HMRC’s Agent Registration Is Real but the Email Is Not

An email is circulating that says it comes from the HMRC Agent Services Team. It asks the recipient to “review and confirm the registration details held for your agent account so that records remain correct”.

HMRC did not send it. ICAEW reported members receiving it and confirmed with HMRC that the message is fraudulent.

What makes this one worth a closer look is not the email itself, which is unremarkable. It is that the thing it asks you to do is something HMRC has genuinely announced it will ask agents to do.

The Policy It Is Impersonating Is Real

Mandatory agent registration is coming. Agents who hold an agent services account will need to register with HMRC, and HMRC has said it expects to contact them about it.

The timing is the part the scam gets wrong, and it is the detail that protects anyone who knows it. HMRC expects to make that contact in early 2027, not now. ICAEW also understands the contact will be made through the agent services account itself rather than by unsolicited email.

So an agent who has been half-following the policy news has exactly the wrong instinct available. They have read that registration is coming, they have read that HMRC will be in touch, and an email arrives from what appears to be the right team asking them to confirm their details. Every part of that matches expectation except the date and the channel.

Why Anticipating a Real Change Works So Well

The most effective fraud does not invent a pretext. It borrows one that the target has already been told to expect.

A cold email about a tax rebate has to overcome scepticism from a standing start. An email referencing a change the recipient has genuinely read about in their professional press arrives pre-authenticated by their own memory. The recipient is not being persuaded that something is happening; they already believe it, and the email simply appears to be that thing.

This is why announced-but-not-yet-implemented policy is such a productive window for fraudsters. Between the announcement and the rollout there is a period, often a year or more, in which everyone in the profession knows the change is coming and nobody yet knows exactly what the genuine communication will look like. Any plausible message fits the gap.

The practical defence is not scepticism about the policy. It is knowing the two operational facts alongside it: when the real contact is due, and through which channel it will arrive. Those are the details that do not survive being guessed at.

What to Do With It

Suspicious HMRC-related emails should be forwarded to phishing@hmrc.gov.uk, and suspicious texts to 60599.

Forwarding matters more than deleting. A reported campaign can be taken down and the sending infrastructure blocked, which protects the people who receive the same message a week later. A deleted one protects only the person who deleted it.

The general rule holds regardless of what any particular email claims: do not authenticate through a link in a message. Navigate to the agent services account independently and check whether anything is genuinely waiting there. If a real HMRC request exists, it will be visible through the account. If nothing is there, the email answered its own question.

Individual Vigilance Is the Wrong Control

The standard response to a campaign like this is to circulate a warning and ask everyone to be careful. It is worth being honest that this is a weak control.

Asking people to be alert makes protection depend on the least-rested person in the firm having the best information at the moment the message arrives. That is not a defence, it is a hope, and a well-built pretext like this one is specifically designed to survive it. The recipient is not being careless; they are being shown something that matches what they were told to expect.

What works better is removing the judgement from the moment. A firm can state one rule and apply it without exception: no one authenticates to a government service through a link in an email, ever, regardless of how convincing the message is or who appears to have sent it. Access is always by navigating to the service directly.

That rule costs almost nothing to follow, because navigating to the agent services account independently takes a few seconds longer than clicking. And it does not require anyone to correctly identify a fake, which is the part that fails under pressure. A perfect forgery and an obvious one both lose to a person who simply never clicks.

The second half is a route for reporting that people actually use. If forwarding a suspicious message means finding an address, deciding whether it is worth the bother and worrying about looking foolish, most messages get deleted instead. If it means forwarding to one internal address that someone else handles, they get reported.

The Rest of the Fortnight’s Tax News

The same ICAEW round-up, covering the two weeks to 19 August, carried several other items that matter to businesses more quietly.

HMRC published Guidelines for Compliance 19, aimed at UK employers whose overseas workers perform duties in the UK on a short-term basis. Short-term business visitors are a persistent compliance trap because the obligation can arise from a handful of days of UK work, and the employer rather than the individual usually carries it. Any business flying colleagues in for meetings, projects or training has an exposure here that is easy to miss precisely because the visits feel too brief to count.

On trusts and estates, HMRC reminded agents that since April 2026 the inheritance tax and trusts helplines have operated as separate services. The dedicated trusts helpline now handles income tax and capital gains tax for trusts and the trust registration service, while the existing IHT helpline handles inheritance tax on trusts. Calling the wrong one is a wasted morning rather than a penalty, but it is a wasted morning that a lot of people are going to have.

HMRC has also published an online tool for checking filing and payment deadlines and adding them to a calendar. And the Welsh government is consulting on possible changes to how self-catering properties are classified for council tax and business rates, which matters to anyone running holiday lets in Wales.

Separating Announcements From Instructions

There is a useful distinction running through that list.

The helpline split, the deadline tool and the Welsh consultation are announcements. They change what you should know, and nothing bad happens if you read them a fortnight late.

The fraudulent email is an instruction. It wants an action, from a specific person, quickly. That difference is worth attending to as a filter in its own right, because almost every genuine tax communication is closer to the first category than the second.

Real deadlines do exist, and this is not an argument for ignoring anything urgent. It is an argument for noticing when a message’s urgency is doing more work than its content. A genuine regulator publishing a change wants you to understand it. A fraudulent message wants you to act before you have.

The Cost of Getting It Wrong

For a tax agent specifically, the stake is higher than an ordinary phishing attempt.

An agent services account is a key to other people’s tax affairs. An agent holds authorisations across a client base, which means a compromised account is not one exposure but potentially hundreds, spanning filings, repayment claims and personal data belonging to clients who never saw the email.

That asymmetry is presumably why this pretext was chosen. The effort of impersonating HMRC’s Agent Services Team is identical to the effort of impersonating anything else, and the return if it lands is very much larger.

It also means the reporting step is a professional obligation rather than a courtesy. Agents share an attack surface: a campaign that works on one firm will be tried on the rest of the profession, and the same logic applies to any policy change with a long announcement-to-implementation gap. The window between now and early 2027 is exactly when this message will be sent again.

About The Author

Will Lisil

Founder of MW3.biz, building technology that empowers creators and democratising access to digital tools.

See author's posts