hmtreasurygovuk.com scam: the fake government department

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

After three years of payments to a fake investment platform, this injured party's affair entered a new and more aggressive phase. They were no longer asking him to invest: they were telling him that an account had been opened in his name, that his position was under examination, and that he had to pay.

The sender presented itself as a British government department.

hmtreasurygovuk.com is a scam, our firm has already handled this case, and this article explains the simplest and most effective rule there is for recognising a fake institutional site — and what to do when you are told an account has been opened in your name.

Why hmtreasurygovuk.com is a scam: the domain rule

Let us start with the rule that unmasks hmtreasurygovuk.com, because it takes thirty seconds to learn and lasts a lifetime.

UK government websites end only in .gov.uk. Not .com, not .org, not .net. That suffix cannot be bought: it is reserved, assigned under control and not available to private parties.

Now look at the address of hmtreasurygovuk.com. The sequence "govuk" is not the suffix: it is a word glued inside the name, before the dot. The actual domain is "hmtreasurygovuk", and the final extension is .com — the most common commercial extension in the world, buyable by anybody for a few euro.

The trick of hmtreasurygovuk.com is the same one seen with prefixes ("eu-", "it-", "secure-") and with subdomains: the part of an address that counts is the one immediately before the final extension, and the final extension does not lie. Everything else is chosen by whoever registers the name.

The same principle applies in Italy: Italian public administrations use institutional domains assigned under controlled rules, not commercial names registered with any provider.

As to the registries, the hmtreasurygovuk.com domain is registered on 2 April 2026, for one year, with a foreign registrar. As at the date of publication the address no longer serves its own content: it points to a parking service, which means the page the injured party saw is gone. That is why the screenshots saved at the time are now irreplaceable.

A one-year domain, registered a few months ago and already abandoned, is not a government department. It is a tool.

"An account has been opened in your name"

In the hmtreasurygovuk.com file this is the delicate part, and it must be explained precisely because it contains both a lie and a real risk.

The lie is the demand for payment. No public authority, Italian or foreign, asks a private individual for money in order to close a position, release funds or avoid proceedings. An authority that establishes an offence does not negotiate and does not send invoices. If there is an amount to be paid, the communication is false — and the threat accompanying it, being an unjust harm held out in order to obtain a payment, is the structure of extortion under article 629 of the criminal code, completed if you pay, attempted if you do not.

The real risk, on the other hand, is that an account in the injured party's name really was opened. In the hmtreasurygovuk.com file, as in many others, the injured party had handed over his documents over time. Whoever holds an identity document, and all the more a facial verification, has in practice the material to open accounts in another person's name at platforms or payment institutions. It is the mechanism by which chains of front men are built: other victims' money passes through accounts held by people who know nothing about it.

So the right answer is not to pay: it is to disavow.

Concretely, the filing must include a precise list of all documents handed over, with dates and channels, and an express, dated declaration: I did not open or authorise any account with my documents and I disavow every operation carried out with them. The same communication should be made in writing to your bank. And it is useful to set up periodic monitoring of your position in the credit databases, to notice at once any loan or account you do not recognise.

Opening accounts with another person's documents amounts to impersonation under article 494 of the criminal code: it is a further offence, and it must be charged.

How to recognise a fake institutional communication

Besides the domain, the recurring signs are always the same. In the hmtreasurygovuk.com case they were all there.

The channel. The communication does not come from an institutional channel but through the private intermediary you are already in contact with. Authorities do not communicate with citizens via a platform's "consultant".

The amount. A sum to be paid appears, with a tight deadline. It is the sign that on its own settles the matter.

Law cited out of place. References to directives, regulations and foreign statutes dropped in to produce legal noise. The practical rule applies: the more acronyms there are, the more worthwhile it is to verify just one, because that is enough to bring the structure down.

The criminal threat. The accusation levelled at the victim — money laundering, irregular accounts, investigations under way — serves to shift the ground from distrust to fear.

The mail address. Look at the domain after the at sign, not at the sender's display name. In the hmtreasurygovuk.com file the domain's mail rested on an ordinary commercial mailbox service, not on institutional infrastructure.

What to do if you receive such a communication

Five things, in order, if the communication comes from hmtreasurygovuk.com or an address of the same kind.

Do not pay. Whatever the sum demanded by hmtreasurygovuk.com, and whatever consequence is held out.

Do not argue with the accusation. There is no point defending yourself against a charge invented by the person who wrote it.

Do not delete anything. The communication, the channel it came through and the messages that accompanied it are the evidence of the threat.

Export it in original form. If it is an email, you need the complete original format with the technical headers, obtained with the "view original message" function of your mail program. If it arrived in a chat, export it with the application's native function, with date and time. Save the screenshots of the site too, because the domain can disappear overnight — which is exactly what happened here.

File, and disavow in the same filing. The complaint must cover both the original fraud and this phase, with an express disavowal of any accounts opened with your documents.

The legal framework

The hmtreasurygovuk.com facts date from 2026, and therefore come after law 90/2024: article 640 paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator.

The threat phase is separately relevant as extortion under article 629, completed or attempted. Using the name and capacity of a public authority amounts to impersonation under article 494, which also applies to any accounts opened with the injured party's documents. To these are added the aggravating circumstances of diminished defence under article 61 no. 5 — particularly telling here, because the pressure is applied to somebody already hit by a fraud — and of damage of particular seriousness under article 61 no. 7, unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion, and money laundering under article 648-bis for whoever moved the sums.

The aggravating circumstances of the second paragraph of article 640, and extortion, entail prosecution of the court's own motion. The domain, however, is already out of use and the data concerning it can be obtained only while the operators keep them: a serious reason not to wait.

What to secure immediately

Anyone who received communications from hmtreasurygovuk.com must obtain: the communication itself in complete original format; the screenshots of the site, if any remain; the exact address the mail came from; the contact details and names used by whoever acted as intermediary; the list of personal documents handed over over time, with dates and channels; and the complete bank documentation in official form for all the payments in the affair, citing article 119 paragraph 4 of the Consolidated Banking Act, which gives the right to a copy of the documentation of operations of the last ten years.

And the warning that always applies: anyone who contacts you promising to recover the sums on advance payment is the second scam, built on the lists of the victims of the first.

Similar cases already handled by the firm

Anyone who crossed paths with hmtreasurygovuk.com will find useful our analysis of sepa.finance, the platform of the earlier phase of the same affair, and of ecommbx.online, where a fake supervisory authority letter is taken apart point by point. On clones of authorised institutions see manoab.com and mirabaudasset-management.com; on fake fund recovery, eu-ecommbx.com and ecommbx.group; on documents handed over and disavowal, m.hashvalueks.com.

If you received a communication from hmtreasurygovuk.com: what to do now

This is the picture. hmtreasurygovuk.com is a scam: a .com domain registered on 2 April 2026 with a one-year term, no longer operational today, which passed itself off as a British government department by putting the word "govuk" inside the name.

The rule to remember is one and it has no exceptions: UK government websites end in .gov.uk, and no government asks a private individual for money.

If they told you an account has been opened in your name, do not pay: disavow it in writing, notify your bank and put it in the filing. It is the right answer whether the claim is false or — above all — if it is true.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.