question anything that seems unusual.

‘We would encourage any student who fears their account may have been misused to speak to either their university support services, banks, or to the police.’

HMRC-related email scams often spoof the branding of GOV.UK and well-known organisations in an attempt to look authentic. The recipient’s name and email address may be included several times within the email itself. It is important to check the email address carefully as these are frequently personalised emails purporting to look official, using the education prefix ac.uk.

As well as email tricks, phone scams are also being used increasingly by criminals in an attempt to threaten taxpayers into handing over cash – HMRC had over 100,000 reports of such scams last year, compared to 400 in 2016. HMRC has since introduced defensive controls with Ofcom and mobile networks to curtail these scams.