14 Arrested in Romania for £47 Million UK Tax Phishing Scam

A major international operation has led to the arrest of 14 individuals suspected of involvement in a large-scale phishing attack that defrauded UK taxpayers of an estimated £47 million.

The arrests, primarily in Romania, were the result of a joint effort between criminal investigators from HMRC (Her Majesty’s Revenue and Customs), the UK’s tax authority, and over 100 Romanian police officers.

The coordinated raids across Romania led to the detention of 13 people, both men and women, aged between 23 and 53. Separately, a 38-year-old man was arrested in Preston, UK, in connection with the same cybercrime network.

Authorities seized luxury cars and significant amounts of cash during the operations. Those arrested face charges including computer fraud, money laundering, and illegally accessing computer systems.

This action follows earlier arrests in November in Bucharest, where two men, aged 27 and 36, were detained for similar cybercrime and fraud offences. The Romanian authorities have also released a video showcasing the police raids.

The criminal gangs behind the scam used phishing, which involves tricking individuals into revealing their personal information. This stolen data was then used to submit fraudulent claims for tax repayments, including PAYE (Pay As You Earn), VAT (Value Added Tax), and Child Benefit payments, effectively creating new online tax accounts in victims’ names.

The scale of the fraud, which saw over 100,000 taxpayer accounts compromised, has drawn significant attention. The incident became particularly controversial when HMRC’s new chief executive, John-Paul Marks, and his deputy appeared before the Treasury Committee without disclosing details of the breach. Dame Meg Hillier DBE MP, Chair of the Treasury Committee, later sent a letter to HMRC, stating that their failure to report the incident was “unacceptable.”

Following the arrests, HMRC has issued an urgent warning to the public about tax fraud. Simon Grunwell, Operational Lead in HMRC’s Fraud Investigation Service, emphasised the importance of international cooperation in combating tax crime. He confirmed ongoing investigations and thanked Romanian partners for their support. HMRC stated they have already taken steps to protect customers whose accounts were targeted.

“Phishing is often seen as a low-level threat, because attacks are easy to execute and require no real computing skill; however, the attacks are rife and very successful. Almost every breach today has a human element and it is vital the security industry and government work harder to thwart this threat,” said William Wright, CEO of Closed Door Security.

“Tax scams are one of the biggest risks to citizens in the UK as criminals are adopting tactics to make them highly convincing, often using a mix of emails, post and SMS to send out fraudulent comms,” warned William.

William further warned taxpayers to be cautious of text and phishing messages that ask for their personal or organisational information while pretending to be HMRC. He also stressed the importance of social precautions when filing taxes, especially around deadlines like the self-assessment in January.