Are you a new student?

Congratulations. You did it. You got the grades. You’re off to university.

And you’ve probably been working through the summer to save for your first term. Finances are tight for most students, with many having to work during term time too. The last thing you need is be scammed out of your hard earned cash. That’s why we’re publicising this warning about scammers who have a con specifically targeting students.

Who has issued the warning?

HMRC’s head of cyber security wrote to the heads of all universities asking them to incorporate warnings about fake HMRC communications into their other student advice packs. There was a 20,000 increase in the numbers of fake HMRC email scams since the 620,000 reported the precious year. And that’s just the ones that were actually reported to HMRC. Imagine how many are sent. We hope the majority go straight to spam or are deleted by the recipient.

A particular amendment made to scam emails to students is the addition of ‘ac.uk’ in the email address, making it look like an official university contact. Emails to students are usually promising a fake tax rebate, which makes a certain amount of sense if you’ve been working all summer. And student tax rebates are definitely a real thing. But their aim is to get your private personal and financial information, in order to use it to procure money in other illegal ways – such as setting up direct debits using your details. And, quite simply, stealing the contents of your bank account.

Financial secretary to the Treasury, Jesse Norman MP, said: “Cyber criminals use every means they can to steal money and personal data from students. That’s why HMRC is asking all UK universities to make sure students know how to protect themselves. HMRC is doing everything they can to clamp down on online fraud, but students and their families need to be vigilant, especially amid all the stresses and strains of going to university. I would urge university principals to take a lead in helping to protect students from these cyber thieves.”

I think I’m pretty cyber security aware

We know you’ve probably been on the receiving end of a lot of unsolicited advice, as you prepare to start university. And no one thinks that you’re not aware of your online security.

Unfortunately, criminals are adaptable, sophisticated and creative when it comes to their unlawful schemes. They target specific groups of people at particular times of year, when they are expecting to get legitimate communication from HMRC. They capitalise on people’s wariness or ignorance of how HMRC works and their fear of being in debt to the Tax Office. As its Fresher’s Week in different universities all around the country, they’ve developed a scam especially for you.

It’s important to know what is out there, so you can continue to protect yourself. You probably haven’t had many legitimate dealings with HMRC yet, which makes criminals assume that you will be more likely to accept official looking communications without any questions.

How do I avoid these fake HMRC scams?

It’s worth pointing out that criminals don’t just use email. There have been SMS, real life letters and phone scams all purporting to be HMRC and all with the exact same purpose – to relieve you of your money and/or information, or to gain remote access to your computer. They are very good at stealing logos and other branding features, include links to real HMRC pages and use your name throughout. Even the wording has become better over time.

There are several basic things to do to avoid these fake HMRC scams.

  • Slow down your reactions. Don’t just automatically follow the instructions in something that looks like it’s from HMRC. Wherever you are, whatever you’re doing, when you receive the email, don’t reply straightaway. Flag it and come back to look at it when you’ve got time to really interrogate its integrity.
  • If something doesn’t look right, get in touch with HMRC using an official phone number before you do anything. HMRC prefer that you do this, they will never accuse you of wasting their time.
  • The old saying is, sadly, true: ‘If it seems too good to be true, it probably is.’
  • No real organisation asks you for your private, personal or financial information by email, text or phone. That includes HMRC, banks, building societies and other government departments. Do not give your bank details, passwords or PIN to anyone.
  • Do not click on any link or attachment unless you are sure it is legitimate. Think before you click.
  • Send any suspicious texts to 60599 and forward emails to phishing@hmrc.gov.uk, only if they say they are from HMRC. Even if you haven’t been a victim of the scam or lost any money, this information helps HMRC and the police to construct a national picture of the criminals’ activities.

What if I lose money to one of these scams?

Do not be embarrassed. People from all walks of life fall victim to these scams every day. The criminals are good at what they do. Get in touch with your bank immediately, if you think you’ve given your details to a fraudster. Then get in touch with your Student Union for help and report it to the police. Action Fraud is another place for you to report the crime on 0300 123 2040. Do not fell too ashamed to speak out. Unfortunately, you are most definitely not alone.