What Happens When Your HMRC Account Is Accessed Without Permission - And What You Should Do Next

If you’ve recently received a letter from HMRC telling you your account was accessed without your permission, you’re not alone. 

HMRC has confirmed a rise in unauthorised access to personal tax accounts, often caused by cybercriminals using stolen credentials to access sensitive taxpayer information — and in some cases, fraudulently claim refunds. Let’s break down what this means for you, how it happens, and what steps you should take right now. 

How Did This Happen? 
Cybercriminals often obtain login details through: Phishing emails pretending to be from trusted sources Reusing passwords leaked in other breaches Unsecured or outdated devices storing login data Once inside, attackers may: View or change your tax details Access financial records Attempt to request refunds on your behalf This doesn’t mean HMRC was directly hacked — it means your login details were compromised somewhere along the chain. 

What You Should Do Now?
If you’ve been contacted by HMRC: Don’t panic — but don’t ignore it. Contact HMRC directly using the official contact points listed on this government page. 

Change your passwords immediately, especially if you’ve used the same password elsewhere. Enable two-factor authentication (2FA) on all financial and professional accounts. Inform your accountant or financial advisor (if you use one) — they may need to take precautionary steps with your records. 

How Key&Box Helps You Stay Protected 
At Key&Box, we’ve built our entire platform around secure, client-first communication — because emailing your NI number or tax code should never have been normal. If you’re a client of a professional services firm using Key&Box, your sensitive documents and messages are protected by: Zero-trust access — only the right people can view what’s shared End-to-end encryption Password and expiry settings for every file and message No data stored in inboxes that can be compromised later 

Final Thought 
Online fraud is evolving — but so is your ability to stay ahead. Even small oversights can create big risks, especially when it comes to your financial and personal data. If you’ve got questions about how your accountant or adviser protects your information, ask them if they’re using Key&Box. Security should never be optional