HMRC’s New Payslip Fraud Guidance: What We Welcome and What We Would Challenge

On 25 August 2026, HMRC published How to avoid payslip fraud, guidance for agency workers, temporary workers, contractors and people paid through umbrella or payroll companies. It explains what payslip fraud can look like, the warning signs workers should recognise, the records they can check and how concerns can be reported. HMRC describes payslip fraud as including a payslip showing deductions that have not been paid to HMRC, incorrect information about pay or deductions, or no payslip at all.

Our first reaction is simple: this guidance is welcome. A payslip is one of the most familiar documents in working life, yet it is also one of the least understood. Most workers receive one regularly, but relatively few have ever been shown how PAYE works, how deductions are calculated or what they should do when something does not look right.

It is equally important, however, to be clear about the intended audience. This is guidance for workers; it is not a due-diligence framework for recruitment agencies, MSPs or end clients. Businesses should read it because it explains what workers are being encouraged to check, but they should not mistake those checks for evidence that their own responsibilities under Chapter 11 have been discharged.

SafeRec was built to follow payroll through the complete chain: from the legal and operational structure of the payroll intermediary, to the payslip issued to the worker, the RTI reported to HMRC and, finally, the employer’s HMRC tax account. Later in this article, we set out that process as a practical blueprint that businesses can use to understand the different controls required when workers are paid through another party.

A useful addition for workers

Over the past few years, HMRC has taken several significant steps to make information about umbrella companies and tax avoidance more accessible. It regularly updates its public list of named tax avoidance schemes, promoters, enablers and suppliers; it introduced an umbrella company pay calculator to help workers and employment businesses understand expected pay and deductions; and it has now published dedicated guidance explaining payslip fraud and the warning signs workers should recognise.

Some will say that these measures should have arrived earlier, should go further or are not enough on their own. There may be merit in those arguments, but we prefer to recognise progress when it happens.

Workers now have an official GOV.UK page explaining that unexplained deductions, changing employer names, frequent movement between payroll providers, inconsistent payslips or take-home pay that does not match the hours worked should prompt questions. It does not give workers every answer, but it gives them the basics of what to be wary of and somewhere authoritative to turn when they are unsure. That is a good thing.

No guidance page can replace enforcement, and no individual worker should be expected to uncover organised fraud alone. Education is nevertheless an important part of prevention, and HMRC deserves credit for continuing to provide workers with more practical information and tools.

Workers can only check what they are shown

The first issue we would challenge is the gap between what HMRC encourages workers to check and the statutory minimum information that employers are required to show on a payslip.

HMRC recommends that workers check that they receive a payslip for every pay period, that their personal and employer details are correct, that the correct tax code is being used, and that tax, National Insurance, pension and other deductions look reasonable. The statutory minimum that an employer must show is narrower: gross pay, net pay, deductions and, where pay varies according to time worked, the number of hours. A tax code, taxable pay to date and tax deducted to date may be included, but they are not all legally required.

A cumulative tax code provides one useful illustration of what we are explaining here. Under the cumulative basis, the calculation takes account of pay and tax from earlier in the same tax year. Year-to-date taxable pay and year-to-date tax are therefore important information when a worker wants to understand or question the deduction appearing on a particular payslip. The same wider argument can apply to other deductions: a worker can only perform a meaningful check when enough information is provided to explain how the figure was reached.

In our experience, most responsible employers already provide much of this information. The concern is not primarily with employers that are already trying to produce clear and comprehensive payslips. It is that fraudsters and tax avoiders can operate at the edge of a statutory framework that asks workers to check more than employers are always required to show them. If HMRC wants workers to play an active role in identifying tax avoidance and payslip fraud, requiring employers to provide sufficiently complete information to empower those workers seems a reasonable next step. Clearer statutory payslip requirements are something SafeRec has advocated for several years. Guidance can encourage good practice, but legislation is what establishes the minimum standard that every employer must follow.

Reported, recorded and paid are not the same thing

The second distinction is even more important.

An employer will normally submit a Full Payment Submission on or before payday, reporting the worker’s pay and deductions to HMRC. The corresponding PAYE liability is paid separately and later, towards the end of the following month. Reporting the payroll and settling the liability are therefore two different events.

Let’s take an example. Consider a payroll intermediary, which could be an umbrella company or a recruitment agency operating PAYE. It may calculate payroll correctly, issue a genuine payslip and submit accurate RTI, but then experience a cash-flow problem and agree a payment plan with HMRC. The payslip may still be genuine and the RTI may accurately reflect the payroll, but the bottom line is that the PAYE liability has not yet been paid in full even when a payment plan with HMRC is in place.

National Insurance provides a useful illustration of the distinction. HMRC’s own manual explains that contributions reported through RTI can be posted to a worker’s National Insurance record even though the employer has not subsequently paid them to HMRC. If an investigation confirms non-payment, those entries may be removed as “paid”; where the worker was not complicit or negligent, the employee’s primary contributions can then be returned to the record with the status “treated as paid”.

Something can therefore appear on a worker’s record, and may ultimately be treated as paid for benefit purposes, without the employer having transferred the corresponding money to HMRC.

