HMRC says phishing fraud hit 100,000 tax accounts and cost 47 million pounds

HM Revenue and Customs told the UK Parliament's Treasury Select Committee that organized criminals had used phishing and previously stolen personal data to take over or create online tax accounts belonging to about 100,000 people, and had claimed roughly £47 million, about $63 million, in fraudulent repayments.

The activity centered on Pay As You Earn accounts, the online records tied to the UK's automatic payroll tax system. Officials said the fraudsters used genuine credentials obtained through phishing or taken from data breaches elsewhere, then filed bogus rebate claims. Setting up accounts for taxpayers who had never registered for online access made the fraud less likely to be spotted by the individuals concerned. The affected accounts represented roughly 0.2% of PAYE users.

HMRC said its own systems were not breached and that no ransom was involved, a framing its deputy chief executive Angela MacDonald conceded could look like splitting hairs. The department said affected taxpayers had lost no money themselves, that the accounts had been locked down, and that letters would go out within about three weeks. It said it had blocked £1.9 billion in attempted fraud over the same period.

A criminal investigation spanning several jurisdictions had already produced a number of arrests. Committee chair Dame Meg Hillier criticized HMRC for revealing the losses during the hearing rather than informing Parliament beforehand.