Is My HMRC Crypto Letter Genuine? How to Check Safely

To check whether an HMRC crypto letter, email or text is genuine, compare it with GOV.UK's own lists of genuine HMRC contacts, never click links or call numbers in the message, and remember that HMRC will never ask for bank or card details by email or text. HMRC does contact people who have traded crypto by letter, email or text, so a real one is plausible. This guide explains what a genuine crypto message looks like, the checks for each channel, the red flags, and how to report a scam without putting yourself at risk.

Does HMRC really contact people about crypto?

Yes. GOV.UK's page on genuine HMRC contact that uses more than one communication method has a Cryptoassets entry. It says that if you have traded in cryptoassets, HMRC may contact you by letter, email or text message. The letter or email gives links to guidance to check that you have declared crypto activities correctly, to report your crypto income and gains, to a HMRC video about how crypto is taxed for individuals, and to check if you need to pay tax when you sell cryptoassets. It also explains what a disposal is. The text message directs you to guidance on GOV.UK.

So a genuine crypto contact points you to GOV.UK guidance. It does not ask you to pay by an unusual method, log in through a link or hand over bank details. Our HMRC crypto letter page explains what these letters are and why people receive them.

How do you check a crypto letter, email or text is genuine?

Use the matching GOV.UK page, all of which list the current genuine messages and were updated in August and September 2026:

Links to each page are in the sources at the bottom. Open them by searching GOV.UK yourself rather than from a link in the message.

What are the red flags that a message is a scam?

GOV.UK and the Low Incomes Tax Reform Group (LITRG) point to the same signs:

• A request for bank details, card numbers or passwords. GOV.UK says HMRC will never ask for personal or financial information by text, and will only email about a tax rebate or ask for personal or payment information from an address ending in hmrc.gov.uk.
• An email address that does not end in hmrc.gov.uk for anything asking for information. GOV.UK says such requests will not be genuine.
• A tax refund offered without explaining why. GOV.UK says not to open links or reply to a text that offers a tax refund in exchange for personal or financial details.
• Pressure. LITRG lists telling you to act immediately, or threatening legal action with no previous contact, as signs of a scam.
• Unusual ways to pay. Asking you to pay in vouchers, gift cards or by transfer to a personal account is not how HMRC works.
• Phone numbers or links that do not match GOV.UK. LITRG suggests comparing the numbers on a letter with GOV.UK, and using GOV.UK's numbers rather than the letter's if anything looks wrong.

A genuine crypto letter asks you to review and correct your tax position, and gives a date. It does not demand immediate payment.

What if the letter is not on GOV.UK's list?

Don't panic. LITRG says a letter that is not on the list might still be genuine, but it is a sign to take extra care. Find the phone number for the relevant HMRC team on GOV.UK, such as the Self Assessment general enquiries line, and read out the reference and wording from your letter. The adviser can tell you whether it is genuine and explain it. That way you are speaking to a real HMRC adviser and you do not miss a real deadline.

How do you report a suspicious message?

GOV.UK's page on reporting suspicious HMRC contact says:

• Emails. Forward suspicious emails to phishing@hmrc.gov.uk, then delete them.
• Text messages. Forward suspicious texts to 60599 (charged at your network rate), then delete them.
• Phone calls. Use the "Report a suspicious HMRC phone call" online service on GOV.UK.

If you have already clicked a link or entered card or bank details, contact your bank straight away, then report it to HMRC as above.

Is my exchange asking for my National Insurance number a scam?

Probably not, but check. Since 1 January 2026, UK crypto platforms must collect your name, date of birth, address, country of residence and your National Insurance number or Unique Taxpayer Reference, and they report your 2026 activity to HMRC between 1 January and 31 May 2027. A user who does not give valid details can face a penalty of up to £300. That is a real legal requirement, so a request from your exchange is normally genuine.

Scammers know this, so they imitate the request. Don't follow a link in an email or text: open your exchange's app or type its address yourself and look for the request there. Our guide to what HMRC knows about your crypto explains what is reported and when.

What should you do once you know it is genuine?

A genuine crypto letter is a prompt to review your position, not an accusation. Do not ignore it, and use the date on your own letter rather than one you read online. Our printable HMRC crypto letter checklist takes you through the steps, and the letter helper builds a personalised checklist and deadline reminder. When you are ready to work out your position, the free crypto tax calculator applies HMRC's matching rules to your exchange exports. If earlier years are affected, see the Cryptoasset Disclosure Service guide.

Sources

• Check if a letter you've received from HMRC is genuine — GOV.UK
• Check if an email you've received from HMRC is genuine — GOV.UK
• Check if a text message you've received from HMRC is genuine — GOV.UK
• Check genuine HMRC contact that uses more than one communication method — GOV.UK
• Check if a QR code on a letter you've received from HMRC is genuine — GOV.UK
• Report suspicious HMRC emails, texts, social media accounts and phone calls — GOV.UK
• Is that HMRC letter genuine? Here's how to check safely before you act — Low Incomes Tax Reform Group
• Collecting cryptoasset user and transaction data — GOV.UK