The MTD deadline is the scammers' deadline too

More than 864,000 sole traders and landlords were due to send their first Making Tax Digital quarterly update by 7 August. For most of them it is the first time HMRC has ever wanted something from them in August, and that is the detail worth noticing.

A very large number of people are currently sitting there half-expecting a message from HMRC.

A scammer does not need a clever story when the story has already been written for them. HMRC took more than 135,500 reports of suspected scams in the ten months to December 2025, and closed down nearly 25,000 fake websites and phone numbers in the same period. Those numbers cluster around deadlines, because that is when the lie is plausible.

The advice you were given is wrong in one important way

Somebody has told you that HMRC never sends text messages, never emails, and never uses QR codes. It is repeated every January and it is not true.

HMRC does send texts to some people, and those texts can contain links to GOV.UK or to HMRC webchat. HMRC does put QR codes in its letters, and since 2024 those codes do not always land on GOV.UK. Both facts are on HMRC's own guidance page.

This matters more than it looks. Advice that is plainly false gets discarded in one piece, and the true half goes out with it. Someone who has been told "HMRC never texts" and then receives a genuine text has learned that the rule is nonsense, which is exactly the frame of mind the next fake is hoping for.

Here is what HMRC says it will never do, which is a much shorter and much more useful list:

Leave a voicemail threatening legal action or arrest.
Ask for personal or financial information by text or email.
Contact you by email, text or phone about a refund, or ask you to claim one.
Ask you to pay with gift or payment vouchers.

Refunds are the big one. Nearly 29,000 of those scam reports referred to fake tax refunds. A real refund sits waiting in your HMRC online account or the HMRC app; nobody rings you about it.

The habit that survives every new format

Spelling mistakes stopped being a reliable tell some time ago. The copy in these messages is now clean, correctly branded, and often better written than the real thing. Caller ID can be spoofed, so the number displaying as HMRC's proves nothing.

So stop trying to judge the message. Judge the route instead.

Never travel to your tax account through something that arrived. Not through a link, not through a QR code, not through a phone number in a letter. Open the HMRC app, or type the address yourself. It takes twenty seconds longer than clicking and it works whether the message was a crude fake, a very good one, or entirely genuine, which is what makes it worth turning into a habit rather than a decision.

If a message wants you to act inside the next hour, that urgency is the product. HMRC's own checklist for spotting a scam leads with it: it could be a scam if it rushes you.

What the fakes will say this quarter

Nobody knows what a normal MTD message looks like yet, because there has not been one before. That is a gift to whoever is writing the fakes, and the shapes are predictable enough to name in advance: your quarterly update failed to submit, your MTD sign-up is incomplete, a penalty has been issued for a missed update.

Two facts make that last one collapse.

No penalty points are being issued for late quarterly updates during the first year of MTD for Income Tax. And the quarterly update is not a tax return; the return deadline is still 31 January. A message demanding immediate payment because you missed a quarterly update is describing a penalty that does not exist yet.

If you did miss 7 August, the honest answer is that it is not an emergency. Take it up with whoever does your books, at a normal hour, through a number you already had.

The bit that is actually a business problem

Everything above is advice for a person. The thing we see go wrong is structural.

Tax correspondence tends to land in a shared mailbox, and a shared mailbox means several people can act on it and each of them assumes somebody senior has already looked. It also means nobody is quite responsible for it. Pick one person who handles anything claiming to be from HMRC, and make it a rule that nobody else acts on one, including you.

The second rule is duller and more valuable: no bank details change on the strength of a message. Not an email, not a text, not a letter. A phone call to a number you already held, or nothing.

Do not expect the spam filter to carry this for you. The convincing fakes are sent from domains the criminals own and have configured properly, so they pass authentication and arrive looking healthy. Email authentication is worth getting right, and it protects your customers from people pretending to be you, but it does not tell you whether the sender is really HMRC.

01Do not reply, click or scan
02Forward a suspect text to 60599, or an email to [email protected]
03Delete it
04If you already gave out details, report the disclosure to HMRC's security team on GOV.UK
05If money has gone, ring the bank first, then Report Fraud

Put the next one in the diary

The second quarterly update is due on 7 November, the third on 7 February. The wave repeats with them, and it will grow, because from April 2027 the threshold drops to £30,000 and a lot more people join the list.

Marking the deadline in the diary is obvious. Marking the fortnight around it as the period when the fakes arrive is the part most people miss, and it costs nothing.

We run Microsoft 365 for our clients and build the systems that talk to HMRC, Xero and Companies House for our sister practice, Opus Accountancy. When a client forwards us something and asks whether it is real, the answer nearly always comes from the route rather than the wording. Ask us if you are unsure about one. It takes a minute, and it is a better use of the minute than deciding on your own at half past seven in the evening.

We work with businesses across Knutsford, Alderley Edge, Wilmslow, Altrincham, Stockport and Warrington, and remotely for clients anywhere in the UK.