HMRC Adds New Security Step to VAT Registration — Here's Why It Matters
From 19 January 2026, HMRC introduced an additional step when businesses enrol VAT services to their Business Tax Account. It's a relatively small procedural change, but it's a direct response to a type of fraud that has been catching businesses out over the past year — and it's worth understanding both what the new process involves and why it was necessary.
What was the problem?
When a business registers for VAT, there's a short window of time between the registration being approved and the business owner actually linking their new VAT number to their own Government Gateway account. Fraudsters identified this gap and began exploiting it.
By moving quickly — often faster than the genuine business owner — criminals were able to link the newly issued VAT number to a Government Gateway account they controlled rather than the legitimate one. Once they had access, they could submit false VAT repayment claims to HMRC, diverting money to themselves before the genuine business had even logged in for the first time.
It's a sophisticated and fast-moving type of fraud, and the consequences for affected businesses were significant — dealing with fraudulent repayment claims submitted in their name, potential HMRC investigations, and the considerable hassle of untangling unauthorised access to their tax account.
What has HMRC changed?
From 19 January 2026, businesses are now required to provide their VAT registration application reference number before VAT can be added to a Business Tax Account.
This reference number is sent by email to the applicant during the registration process — which means it's something only the genuine applicant should have. By requiring it as part of the enrolment step, HMRC has created a meaningful barrier that specifically targets the weakness fraudsters were exploiting. Without the reference number, an unauthorised third party can no longer get ahead of the legitimate business and take control of the VAT services.
It's a targeted and practical fix — HMRC has identified exactly where the vulnerability was and addressed it directly.
What does this mean for businesses registering for VAT?
If you're registering for VAT now or in the near future, the practical implication is straightforward. When you receive your VAT registration application reference number by email, keep it safe and accessible — you'll need it when you come to activate VAT services on your Business Tax Account.
Beyond that, the advice that applied before this change still stands. Act promptly after your VAT registration is confirmed — don't leave a lengthy gap between receiving your registration details and linking them to your account. Even with the new safeguard in place, being proactive remains your best defence.
If you encounter an unexpected error message when trying to add VAT services to your account, treat it as a potential red flag and investigate rather than assuming it's a technical glitch. Similarly, keep a close eye on any HMRC correspondence relating to your VAT account, particularly anything around repayment claims or access issues — if something doesn't look right, act on it quickly.
What if you think you've already been affected?
If you suspect that your VAT number may have been linked to an account you don't control, or if you've received unexpected correspondence from HMRC about VAT repayments you didn't claim, contact HMRC as soon as possible and seek professional advice. The sooner you act, the more straightforward the process of regaining control and correcting any fraudulent submissions tends to be.
We can help
VAT registration, fraud risks, and Business Tax Account issues are all areas where having an adviser alongside you makes things considerably less stressful. If you're registering for VAT for the first time, have concerns about the security of your HMRC account, or have received unexpected correspondence you're not sure how to interpret, get in touch with the team at Alera Accounting & Advisory and we'll help you work through it.