If you've built against HMRC's Making Tax Digital APIs, you've seen the phrase "Fraud Prevention Headers" in the docs and probably assumed it was a checkbox exercise — a handful of headers, a quick lookup table, done. It isn't. Get these wrong and HMRC either silently downgrades your submission's trust score or rejects it outright with an error message that tells you almost nothing about which header caused it. This post covers what actually trips people up when implementing this in a real .NET backend.
Why this exists
HMRC requires every call to their MTD APIs (VAT, ITSA, and others) to carry a set of Gov-Client-* and Gov-Vendor-* headers. The stated purpose is fraud prevention — HMRC wants a fingerprint of the originating device and software, not just the taxpayer's credentials. This is mandatory, not optional, and HMRC does run automated conformance checks against your header data.
The gotcha nobody's docs make clear: server-side vs browser-side
This is the part that catches out backend-only implementations. A chunk of the required headers describe the end user's device and browser, not your server:
