What to do if…
a government agency contacts you demanding information and you are unsure what to provide

What to do now

1. Break the live contact safely. If this is a call, say: “I can’t deal with this right now. I’ll contact the organisation through its official details.” Then end the call. If it is an email or text, do not reply, click links, open attachments, or use the contact details in the message.

2. Verify the organisation independently.

   • Search GOV.UK or the organisation’s official website yourself.
   • Use the main switchboard, online account, official portal, or published contact route you find there.
   • Ask whether the reference number, team name, deadline, and request are genuine.

3. If it claims to be HMRC, use HMRC’s official checking pages.

   • Check whether the type of call, text, email, or letter is listed as genuine.
   • If the contact cannot be verified, stop engaging with it.
   • HMRC scam messages and calls can look convincing, so do not rely on the sender name or number alone.

4. If it looks like phishing or impersonation, report it and stop engaging.

   • Forward suspicious emails to [email protected].
   • Forward suspicious text messages to 7726 if your mobile provider supports this service.
   • If you have already shared passwords, bank details, payment-card details, identity documents, or access codes, contact the relevant bank, account provider, or card provider using official contact details.

5. Ask for the request in writing, with specifics. Ask for:

   • exactly what information or documents they want;
   • why they want it;
   • the legal power, formal notice, or reason they rely on;
   • whether each item is compulsory or voluntary;
   • the deadline and what happens if you need more time;
   • the secure way to respond;
   • a reference number, team name, and official contact route.

6. Sort the request into rough categories.

   • Routine or voluntary request: you can ask questions, narrow the request, or decline items that are not required.
   • Formal or compulsory notice: it may cite a specific power, deadline, offence, penalty, or appeal route.
   • Police or law-enforcement contact: it may involve questions, a statement, an interview, or evidence. If you cannot tell which category it is, treat it as unclear and do not provide information until you have verified it and asked what makes it compulsory.

7. Narrow the scope before sending anything. Once verified, ask: “Please confirm the minimum information you require and the secure official route for providing it.” Send only what has been requested, unless you have had advice that more is needed.

8. Use a safe delivery route.

   • Use the organisation’s official portal, online account, postal address, or secure upload route found independently.
   • Avoid sending sensitive documents by ordinary email unless the organisation confirms that this is the correct route.
   • Keep copies of what you send.

9. If police want an interview, statement, or informal chat, pause for legal advice.

   • You can say: “I want legal advice before answering questions.”
   • If you are arrested or questioned at a police station, ask for free legal advice.
   • If you do not have your own solicitor at the police station, ask for the duty solicitor.

10. Keep a simple record. Note the date and time, who contacted you, what they asked for, the reference number, how you verified it, who you spoke to, and what you sent. Keep copies or screenshots of letters, emails, texts, envelopes, and web pages used to verify the contact.

11. If the issue is about your personal information being mishandled, use the data-protection complaint route. Usually start by complaining to the organisation and keeping a copy of that complaint. If it is not resolved, you can consider complaining to the Information Commissioner’s Office.