I've just had a particularly nasty phishing email purporting to come from HMRC about a tax refund. Normally I can spot these a mile off, but this one was particularly subtle.
From the HMRC website:
"HMRC will never send notifications of a tax rebate by email, or ask you to disclose personal or payment information by email.
You should never disclose your personal and/or payment information in reply to an email that may look like it's from HMRC, you may well be revealing your details to a fraudulent website."