Phishing at tax authority HMRC: 47 million pounds in losses from fake tax accounts

June 5, 2025

Categories:

Data security

Her Majesty's Revenue and Customs (HMRC) has announced that cyber criminals have stolen around 47 million pounds via fraudulently opened tax accounts. Over 100,000 people have been affected, often without knowing it. This was not a classic hack, but a phishing-based social engineering campaign. The attackers misused legitimate access data to impersonate taxpayers and claim refunds.

Phishing instead of technical compromise

The attack on HMRC was not a traditional IT security incident where a system was compromised by malware or a technical exploit was used. Rather, it was a sophisticated phishing campaign.

The criminals sent fraudulent emails designed to capture sensitive personal information such as people's names, dates of birth and social security numbers. Using this information, the attackers fraudulently set up new tax accounts with HMRC, which are normally used by taxpayers to claim their refunds or manage their tax details.

By creating these fake accounts in the names of real people, the attackers attempted to illegally claim tax refunds and receive payouts. What was particularly insidious was that many of the people affected had never previously set up an online account with HMRC and therefore had no way of knowing that fraudulent activity was taking place in their name.

The procedure clearly shows how efficient social engineering can be when combined with inadequate identity verification. It was not necessary to break into systems technically, as the vulnerability lay in the authentication logic and the assumption that the login details of a real identity automatically mean legitimate access. This is precisely where the attackers started and were able to create a large number of fake accounts without this being noticed at first.

Response and risk assessment by HMRC

The British tax authority HMRC explicitly emphasized in a statement that no funds were stolen directly from the citizens concerned. Rather, HMRC itself was the target of the attacks. The fraudsters used stolen identity data to fraudulently claim tax refunds and defraud the authority of millions.

As a result, thousands of compromised accounts were identified and blocked. HMRC initiated measures to restore the legitimacy of existing accounts and prevent new abuse. According to HMRC, it was particularly challenging to subsequently distinguish between genuine customers and the attackers, as many of the people affected did not previously have an online account with HMRC.

There was also criticism of HMRC's internal and external communications. The members of the Treasury Select Committee only found out about the incident from the press. This was criticized in parliament. This criticism illustrates how essential clearly defined reporting channels and transparent communication are for crisis management in such cases.

Reading tip: Beware of ESMA fraud - how to protect yourself from fake identities

Classification for compliance and IT consultants

Risk of identity fraud on platforms with a self-service character

This incident underlines the need to think beyond pure technical hacking when it comes to platforms with a high level of automation (e.g. online tax portals, banking apps, customer self-service). Social engineering and identity misuse are not only an IT risk, but also a governance problem.

KYC and identity verification are also crucial for public bodies

The fact that HMRC so easily accepts new accounts based on captured data shows shortcomings in identity verification (Know Your Customer). Public bodies also need to implement mechanisms such as two-factor authentication, biometrics or the video ID process to prevent such abuses.

Transparency and communication as part of the compliance strategy

The parliamentary reprimand to HMRC for only finding out about the incident from the media is a clear reminder to all organizations that internal and external communications must also follow a protocol when cyber incidents occur. Incident response and reporting should be an integral part of an IT security and compliance plan.

Strategic lessons from the HMRC incident

The HMRC case impressively demonstrates that phishing remains one of the most effective attack vectors used by cyber criminals. What is remarkable is that this was not a classic technical attack, but the attackers were able to achieve their goals through clever social engineering and the misuse of stolen identity data. The incident makes it clear that the greatest vulnerabilities do not necessarily lie in the IT infrastructure itself, but often in inadequate organizational processes, insufficient identity checks and a lack of awareness.

It is not enough to implement technical security solutions such as firewalls, encryption or intrusion detection systems. Rather, a holistic security approach must be pursued that also includes organizational and human factors. This includes robust identity verification procedures, clear internal communication and reporting channels and continuous awareness programs for everyone involved.

This comprehensive perspective is the only way to build genuine resilience against modern cyber threats. The aim must be not only to prevent attacks, but also to remain capable of acting in an emergency in order to quickly identify, limit and manage risks.

Source: HMRC communication on the phishing incident
Source: Scammers stole £47m from HMRC in phishing attack (BBC)