A growing threat is targeting UK businesses at one of their most vulnerable moments: VAT registration.
Fraudsters are hijacking newly issued VAT numbers by swiftly linking them to Government Gateway accounts they control. This allows them to file fake VAT returns and redirect repayments into their own bank accounts—often before the legitimate business owner has even set up their own online access.
The scam exploits a critical timing gap. Criminals act fast, taking advantage of the brief window between VAT registration and the business owner establishing their Government Gateway account and linking the VAT registration to the account. Many victims only discover the fraud when they try to add VAT services to their account, only to find the VAT number already linked elsewhere. By the time HMRC flags suspicious repayment claims, the damage may already be done.
This is a wake-up call for businesses and advisers alike: VAT registration must be treated as a high-risk moment requiring immediate digital action. Setting up a Government Gateway ID and linking VAT services should happen as soon as the VAT number is issued. Any errors or delays in this process could signal unauthorised access. Unexpected correspondence from HMRC—especially about repayments or compliance checks—should be treated with urgency.
While HMRC continues to strengthen its systems, the best defence remains speed and vigilance. If you’re registering for VAT or advising clients, act quickly to secure accounts and monitor for signs of fraud.
If you would like to discuss further, our VAT team are always here to help – [email protected]
