Welsh Revenue Authority: tax-related phishing and scams

If you’re not sure whether a website, email or phone number associated with the WRA is genuine:

• do not give out personal information (such as bank details or passwords)
• do not reply to it
• do not click any links or download any files

We’ll never ask you for your password or bank details by email or phone.

We’ll only send you links in our emails in reply to your tax-related query.

Report misleading websites, emails, phone numbers, phone calls or text messages you think may be suspicious to us.

If you’re in any doubt, email us at security@wra.gov.wales

Some websites, emails or phone numbers can look like they’re part of an official government service or that they provide more help than they do.

For example, scammers may text, email or phone taxpayers pretending to:

• offer financial support
• issue tax refunds
• demand payment of tax that they claim is owed.

Search our website on GOV.WALES to find the information and services you need.

If an email or text message looks suspicious, do not open or click on any links.

It will help our investigations if you report all WRA related phishing emails, bogus text messages and misleading websites to us.

Please forward to security@wra.gov.wales and then delete it, even if you receive the same or similar phishing email or text message again. We’ll reply to you and may ask you for more information to investigate further.

Email

All our emails will be from addresses with ‘@wra.gov.wales’ or ‘@acc.llyw.cyrmu’ (in Welsh) except for agents registering to file tax online for the first time. They will get a verification code email from Microsoft.

We’ll only send you links in our emails in reply to your tax query, or if you’re an agent (registered with us) and automatically get our operational updates. These links would be to our website on GOV.WALES or LLYW.CYMRU (in Welsh).

Remember, we’ll never send you links if you’ve not contacted us before.

To make sure the email has come from us you can:

• check it includes a unique transaction reference number (UTRN) or a case reference number
• check text hyperlinks (text that’s often blue and underlined) links to the full URL and includes ‘https://’ at the start
• copy and paste the link into your internet browser, rather than clicking on it directly

Calls

If we call you, we may leave a voicemail if you do not answer. But our voicemails will never be an automated message.

If you're not sure if the call is genuine, you can always hang up and call us back using the details provided on our contact us page.

Texts

We’ll never send you a text message. If you receive a text message from a number posing as us, email security@wra.gov.wales

We’ll also never use messaging services, such as ‘WhatsApp’.

Social media

We’ll never use social media to communicate any personal information to you.

Please do not respond to any misleading social media posts or messages with your personal information. Instead, report these to security@wra.gov.wales

Bank and payment details

We’ll never ask you for bank details over the phone or via email. We may ask for this in our online forms. All our forms can be found on our website.

If you receive a WRA related email or call asking you to provide bank details, take down the callers information and contact us.

We’ll never ask you to disclose payment information by email. We may send you an email telling you that you’ve received a rebate, but this email will never include a link to a website to receive your claim.

If you get an email saying you’ve received a rebate and you, or any agent or person acting on your behalf, haven’t asked for one please contact us straight away.

Fraudsters may sign-off such scams using the name of a real WRA member of staff in an attempt to make the scam look genuine. If you’re in any doubt, please do not reply and contact security@wra.gov.wales