HMRC Scam alert

[johnny10hands]

Just in case anyone hasn't yet seen one of these:

 

 

TAX RETURN FOR THE YEAR 2009

RECALCULATION OF YOUR TAX REFUND

HMRC 2008-2009

 

 

Date: 08/03/2009

LOCAL OFFICE No. 3819

TAX CREDIT OFFICER: David Craig

TAX REFUND ID NUMBER: 381716209

 

 

 

Dear Applicant,

 

HMRC announce you after the last annual calculation of your fiscal activity we have determined that you are eligible to receive a tax refund of 285.45 GBP

 

You have attached the tax return form with the TAX REFUND ID NUMBER: 381716209, complete the tax return form attached to this message.

 

After completing the form, please submit the form by clicking the SUBMIT button on form and allow us 5-9 business days in order to process it.

 

Our head office address can be found on our web site at http://www.hmrc.co.uk/

 

Sincerely,

David Craig

Tax Credit Office

Preston

PR1 0SB

 

__________________________________________________________

 

As I was expecting some tax back, I looked a little deeper, but when I clicked on the attachment that was a web page, I discovered it was asking for information including last 3 digits on the back of your credit card etc, so decided it was indeed a [problem].

 

The HTML document is downloaded from 87.248.114.86

 

Now hopefully some IT master who sees the above, and has the ability, will give them a jolly good "cybershafting"

[RichardM]

Good call on the suspected [problem], unless hmrc are now using yahoo servers .

 

Suggest you send a copy of the phishing page to yahoo who should remove it at the very least.

[rickyd]

I would notify HMRC too, they're bound to be interested in someone impersonating them and they have much deeper pockets than you or I.

[Tezcatlipoca]

I clicked on the attachment that was a web page

 

Still got a copy of that attachment? I'd be curious to take it apart and have a look at the code.

[mazbck]

I had about 4 emails about the same a couple of weeks ago, and followed the directions on the HMRC website. I knew it was a [problem] as one of the emails went to an email address I use only for online gaming!!!

 

 

HM Revenue & Customs: Fraud and scams

 

Just forward the email to them and they will investigate it.

[johnny10hands]

mazbck, thanks for the email addy at the tax office, have just forwarded the whole email to them.

 

Tezcatlipoca, PM me with your email addy and I will forward it to you.

I did actually click on the link without even thinking. but it didn't register as a virus through Avast (have run a scan aswell and nothing appears to be onmy PC).

 

The file extension is .pdf.htm so it was a webpage posing as a PDF document

[FlyboyAgain]

mazbck, thanks for the email addy at the tax office, have just forwarded the whole email to them.

 

Tezcatlipoca, PM me with your email addy and I will forward it to you.

I did actually click on the link without even thinking. but it didn't register as a virus through Avast (have run a scan aswell and nothing appears to be onmy PC).

 

The file extension is .pdf.htm so it was a webpage posing as a PDF document

 

Deleted. Sorry, got confused.

 

The link looks ok to me?

Edited August 14, 2009 by FlyboyAgain

[legalpickle]

Normally in these scams the e-mail shows the correct web address, but the HTML code actually links to a different site that looks similar, but is not. They usually build a fake page looking like the site they are covering and trick too many people into entering their details. That's why when one copies the text without the code into public forums you don't realize it's definitely a [problem], because it's not copying the HTML code showing the fake web address.

 

They also normally have terribly bad spelling!