03/06/2026
We are currently seeing a significant rise in cases where newly issued VAT registration numbers are being fraudulently accessed before the taxpayer has had the opportunity to register them on their Government Gateway account.
This issue is now widespread. Many managing partners and directors across accountancy practices are aware of at least one client who has been affected.
While the perpetrators have not been formally identified, the pattern strongly suggests organised cybercrime activity. Fraudsters appear to be systematically identifying unregistered VAT numbers, claiming access to them, and submitting repayment claims to extract funds.
What to do if you believe your VAT number has been compromised:
Contact HMRC VAT Online Services immediately on 0300 200 3701 and request that the unauthorised Government Gateway access is removed.
HMRC will typically require confirmation from a company director or officer. However, we are happy to join calls with clients to ensure the situation is handled efficiently and that all parties remain fully informed.
Please be aware that resolution may not be achieved in a single call and could require ongoing follow-up.
HMRC has not yet released specific figures relating to VAT registration hijacking. However, it has disclosed that approximately 100,000 PAYE, Self Assessment, VAT, and Corporation Tax accounts have been compromised through phishing activity.
Reporting suspicious communications:
Forward suspicious emails to: [email protected]
Forward suspicious text messages to: 60599
We strongly advise all businesses to remain vigilant. This issue is placing an increasing administrative burden on UK businesses at a time when focus should be on growth and operations.
If you have any concerns or require assistance, please contact Girlings & Co without delay!