The figures underline the rapid growth of online scams and scam websites aimed at cheating consumers. Many are fake HMRC sites.
The warning comes as Scam Awareness month, run by Citizens Advice, draws to a close.
HMRC has brought in additional technology to tackle cyber-crime but says the public needs to be aware and report phishing attempts to defeat the criminals. Ministers say savers can also take action themselves to protect their savings.
HMRC advises that genuine organisations, like banks and HMRC, will never contact people out of the blue to ask for their PIN, password or bank details. It urges people to never give out private information, download attachments or click on links in emails and messages they were not expecting.
During the financial year 2017/18 HMRC responded to nearly 1 million phishing referrals
Treasury Minister Mel Stride MP, Financial Secretary to the Treasury said: “The criminals behind these scams prey upon the public and abuse their trust in government. We’re determined to stop them. “
The most common type of scam is the ‘tax refund’ email and SMS. HMRC does not offer tax refunds by text message or by email.
HMRC has been trialling new technology which identifies phishing texts with ‘tags’ that suggest they are from HMRC and stops them from being delivered. Since the pilot began in April 2017, there has been a 90% reduction in people reporting spoof HMRC-related texts.
In November 2016, the department implemented a verification system, called DMARC, which allows emails to be verified to ensure they come from a genuine source. The system has successfully stopped half a billion phishing emails reaching customers, says HMRC.
HMRC says it has also saved the public over £2.4m by tackling fraudsters that trick the public into using premium rate phone numbers for services that HMRC provide for free.
Scammers often create websites that look similar to HMRC’s official site and then direct the public to call numbers with extortionate costs. HMRC has successfully challenged the ownership of these websites which masquerade as official websites.