If you’ve recently registered for VAT, or you’re planning to, there’s something you need to know about. A type of fraud targeting the VAT registration process is catching businesses out and the consequences can be stressful, disruptive and genuinely costly.
The good news is that HMRC has already taken steps to address it, and there are practical things you can do right now to protect your business. This post explains exactly what’s happening, how the fraud works and what your next steps should be.
What’s Actually Happening
Fraudsters are intercepting the link that connects a new VAT registration to a Government Gateway account. Once they get hold of that link, they add the VAT registration to a Government Gateway account they control instead of yours.
The first time most business owners discover this has happened is when they try to add VAT to their own Government Gateway and receive an error saying “it’s already assigned elsewhere” or “sorry we are having a problem”. By then, the fraudsters may have already submitted false VAT reclaims to obtain refunds from HMRC using your registration.
Meanwhile, your genuine returns haven’t been filed. HMRC doesn’t know why and penalty points for non-filing and non-payment start to accumulate against your business.
Why VAT Is Particularly Vulnerable
When you register for Corporation Tax or PAYE, HMRC sends an activation code to your registered address by post. That letter has to be physically intercepted to be misused which creates a natural barrier.
VAT works differently due to Making Tax Digital.
When a VAT registration is completed online, in order to connect it to a Government Gateway account, you need to generate a digital link. There’s no letter in the post, just a digital link that fraudsters have learned how to access before the genuine business owner does.
What HMRC Has Done About It
On 19 January 2026, HMRC introduced a change to close this gap. When enrolling a VAT registration on a business tax account, you now need to enter the VAT registration application reference number. This is provided on screen and by email when you complete your online VAT registration.
This extra step means that simply intercepting the link is no longer enough. You need the application reference number too, and that goes only to the applicant.
It’s a meaningful improvement. But it only applies to new registrations going forward, so businesses that registered before this change may still be exposed if they haven’t yet linked their VAT to a Government Gateway account.
What You Should Do Right Now
Whether you’ve recently registered for VAT or you’ve been VAT registered for some time, take these steps:
If you’ve just registered for VAT set up your Government Gateway account promptly and add VAT as a service as soon as you can. Use the application reference number provided when you registered.
If you’ve been VAT registered for a while but don’t have a Government Gateway account set one up now, add VAT to it and activate it via the link as quickly as possible.
If you’re not sure whether your VAT is correctly linked to your own account, check. Log in to your Government Gateway and confirm that VAT appears as a service on your account.
It’s worth noting that your accountant or bookkeeper may have access to your Government Gateway through the agent services system, but that’s separate from your own access.
You should always have direct access to your own Government Gateway account, with all relevant taxes added. If you don’t, make it a priority!
If You Think You’ve Been Affected
If you try to link your VAT registration to your Government Gateway and receive an error saying it’s already assigned, don’t panic, but do act quickly.
Contact your accountant or bookkeeper straight away. They can help you report the issue to HMRC and work through the process of getting your registration correctly assigned.
If you handle your own VAT without an agent, you can find HMRC’s guidance on VAT fraud at https://www.gov.uk/hmrc-internal-manuals/vat-fraud
The important thing is not to wait. Unresolved issues can lead to missed filing deadlines and penalty points accumulating on your VAT account.
Frequently Asked Questions
Yes, if your VAT registration has never been linked to a Government Gateway account you control, it could still be at risk. HMRC’s January 2026 change applies to new registrations, so older registrations that remain unlinked don’t automatically benefit. Checking and securing your own access now is the right move.
No. If you report the fraud to HMRC promptly, you should not be held liable for fraudulent reclaims made using your registration. The key is acting quickly and keeping a clear record of everything. Your accountant can help you navigate the process.
If the non-filing was caused by fraud rather than your own actions, HMRC should be able to remove the penalty points once the situation is resolved. This is something your accountant can raise with HMRC directly on your behalf.
Yes, absolutely. If you’re unsure whether your VAT is correctly linked or you’d like us to check your Government Gateway set-up, just get in touch. It’s a straightforward thing to check and well worth doing.
Final Thoughts
VAT registration fraud is a real and growing issue, but it’s also one you can protect yourself against with relatively little effort.
If your VAT is correctly linked to your own Government Gateway, you’re in a much stronger position. If it isn’t, now is the time to fix that.
Whether this is something you want to sort out yourself or you’d like a hand checking things over, simply get in touch and our team will be happy to take a look at your Government Gateway set-up and make sure everything is in order.