HMRC do not send notifications of a tax rebate over email, or request that you update your security certification.
If you receive an email that does not address you by your first name and surname and then asks you to click on a link and/or disclose your details, you may well be revealing your details to a fraudulent website.
If you have received an email from HMRC that you consider to be fraudulent, please forward it to
phishing@hmrc.gsi.gov.uk.
However, if you have already disclosed any of your personal information, for example your HMRC User ID, password or National Insurance number, please forward a report to
security.custcon@hmrc.gsi.gov.uk.
Do not disclose any personal details or information in the email report to us.
You should however list the type(s) of information that you disclosed. For example – I disclosed my Name, Address, Date of Birth, bank card details, HMRC User ID etc.
HMRC cannot reply to every email, but action is taken on each report received.