HMRC has advised that if you receive an email to verify a change to your online account, it should be ignored if you did not request it.
You should also ignore any follow-up emails asking you to click a link.
HMRC says, “These emails, which we are aware have been received by some customers, are a tactic by scammers to direct people to a phishing site and steal personal details. HMRC systems have not been compromised – but criminals have attempted to create fake customer accounts or to access existing accounts using personal data obtained through a variety of routes, including breaching other organisations’ security.”
Anyone who has received such a message is encouraged to report it to HMRC at phishing@hmrc.gov.uk.