100,000 UK taxpayer accounts hit in £47m phishing attack on HMRC | HMRC

[Pelican Press 0]

This is the hidden content, please

• Sign In
• or
• Sign Up

100,000 *** taxpayer accounts hit in £47m phishing attack on HMRC | HMRC

HM Revenue and Customs has lost £47m after a phishing scam breached tens of thousands of tax accounts, a group of MPs has heard.

Two senior civil servants at the tax authority told the Treasury committee on Wednesday that 100,000 people had been contacted, or were in the process of being contacted, after their accounts were locked down in what the officials said was an “organised crime” incident that began last year.

Taxpayers affected would suffer “no financial loss”, said John-Paul Marks, HMRC’s chief executive.

He told the committee: “It’s about 0.2% of the PAYE population, around 100,000 people, who we have written to, are writing to, to notify them that we detected activity on their PAYE account.”

Asked whether this applied to individual working people’s PAYE accounts, not companies, Marks replied: “That’s right, individuals. To be clear, no financial loss to those individuals.”

He added: “This was organised crime phishing for identity data outwith of HMRC systems, so stuff that banks and others will also unfortunately experience, and then trying to use that data to create PAYE accounts to pay themselves a repayment and/or access an existing account.”

An investigation into the matter, which took place last year “including jurisdictions outside the ***”, led to “some arrests last year”, Marks told MPs.

Angela MacDonald, HMRC’s deputy chief executive and second permanent secretary, added: “At the moment, they’ve managed to extract repayments to the tune of £47m. Now that is a lot of money, and it’s very unacceptable.

“We have overall, in the last tax year, we actually protected £1.9bn worth of money which sought to be taken from us by attacks.”

MacDonald stressed the breach was “not a cyber-attack, we have not been hacked, we have not had data extracted from us”.

She later added: “The ability for somebody to breach your systems and to extract data, to hold you to ransomware and all of those things, that is a cyber-attack. That is not what has happened here.”

HMRC said it had locked down affected accounts and deleted login details to prevent future unauthorised access.

Any incorrect information has been removed from tax records and officials have checked to ensure no other details have been changed.

People affected will receive a letter from HMRC over the next three weeks.

Marks also told MPs that HMRC phone lines were down on Wednesday afternoon but said this was “coincidental”, adding they will be “back up and available” on Thursday.

An HMRC spokesperson said: “We’ve acted to protect customers after identifying attempts to access a very small ********* of tax accounts, and we’re working with other law enforcement agencies both in the *** and overseas to bring those responsible to justice.

“This was not a cyber-attack – it involved criminals using personal information from phishing activity or data obtained elsewhere to try to claim money from HMRC.

“We’re writing to those customers affected to reassure them we’ve secured their accounts and that they haven’t lost any money.”

Last week, *** banks and payment firms were urged to strengthen their anti-fraud systems for international payments after a rise in scammers tricking people into sending money abroad.

New figures revealed that international payments accounted for 11% of authorised push payment scams losses in 2024 – almost double the 2023 figure.

This is the hidden content, please

• Sign In
• or
• Sign Up

#taxpayer #accounts #hit #47m #phishing #attack #HMRC #HMRC

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up