When will these scammer's, ever learn
The sample letter on the GFI security page is littered with punctuation errors such as missing full-stops, misplaced and missing commas. The letter begins "Dear Applicant" but the reader isn't an applicant yet.
And why would the UK tax office need use the abbreviation GBP to describe the "over [sic] payment"?
These people are giving HMRC a bad name.