Workers should nevertheless check their records regularly. We strongly believe that every worker paid under PAYE should treat Creating a Personal Tax Account as essential. It allows them to review employment and income information reported to HMRC, their tax codes and other relevant tax information, making it easier to identify missing or inaccurate information.

A Personal Tax Account entry or an RTI match is not, however, a receipt confirming that the employer has settled its PAYE account. It shows what has been reported or recorded. As the National Insurance example demonstrates, an amount can initially appear as paid and may later be treated as paid for the worker's benefit purposes, even though it was not actually remitted by the employer.

Why agencies must read the guidance for what it is

For workers, HMRC’s guidance is useful and the checks it recommends should be followed. For recruitment agencies, MSPs and end clients, the legal question is different.

Since 6 April 2026, Chapter 11 of Part 2 of ITEPA 2003 has made the relevant recruitment agency, MSP or end client jointly and severally liable with the umbrella company for PAYE amounts due in relation to qualifying umbrella company payments. HMRC can recover an underpayment from the relevant party where the umbrella company has not paid the correct amount.

An accurate payslip and matching RTI may demonstrate that payroll was calculated and reported correctly. They do not establish that the liability was paid, and they do not remove the relevant party’s statutory exposure if it was not.

So what is the solution for a recruitment agency or MSP if a payslip can be forged, RTI may not be submitted, or tax can be reported but remain unpaid? What is certain is that agencies cannot rely on this worker guidance, or assume that accurate calculations and matching RTI automatically equal protection from liability under Chapter 11.

No single document or isolated check provides the complete answer. Assurance must be layered because every control answers a different question.

The SafeRec blueprint for supply-chain assurance

The framework below is the blueprint on which the SafeRec Certification is built. It reflects a simple principle: meaningful supply-chain assurance cannot come from a single document, or information considered in isolation. It requires a clear and continuous chain of evidence: from understanding the business behind the payroll, to checking how each worker has been paid, confirming what was reported to HMRC, establishing whether the resulting liability was settled and making that information visible to the businesses relying on it.

First, understand the business beyond the payroll. Legal and operational due diligence should examine ownership and control, Companies House history, connected entities, contracts, subcontracting, policies and the actual operating model. This establishes who is responsible, how workers are engaged and whether the documentation reflects what happens in practice.

Second, audit the payslip in isolation before reconciling it with RTI. The payslip calculation should first be tested on its own, including gross and taxable pay, Income Tax, National Insurance, pension, student loan, holiday pay, etc. Only then should it be reconciled with the RTI submitted to HMRC. The first check asks whether the worker was paid correctly; the second asks whether the same pay and deductions were reported correctly.

Third, establish whether the reported liability was actually settled. This requires reviewing the employer’s HMRC business tax account and comparing the recorded liability with payments and any agreed payment arrangement. A screenshot is far from enough: it is a static image selected by the party being checked and cannot, by itself, establish that the information is complete, current or unaltered.

SafeRec conducts this part of the review remotely while the umbrella company accesses its own HMRC account through a controlled, isolated browser session. This allows the live account to be reviewed without relying on a screenshot or document selected and prepared in advance.

Fourth, obtain payroll evidence in real time and at source, and make the outcome visible. HMRC correctly warns that fraudulent payslips can look genuine. Payslips and RTI should therefore be captured directly from independent payroll software as they are generated, rather than selected and forwarded after the event. Workers should be able to see evidence relating to their own pay, while agencies should be able to see which workers were audited and compare that population with the workers they supplied.

These controls are not alternatives. A legal review does not prove payroll execution. A correct payslip does not prove that matching RTI was submitted. Matching RTI does not prove HMRC was paid. And none of those controls is complete if part of the worker population has been omitted.

Finally, businesses may want to consider an additional layer of financial protection. Orbio Insurance offers specialist Tax Liability Insurance designed to protect recruitment agencies should an insured tax liability arise from a SafeRec Certified umbrella company in their supply chain. This complements the SafeRec framework: our role is to audit and evidence compliance, while Orbio provides an additional layer of financial protection should an insured liability nevertheless arise. Agencies interested in this protection should speak directly with Orbio about the scope, suitability, terms and exclusions of the cover.

The payslip has always been the starting point.

HMRC’s new guidance is a welcome resource for workers. It provides the basic warning signs, encourages people to check their records and gives them an official place to turn when something does not look right.

The payslip is, and has always been, the start of the compliance process. It can help identify incorrect calculations, unlawful deductions and signs of tax avoidance or fraud. But where the objective is to establish that tax has been accurately calculated, reported and ultimately paid, much more needs to sit behind it.

Workers should read HMRC’s guidance and create a Personal Tax Account. Recruitment agencies and MSPs should also read it, but they must read it for what it is: guidance designed to help workers, not businesses.

Whether you are a recruitment agency, an MSP or an end client, if your business would benefit from help reviewing and future-proofing its controls, you can create a free account at SafeRec.co.uk and book a call with our team at no cost. Our role is not simply to identify risk, but to help businesses understand and evidence the controls on which they rely.

Read HMRC’s full Payslip fraud guidance. learn more about Orbio’s Tax Liability Insurance.

This article provides general information only and does not constitute legal, tax or insurance advice.