Hi, Long time lurker, first time poster!
I added my 3 youngest children to my HHA yesterday. Noticed a really odd thing with the validation emails which of course go to "their" email accounts for them to accept becoming part of the HHA.
The unique URLs which are provided to validate the process seem "dodgy" and redirect to a strange url. My virus scanner then blocked them.
The beginning of the urls provided was

unable to post properly as new poster) "wwwbritishairways.com/travel/hmrjoinhhaccount/"
I found that by adding the . between www and british, i was directed to the correct url. (validated D.O.B and added the chid to my HHA)
Would be good to be looked into- other people may be struggling to add people to their account, or worse still being phished. Not sure how this can happen.