Romanian authorities have detained 13 individuals suspected of orchestrating a phishing scheme targeting the UK’s HM Revenue and Customs (HMRC), which led to millions being claimed in fake tax refunds.

The suspects, aged between 23 and 53, allegedly stole personal data and used it to file false claims for PAYE refunds, VAT repayments, and child benefit payments totaling millions of pounds.

The operation was conducted by HMRC investigators alongside over 100 Romanian law enforcement officers in Ilfov, Giurgiu, and Calarasi counties.

“These arrests demonstrate our commitment to fighting tax fraud through international cooperation,” said Simon Grunwell from HMRC’s Fraud Investigation Service. “We are actively investigating several cases and appreciate the collaboration with our colleagues in Romania.”

He also added that HMRC had taken steps to secure affected accounts and is working closely with domestic and foreign agencies to ensure those responsible face justice.

In November, two other suspects—aged 27 and 36—were arrested in Bucharest on charges related to cybercrime and fraud, with investigations still underway.

Last month, HMRC disclosed that scammers had accessed approximately 100,000 taxpayer accounts and made off with ￡47 million. A 38-year-old man was subsequently arrested in Preston in connection with this breach.

“This was a coordinated criminal effort involving phishing attacks outside of HMRC systems—similar to what banks and other institutions also face,” explained HMRC chief executive John-Paul Marks. “They used stolen data to either create new PAYE accounts or access existing ones to claim refunds illegally.”

Details of the phishing campaign

The cyberattack occurred last year but was only publicly disclosed in June, prompting criticism from Dame Meg Hillier, chair of the Treasury Select Committee, who called HMRC’s delay in reporting the incident "unacceptable."

HMRC stated that it contacted impacted taxpayers directly in June, secured compromised accounts, and wiped all login details—including Government Gateway IDs and passwords—to prevent further unauthorized access.

Additionally, the department corrected any false information entered into tax records as a result of the scam.

“Tax-related fraud is one of the most serious threats UK citizens face today,” said William Wright, CEO of Closed Door Security. “Scammers are increasingly sophisticated, often combining emails, postal mail, and SMS to mimic official communications. These messages can look extremely authentic, especially when timed around major tax deadlines like January’s self-assessment period.”

Be sure to follow php.cn on Google News for all the latest updates, insights, and tech news.

The above is the detailed content of Arrests made after huge HMRC scam campaign hit 100,000 accounts. For more information, please follow other related articles on the PHP Chinese website!