Crypto platform asking for your National Insurance number? What CARF means and how to spot fake emails
Date: | Week 44 | Reading time: 6 minutesAuthor: Simcha Schrijver
In brief
Is your crypto platform asking for your National Insurance number, date of birth or tax residence? That comes from the Cryptoasset Reporting Framework (CARF), under which UK crypto providers collect user details for HMRC. A request is not a suspicion.
Paucitas sees in practice that scammers copy exactly these requests, with fake messages that look like they come from HMRC. Unsure whether a message is genuine, or want your crypto history in order? Paucitas finds out for you.
Contact Paucitas. An initial conversation comes with no obligation.
Put simply
Your platform may ask for these details, but HMRC will not ask you to log in through a link in an email. If in doubt, open your platform's app or GOV.UK yourself. Let Paucitas take a look with you.
You open your crypto app and find your crypto platform asking for your National Insurance number, date of birth and country of tax residence. Shortly afterwards an email arrives, supposedly from HMRC, about your crypto. It makes sense that you are not sure what is real. It happens regularly.
Why is a crypto platform asking for your National Insurance number?
A crypto platform asking for your National Insurance number is doing so because of the Cryptoasset Reporting Framework, known as CARF. Under GOV.UK guidance, UK reporting cryptoasset service providers collect details of their users and their transactions. For individuals that means name, date of birth, home address and country of residence, and for UK residents a National Insurance number or Unique Taxpayer Reference. Providers submit their first report to HMRC between 1 January and 31 May 2027.
The rules exist so that HMRC can see crypto activity more clearly. A crypto platform asking for your National Insurance number is meeting its own obligation; it is not a suspicion against you.
Is every message about crypto reporting genuine?
No. Scammers like to use news that people half recognise. A message that refers to new reporting rules and asks you to act quickly can feel credible, precisely because your platform really did ask for your details. HMRC asks people to forward suspicious emails to phishing@hmrc.gov.uk, and the NCSC explains how to spot and report scam messages.
Signs that may point to a fake message:
- You are asked to log in through a link in the email or text.
- You are threatened with a penalty or legal action if you do not respond quickly.
- You are asked for wallet addresses, your recovery phrase or the login details of your platform.
- Someone phones after the email and wants to go through your crypto holdings with you.
- The request is not shown in your platform's own app or website, only in a separate email or text.
Do you recognise one or more of these points? That does not automatically mean it is fake. Do not click anything, though, and open your platform's app or GOV.UK yourself.
What if my crypto history is not complete?
That is common. Someone bought years ago on a platform that no longer exists, moved crypto to a wallet of their own or shifted it between exchanges. CARF gives HMRC sight of transactions through providers, but not automatically of what happened before or outside them. Paucitas records that history in full: which wallets and accounts exist, what was held on a given date and where it came from. You can read more in my crypto history is not complete and in crypto reporting to HMRC.
What that means for your tax position is something to discuss with your tax adviser. If not everything was reported in the past, that belongs in the same conversation. Paucitas provides the facts that you and your adviser can work with.
Already responded to a fake message?
Stay calm. Change the password of your platform, switch on two-step verification and check for transactions you do not recognise. If you shared a recovery phrase, that wallet is no longer safe. Keep the email, the sender, the link and any messages. That is exactly the material Paucitas works with.
Paucitas does more than look at transactions. Paucitas also goes through all messages, emails and documents, builds a timeline and maps step by step where your crypto went. The result is one complete picture. Contact Paucitas if you want to know what is possible in your situation.
Why people trust Paucitas
Paucitas is an independent firm of crypto specialists, established in the Netherlands with its own office, where you are welcome to visit. Paucitas investigates hundreds of cases a year, carries out all blockchain research itself and has many client reviews. An honest picture comes first. Before any work starts, Paucitas discusses a tailored quote with you, so there are no surprises afterwards.
Paucitas can be reached 24/7 on +31 20 244 5774. Through the form you will hear from us within 1 to 3 hours, and we answer emails within 24 hours, usually the same day.
Sources: GOV.UK, collecting cryptoasset user and transaction data; GOV.UK, check if you need to report cryptoasset data to HMRC; NCSC, phishing scams.
Do you have questions about this blog?
Feel free to get in touch with Paucitas. Paucitas can be reached by phone 24/7, including evenings and weekends. Through the contact form we usually reply within 1 to 3 hours, and we answer e-mail within 24 hours.
Contact form
Usually a reply within 1 to 3 hours
"*" indicates required fields
We only use your details to contact you about your request. You can read more about this in our privacy statement.
Frequently asked questions about CARF and your crypto platform
Do I have to give my National Insurance number to my crypto platform?
Paucitas sees a crypto platform asking for your National Insurance number because UK platforms must collect user details for HMRC under CARF. If you doubt whether the request is genuine, open your platform's own app or website and enter it there, never through a link in an email.
Does a CARF request mean HMRC suspects me?
Paucitas explains: no. It is an obligation for the platform, not a suspicion against you. The rules give HMRC a clearer view of crypto activity in general.
How do I spot a fake email about my crypto?
Paucitas mainly sees messages that ask you to log in through a link, threaten a penalty or ask for wallet details. HMRC asks people to forward suspicious emails to phishing@hmrc.gov.uk. If in doubt, do not click and go to GOV.UK yourself.
My crypto history is not complete. What now?
Paucitas maps your wallets, accounts and transactions, including on platforms that no longer exist, and records what was held on a given date and where it came from. What that means for your tax position you then discuss with your adviser.
How quickly can Paucitas take a look?
Paucitas can be reached by phone 24/7. Through the form you will hear from us within 1 to 3 hours. An investigation usually takes from the same day to about two weeks, depending on the case.
From Amsterdam, for the whole of the UK
Everything can be done fully online. Prefer to meet in person? You are very welcome at our office in Amsterdam, by appointment.
Paucitas is an independent expert firm based in the Netherlands that, for clients across the UK, investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.