UK GOVERNMENT IMPERSONATION - COUNCIL TAX

The council tax "refund" email is a scam, even the calm, polite one.

Councils from County Durham to Pembrokeshire and the Highlands have spent nine days warning about council tax refund messages. One example, shared by Durham, does not shout. It tells you there is a credit on your account and invites you to review it at your convenience.

SB

SafeBrowz Threat Research Security Research · 1 November 2026 · 8 min read

Six councils, one scam, nine days

This is not one council's local problem. In the order the warnings went out:

• Highland Council, 22 October: emails offering council tax refunds, from a sender calling itself the "Council Revenue Authority" team. The council said it will not ask for sensitive personal or banking information by email (Inverness Courier).
• Argyll and Bute Council, 27 October: emails claiming residents had overpaid and were due a refund. "These are not from Argyll and Bute Council" (council post on X).
• Carmarthenshire County Council, 27 October: scam messages claiming accounts were in credit or had unpaid balances, while the council's own genuine reminder texts were going out at the same time (Wales247).
• Durham County Council, 29 October: emails from [email protected] claiming a refund was due, asking people to click a link or button and then give their bank details (council post on X).
• Stratford-on-Avon District Council, 29 October: fake emails offering council tax refunds (council post on X).
• Pembrokeshire County Council, 30 October: messages by email, text or "unofficial websites" saying a refund was due because of a house move, a new discount or exemption, or a reassessment, and asking for bank card details (Pembrokeshire Herald).

Six councils across England, Scotland and Wales, inside nine days. The scammers do not need to know which council you pay. An email that says "your council" works on anyone who pays council tax, and the reasons these messages give, a house move, a new discount, a reassessment, are real reasons an account can end up in credit. That is what makes them believable.

Read the email Durham shared, line by line

Durham County Council published an example alongside its warning. It is dated 30 September 2026, three weeks before the first of these warnings, and it is worth reading slowly, because it has dropped most of the habits people are taught to look for.

The subject line starts with "Council" and asks you to "review this important update at your convenience". The body sits under a blue "Revenue and Benefits" banner headed "An update regarding your Council Tax account". It opens "Dear Resident" and says a credit balance is currently held on your account, that this "is a normal occurrence and does not affect the status of your account", and that the credit will be applied against future instalments "unless you ask for it to be returned". To review it, there is a "Review Account" button. The footer says the message "was generated by our revenue system. Please do not reply".

Look at what is missing. No deadline. No threat of court action. No capital letters, no "final notice", no exclamation marks. "At your convenience" is the opposite of urgency. Most scam advice says to watch for pressure, and this email has been written so that there is none to find.

What it does have is a request that only makes sense if you act on it: to get the money back, you press the button. That is the whole scam. The credit is the bait, the "ask for it to be returned" line puts the decision in your hands so it feels like your idea, and the button leads to a page that asks for your bank details so the "refund" can be paid. Pembrokeshire describes the same final step: a link, then a request for personal and bank card details.

Three things in it do give it away. "Dear Resident" from a council that has your name on every bill. A council tax email that, in the part Durham published, never says which council it is from. And the sender: the screenshot crops out the "From" line, but Durham's warning names the address on these emails, which brings us to the bird supplements.

The sender Durham named belongs to a bird-supplement company

Durham named the sender as [email protected]. We looked it up on 1 November 2026. The domain was registered in April 2024 and serves a French-language website selling plant-based health supplements for birds. It says nothing about council tax, the United Kingdom, or local government, and there is no sign that the business has anything to do with this campaign.

We cannot tell from the outside whether the scammers sent through that company's email system, or simply typed its name into the "From" line. Either way, the lesson is the same, and it is the most reliable check in this whole post: a council's own website, and the page where you log in or pay, is on gov.uk. Welsh councils may also use gov.wales or its Welsh-language twin, llyw.cymru; Carmarthenshire's genuine reminder texts, for example, link to carmarthenshire.gov.wales, and the council says an email that does not come from an @carmarthenshire.gov.uk address, or link to its own website, is very likely a scam. Both are restricted to public bodies: gov.uk to eligible UK public sector organisations, gov.wales and llyw.cymru to the Welsh public sector. Some councils do send genuine emails through outside mailing services, so a strange sender alone is not proof. But if a council tax email's sender or link is anywhere other than the council's own domain, do not use it. Go to the council's website yourself, however official the banner above the button looks.

That is also why we did not add plantabird.com to our block list. It is a real business's website, and marking it as dangerous would be wrong. The page the "Review Account" button actually leads to is the dangerous part, and none of the councils has published its address, so we cannot name it here.

