Organized crime has extracted £47 million ($64 million) from the UK government in a phishing operation, His Majesty’s Revenue and Customs officials said Wednesday.The operation, which took place last year, involved mimicking taxpayer credentials and claiming payments from HMRC, Angela MacDonald, second permanent secretary and deputy chief executive, told Parliament’s Treasury Committee. The incident wasn’t a cyberattack and no data from taxpayers was taken, she said.
Organized crime has extracted £47 million from the UK government in a phishing operation, His Majesty’s Revenue and Customs officials said Wednesday.The operation, which took place last year, involved mimicking taxpayer credentials and claiming payments from HMRC, Angela MacDonald, second permanent secretary and deputy chief executive, told Parliament’s Treasury Committee. The incident wasn’t a cyberattack and no data from taxpayers was taken, she said.
“That is a lot of money and is very unacceptable,” MacDonald said.
The Treasury Committee learned of the incident during a hearing, after asking the HMRC officials about a statement released earlier in the day that said the tax authority had shut down accounts after detecting “unauthorised access.”
HMRC is trying to contact 100,000 people whose accounts have been affected, John-Paul Marks, HMRC first secretary and chief executive, told the committee. Authorities began a criminal investigation that included going outside the UK after HMRC detected the operation in 2024, and arrests have since been made, he said.
“This incident is constrained, it is under control,” he said.
The affected accounts are Pay-As-You-Earn, or PAYE, accounts, used by employers to hold employee tax and national insurance payments, Marks said. The entities behind the operation created new PAYE accounts and accessed existing ones to get a repayment from HMRC, he said.
Banks have also been affected by the operation to use HMRC’s identity information, Marks said.
Customers initially contacted HMRC after noticing anomalies in their accounts, Marks said. The tax authority has shut down fake accounts and removed false information as part of its response, he said.
