A phishing scheme run by organised crime groups cost the UK government £47 million, according to officials from His Majesty's Revenue and Customs.
Criminals posed as taxpayers to claim payments using fake or hijacked credentials. Rather than a cyberattack, the operation relied on impersonation and did not involve the theft of taxpayer data.
Angela MacDonald, HMRC's deputy chief executive, confirmed to Parliament's Treasury Committee that the fraud took place in 2024. The stolen funds were taken through three separate payments, though HMRC managed to block an additional £1.9 million attempt.
Officials began a cross-border criminal investigation soon after discovering the scam, which has led to arrests.
Around 100,000 PAYE accounts - typically used by employers for employee tax and national insurance payments - were either created fraudulently or accessed illegally.
Banks were also targeted through the use of HMRC-linked identity information. Customers first flagged the issue when they noticed unusual activity.
HMRC has shut down the fake accounts and removed false data as part of its response. John-Paul Marks, HMRC's chief executive, assured the committee that the incident is now under control and contained. 'That is a lot of money and unacceptable,' MacDonald told MPs.