Real council messages exist, which is why "never trust a text" is the wrong rule

Carmarthenshire's warning is the useful one, because it starts with a genuine message. The council sends texts from the sender name "Carms CC" to residents who have fallen behind, saying they have an outstanding matter and linking to the council's own website. The council says those texts are real. At the same time, scam messages were circulating about accounts in credit or unpaid balances.

So the rule cannot be "councils never contact you". Some do, by text and by email. The rule that holds is about two things only: where the link goes, and what the page asks for. Wandsworth Council, which saw scam council tax texts in April 2026, put the second part as plainly as anyone. A message is a scam if it asks for card or bank details, says you are entitled to a refund or band reduction, or offers to write off council tax arrears for a fee.

How a council tax refund scam works, step by step

1. The hook: an email or text says you overpaid, have a credit balance, qualify for a discount or exemption, or are due a band reduction.
2. The click: a link or button such as "Review Account" or "Claim refund" opens a page made to look like a council or government service.
3. The request: it asks for personal details and bank or card details, "so the refund can be paid".
4. The payoff, for them: card details can be used straight away, and the personal details on the form give a follow-up caller, posing as your bank or the council, enough to sound genuine.

Where a link scanner helps with council tax emails, and where it does not

This scam lives or dies on one moment: whether the button opens a council website or someone else's page. That is a question about an address, and it is the kind of question our tools answer before the page loads.

Here is what we checked while writing this. Real council websites on gov.uk come back safe in our scanner, because the whole gov.uk suffix is on our verified list, and an address like gov.uk.something-else.com does not borrow that trust. While testing, we found that Welsh council addresses on gov.wales were not treated the same way, coming back as "caution", which is the wrong answer for a real council. We fixed that today: gov.wales, llyw.cymru, gov.scot and mygov.scot are now on the verified list, after checking them: gov.wales and llyw.cymru are restricted to Welsh public sector bodies, gov.scot is reserved for the Scottish public sector, and mygov.scot is a Scottish Government site. We then re-ran the test both ways: carmarthenshire.gov.wales and gov.wales now come back safe, while made-up addresses that put "gov.wales" or "gov.scot" in the wrong place still do not get that trust.

Now the limits, plainly. We do not flag a page just because its address contains the word "council", because hundreds of real councils, parish councils and charities use it, and a rule that caught the fake would catch them too. The phishing page behind this campaign has not been published, so it is not on our block list. On a page like that, with an address nobody has reported yet, the free check will usually say "caution" rather than "danger", which is honest about what we know. Layer 3, our AI deep scan in Premium, reads what the page is doing, a council tax form asking for card details on a website that is not a council's, and that is the signal built for an unreported page. And none of our tools read your inbox: the browser extension (Chrome, Firefox and Edge) and the Android app check a link when you open it, not the email it came in.

The cheapest defence costs nothing at all. Do not use the button. Type your council's address yourself, or find it through gov.uk's council finder, and log in there. If there really is a credit on your account, it will be there.

A 30-second check on any council tax message

• Who sent it? A council's own domain is on gov.uk, or in Wales possibly gov.wales. If the sender or the link is somewhere else, do not use it; go to the council's website yourself.
• Does it name your council and you? "Dear Resident" and "your council" are what a mass email says.
• Where does the button go? Press and hold it on a phone, or hover over it on a computer, and read the address that appears. Better still, do not use it at all.
• What does it want? A refund, a band reduction, or arrears written off "for a fee", in exchange for card or bank details, is the scam, whatever the wording.

If you clicked or entered your details

• Gave card or bank details: call your bank or card provider now, on the number on the back of your card, and tell them what happened. Pembrokeshire Council says to do this without delay.
• Expect a follow-up call: someone may phone as your bank's fraud team or as the council, already knowing your name and details from the form. Hang up and call your bank back on a number you know.
• Gave personal details only: watch for more targeted emails and texts that use them, and be wary of any contact that mentions this "refund".
• Report it: forward the email to [email protected] and texts to 7726. If you lost money in England or Wales, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, report it to Police Scotland on 101. Tell your council as well, using contact details from its own website.
• Money has gone: our guide to what to do after you have been scammed covers the next steps with your bank in more detail.

Council tax is one more costume for an old trick. The same refund bait turns up in the HMRC tax refund scam, the DVLA vehicle tax email and the TV Licensing refund email. Each one copies a bill people pay without thinking twice, and each one is beaten the same way: go to the real website yourself.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play