Imagine this: You’ve done the hard work, filed your VAT return, and you’re expecting a nice little refund to help with cash flow. You check your bank account on Friday morning, expecting to see those funds hit. Nothing. You wait until Monday. Still nothing.
You log into your HMRC Business Tax Account, thinking there’s just been a delay. But when you look at your "Bank Details" section, your heart sinks. The sort code and account number looking back at you aren’t yours. They belong to someone you’ve never heard of.
Welcome to the world of VAT hijacking. It’s a growing problem in 2026, and even with all the digital bells and whistles HMRC has introduced, fraudsters are still finding ways to redirect your hard-earned money into their own pockets.
At Makes Sense Accountants, we’re seeing more and more of this. It’s frustrating, it’s scary, and it’s completely avoidable if you know what to look for. I’m Tim Hammond, and today I want to walk you through exactly how these "paper hijacks" work and, more importantly, how you can stop them.
The Sneaky Return of the Paper Form
You’d think that in 2026, everything would be 100% digital. For the most part, it is. HMRC has pushed "Making Tax Digital" (MTD) hard over the last few years, making it the default for almost every business interaction. But there’s a loophole that fraudsters love: the paper VAT 484 form.
The VAT 484 is a simple paper form used to tell HMRC about changes to your business details, things like your business address, your phone number, or your bank account details for repayments.
Fraudsters have realized that while digital systems have high security (like two-factor authentication), the postal system is a bit of a "blind spot." They fill out a paper VAT 484 using your business name and VAT number, put in their bank details, and mail it to HMRC.
If the person at HMRC processing that form doesn’t spot the fraud, they update the system. The next time you’re due a refund, HMRC sends the money straight to the fraudster. By the time you realize the money is missing, the fraudster has emptied the account and vanished.
Why Is This Still Happening in 2026?
HMRC is aware of the issue. In fact, they’ve recently moved to make digital the default for these changes to try and shut down the "paper hijacks." However, the system isn't perfect. There are still legacy processes and exceptions that allow paper forms to be processed.
Fraudsters are experts at finding the path of least resistance. They know that if they can bypass the digital gateway, they bypass your phone’s security codes and your complex passwords. It’s a low-tech solution to a high-tech security system, and unfortunately, it’s still working.
We often talk about high-level fraud, like the massive £41m Bolton Cigarette Sting where HMRC had to go all-in on enforcement. But VAT hijacking is different, it’s personal. It’s not about smuggling goods; it’s about stealing your specific repayment.
How the "Hijack" Works Step-by-Step
It’s actually disturbingly simple. Here is how a typical VAT hijack plays out:
- The Target: A fraudster identifies a business that is likely to receive VAT repayments (often those in construction, retail, or hospitality).
- The Data: They find your VAT number. This isn't hard, it's often on your invoices, your website, or public registers.
- The Form: They download or print a VAT 484 form. They fill it in with your details but swap your bank account for a "mule account" (an account they control).
- The Submission: They post it to HMRC.
- The Wait: HMRC processes the form. Because it looks legitimate, the system updates.
- The Theft: You file your VAT return. HMRC sees you are owed £5,000. They check the system, see the "new" bank details, and send the cash.
- The Discovery: You realize the money is missing weeks later.
Red Flags: What to Watch Out For
The good news is that there are usually warning signs. The problem is that most business owners are so busy running their companies that they miss them. Keep an eye out for these red flags:
1. Unexpected "Confirmation" Letters
HMRC will often send a letter to your registered business address confirming that a change has been made to your account. If you get a letter saying "We've updated your bank details" and you haven't touched your HMRC account in months, do not ignore it. This is the biggest warning sign you’ll get.
2. Sudden "Security" Emails
Be careful here, fraudsters also use phishing emails. But if you get a legitimate notification from your HMRC Business Tax Account saying a change has been made, log in immediately (through the official gov.uk site, not by clicking a link in an email) and check what happened.
3. Delays in Repayments
If your VAT repayments usually take five working days and you’re now on day fifteen, don't just assume HMRC is being slow. Log in and check if the payment has been "issued" and, if so, where it went.
How to Protect Your Business
At Makes Sense Accountants, we tell our clients that being proactive is the only way to stay safe. Here is your "Anti-Hijack" checklist:
Regularly Log into Your HMRC Business Tax Account
Don't just log in once a quarter to file your return. Make it a habit to check your "Business Details" once a month. Ensure the bank account listed is yours. It takes two minutes and could save you thousands.
Set Up Email Notifications
Ensure your contact details in the HMRC portal are up to date and that you have opted into electronic communications. The faster you get a notification of a change, the faster you can stop the fraud.
Verify Everything Immediately
If you receive a letter from HMRC that seems "off" or describes a change you didn't request, call them immediately. Yes, the phone lines can be a pain, but it's better than losing your refund. You can also contact us, and we can look into it for you.
Use a Professional Agent
When you have an accountant like us acting as your agent, we provide an extra layer of eyes. We can often see changes in the agent portal and flag things that don't look right. We’ve been doing this for over 15 years, and we know what a "normal" HMRC interaction looks like.
What to Do If You’ve Been Hijacked
If the worst happens and you realize your details have been changed:
- Contact HMRC Fraud Hotline: Report it immediately. The sooner they know, the better the chance they can freeze the payment or recover the funds.
- Contact Your Bank: Let them know your business identity has been compromised.
- Check Your Other Taxes: If they’ve hijacked your VAT, they might try your Corporation Tax or PAYE details too.
- Call Us: We can help you navigate the bureaucracy of getting your details reset and proving to HMRC that you were a victim of fraud.
We Are Your Shield
Fraudsters are getting cleverer, but they usually rely on people being too busy to check the small print. At Makes Sense Accountants, we take the stress out of tax so you can focus on what you do best: growing your business.
Think of us as your shield. We don’t just crunch numbers; we keep an eye on the landscape to make sure your business is protected from threats like VAT hijacking. Whether you're a sole trader or running a large Ltd company, the risks are the same, and the protection needs to be just as solid.
Don't let a "paper hijack" ruin your month. Stay vigilant, check your portal, and remember that we’re always here to help. If you're worried about your account security or just want someone to take the VAT burden off your shoulders, let's have a chat.
Ready to secure your business?
Contact Tim and the team at Makes Sense Accountants today. We’ll help you secure your accounts, manage your VAT, and make sure your money stays where it belongs: with you.