Guidance on Avoiding and Reporting Welsh Revenue Authority Tax Scams

How to identify genuine Welsh Revenue Authority contact and avoid tax scams

The Welsh Revenue Authority (WRA) gives security guidance to help people spot fake emails, calls, websites and refund or payment scams. The key message is to be cautious with unexpected contact, never share personal or banking details through suspicious messages, and check any query using official GOV.WALES contact details.

• The WRA says it will never ask for your password or bank details by email or phone, and it does not send text messages or use WhatsApp.
• Genuine WRA emails should usually come from @wra.gov.wales or @acc.llyw.cymru, with a limited exception for some first-time agent registration emails sent by Microsoft.
• The WRA only sends email links in limited cases, such as replying to your tax query or sending updates to registered agents, and those links should go to GOV.WALES or LLYW.CYMRU.
• Unexpected messages about rebates, refunds, overdue tax or payment requests should be treated with caution, even if they use official branding or a real staff name.
• If you are unsure, do not reply, click links, download files or use the contact details in the message; instead, check the WRA’s official contact page.
• Suspicious emails, websites, phone numbers, calls or social media messages should be reported to [email protected].

Scroll down for the full analysis.

How to recognise genuine Welsh Revenue Authority contact and avoid tax scams

This page explains how the Welsh Revenue Authority, or WRA, says it will and will not contact you. That matters if you deal with Land Transaction Tax or other Welsh taxes, because scam emails, calls and websites often pretend to be official. The practical aim is simple: protect your personal information, avoid paying the wrong person, and know what to report.

What this rule is about

The source material is not a tax charging rule. It is official security guidance about phishing, fake websites, bogus payment demands and refund scams linked to the WRA.

For anyone involved in a property transaction, this is important because tax returns, payments, refunds and correspondence often involve sensitive personal and financial information. A message that looks convincing may still be fraudulent. The guidance sets out warning signs and explains the WRA’s normal communication methods.

What the official source says

The WRA says that if you are unsure whether a website, email or phone number is genuine, you should not give personal information, should not reply, and should not click links or download files.

The WRA states that it will never ask for your password or bank details by email or by phone.

It also says:

• its emails will come from addresses ending “@wra.gov.wales” or, in Welsh, “@acc.llyw.cymru”
• there is one stated exception for some agents registering to file tax online for the first time, who will receive a verification code email from Microsoft
• it will only send links in emails if it is replying to your tax query, or sending operational updates to registered agents
• those links should point to GOV.WALES or LLYW.CYMRU pages
• it will never send links if you have not contacted it before
• it never sends text messages
• it never uses messaging services such as WhatsApp
• it will never use social media to communicate personal information
• if it calls and you do not answer, it may leave a voicemail, but not an automated voicemail
• it will never ask for payment information by email in relation to a tax refund or rebate

The WRA also asks people to report suspicious emails, texts, websites, phone numbers, calls or social media messages to [email protected].

What this means in practice

The main practical point is that you should treat unexpected contact about tax with caution, especially where it involves urgency, money, refunds or requests for personal details.

In practice, the safest approach is to separate the message from the action you take. Do not use the phone number, link or reply address in the suspicious message. Instead, go directly to the WRA’s official GOV.WALES pages and use the contact details published there.

This matters in several common situations:

• If you receive an unexpected email about a rebate, do not assume it is genuine merely because it uses official branding or the name of a real member of staff.
• If someone calls asking for bank details, that is inconsistent with the WRA guidance.
• If you receive a text claiming to be from the WRA, the guidance says it is not genuine.
• If an email contains a link and you have not previously contacted the WRA, that is a warning sign because the WRA says it will not send links out of the blue.

The guidance also recognises that some scam communications are designed to look helpful rather than threatening. They may offer financial support, promise a refund, or say tax is overdue. The fact that a message appears useful does not make it genuine.

How to analyse it

A sensible way to check a message is to work through a short set of questions.

• Was the contact expected? An unsolicited message is riskier.
• What channel was used? A text message, WhatsApp message or social media message is inconsistent with the WRA guidance.
• What is being asked for? Requests for passwords, bank details or payment information by email or phone should be treated as suspicious.
• What is the sender address? The WRA says its emails should come from the official domains it names, subject to the Microsoft verification email exception for first-time agent registration.
• Does the email contain links? If so, did you contact the WRA first, or are you a registered agent receiving operational updates?
• Where does the link actually go? The guidance says genuine links should be to GOV.WALES or LLYW.CYMRU pages. Check the full URL rather than relying on the visible text.
• Does the message include a UTRN or case reference number? The WRA says that can help you verify whether an email is genuine.

If doubt remains, the guidance points to two practical steps: stop engaging with the message, and contact the WRA using details from its official contact page or email [email protected].

Example

A buyer’s solicitor receives an email saying a Land Transaction Tax rebate is ready and asking them to click a link to confirm banking details. The email uses the name of a real WRA staff member.

On the WRA guidance, several warning signs appear at once. The WRA says it will never ask for bank details by email, and a rebate email will not include a link to a website to receive the claim. The use of a real staff name does not make the email genuine. The safest response is not to click the link, not to reply, and to report the email to [email protected].

Why this can be difficult in practice

Some scam messages are convincing because they copy official language, branding or staff names. Others exploit real tax events, such as a return being filed, a refund being expected, or an agent registering for online filing.

The source itself includes one important exception: first-time agents registering to file tax online may receive a verification code email from Microsoft. That means a message from a non-WRA domain is not automatically fraudulent in every case. The right question is whether it matches the specific process the WRA describes.

Another difficulty is that genuine communications may sometimes refer to real case details, such as a unique transaction reference number or case reference number. That can be a useful sign, but it should not be the only check. The overall context still matters, including the sender address, the communication channel used, and whether the message asks for information the WRA says it does not request in that way.

Key takeaways

• The WRA says it will never ask for passwords or bank details by email or phone, and it never sends text messages or uses WhatsApp.
• Unexpected refund, rebate or payment messages should be treated carefully, especially if they contain links or ask for personal or financial information.
• If in doubt, do not engage with the message and report it to [email protected], then use official GOV.WALES contact details to verify anything important.

This page was last updated on 24 March 2026

Useful article? You may find it helpful to read the original guidance here: Guidance on Avoiding and Reporting Welsh Revenue Authority Tax Scams

View all WRA LTT Guidance Pages Here