Scammers have stolen £47 million from HMRC by accessing the online accounts of around 100,000 people, according to the tax authority.

HMRC confirmed that it is contacting everyone affected to reassure them that their accounts are now secure, they haven’t lost any money, and no action is needed on their part.

“These were attempts to fraudulently claim money from HMRC, not from individual customers,” the authority stated.

A criminal investigation has already taken place, with arrests made in 2023.

The scammers used phishing techniques—where criminals impersonate individuals using stolen personal information—to create fake accounts and try to claim tax refunds. HMRC emphasized this was not a cyberattack in the sense of hacking into systems, as seen in recent incidents affecting large retailers.

Speaking to MPs on the Treasury Select Committee, HMRC’s Deputy Chief Executive Angela MacDonald admitted, “A lot of money was taken—and it’s completely unacceptable.”

John-Paul Marks, HMRC’s Chief Executive, added that swift action was taken to identify and shut down the compromised accounts.

However, MPs criticized HMRC for not informing the committee when the fraud first occurred. Chair Dame Meg Hillier said they only learned about the incident through media reports. She reminded HMRC that it should have informed Parliament directly before a public announcement.

"Money was stolen by criminals who exploited the digital system. Most people would view that as a cybercrime, no matter how you define it," Hillier said.

Angela MacDonald explained that the fraud mainly involved criminals setting up new accounts using stolen data. Many of the victims were unaware, as they had never created online tax accounts before.

She said the scammers changed their tactics as HMRC responded by shutting down fake accounts. "We took significant action to disrupt the criminals and secure the system," she said.

One of the challenges in resolving the situation, MacDonald noted, was making sure HMRC was dealing with the real customer—not the scammer.

She confirmed that the Information Commissioner’s Office was kept informed and had provided guidance.

“We operate in a world where every organization faces some level of cyber threat,” she said. “We continue to invest in our systems to stay ahead of criminals.”

The BBC reports that the government is expected to announce more funding for HMRC's IT systems in the upcoming spending review. Photo by Images_of_Money's profile, Wikimedia commons.