One Solution...
Is to refuse to give your email address to HMRC. That way, any email which arrives in your inbox purporting to be from HMRC is obviously fraudulent.
You are not obliged to have email, and they should not be able to demand it. If they need to contact you, they should be made to do so by snail mail. Not that snail mail is secure, but the crooks have to go to a lot more effort for less payback....
Biting the hand that feeds IT
