Report suspicious activity happening in an HMRC online account
Find out how to report suspicious activity happening in an online account and keep your personal information safe from identity fraud.
If someone has used your personal information to access your online account or make changes without your permission, it is identity fraud.
If you think someone has accessed your account, you should:
-
report this immediately to HMRC
-
change your online account password, if you still have access
How to identify suspicious activity
Signs to help you identify suspicious activity include:
-
account access codes being sent to your phone when you have not tried to sign in
-
not being able to access the online account because the password has been changed
-
changes to tax records you did not make
-
letters or payments from HMRC you were not expecting
How to report suspicious activity
If you’re an individual or business
If you still have access to your online account, you can sign in to HMRC online services and report suspicious activity from the security console.
If you’re unable to use the security console, use this reporting form. You’ll need:
-
an email address
-
a contact number with preferred times to contact you
-
details of the suspicious activity
If you’re a business, you’ll also need your tax reference.
If you’re an agent
You can use this reporting form to report suspicious activity.
If you’re reporting for yourself, you’ll need:
-
an email address
-
details of the suspicious activity
If you’re reporting on behalf of a client, you’ll also need:
-
authorisation to act for your client
-
your client’s details
Get all of your information together before you start. You will fill this form in online and you cannot save your progress.
What happens next
We’ll conduct an initial review and aim to phone or email you within 10 working days.
Keeping your personal information safe
Do not share your National Insurance number with anyone who does not need it — this will help prevent identity fraud. Find out more about your National Insurance number and examples of organisations who may need to know it.
Stop! Think Fraud has advice on protecting yourself from phishing attacks and fraud.
You can also find out more on how to protect your details and what HMRC does to help keep you safe online.
Updates to this page
-
Guidance has been updated to include agents and businesses and to confirm that HMRC aims to contact you within 10 working days after submitting the form.
-
Added translation