There is a variant (yes, like a pathogen) on the pretent-HMRC trick. This happened to me recently when the message did not try to clain to be from the department, but from an agent.
It promised me about £1100 in underpaid Marriage Allowance (I have never been married and girl-friends don't count) in return for my wife's and my NI numbers and level of earnings.
The site looked impressive: two big blue link buttons, and a photo of a couple at the altar… dead give-aways apart from being so unlikely and not pretending to be HMRC, were the sender's peculiar open and "bounce" addresses.
Block sender, block domain, delete….
Only that will not stop them because the criminals have adopted an anti-blocking, anti-tracing technique using multiple but temporary, random name.domain paths for each message, and I have received several in the last few days.
Yesterday they sent three copies of the same message headed "Costumer [sic] Notice" or similar by this method, with individual open and "bounce" addresses, within minutes of each other; and this morning I received another, pretending to be an very unlikely voucher offer from the Morrisons supermarket.
The only defence would seem to be to make all e-mails text and photos only by default, blocking all links and operating-files unless by specific permission. A web-site could be cited, but its name would be inactive, but its user would need only type the name in the search tool as usual.