HMRC have agreed new fraud prevention measures with the tax bodies in order to verify a caller's ID when an HMRC employee contacts a tax agent.
- If the agent has requested a call back for Self Assessment (SA) or PAYE, HMRC should request a single use password to be quoted on the return call.
- HMRC’s Debt Management and Banking (DMB) department make unsolicited calls to agents. The caller should be asked to quote two characters from the agent's reference number.
- When a caller claims to be from HMRC’s VAT department, they should be asked for the four digit ID
- If the SA or PAYE team need to make an unsolicited call they should make reference to earlier correspondence/telephone calls as proof of identity.
- In any of these cases, if the agent remains concerned that the caller is not who they claim to be they should request a call back.
If information is shared without verifying the identity of the caller there is a potential risk of violating the Agent's responsibilities in respect of Data Protection and client confidentiality.
