10.07.2025
2 min
549
A large-scale operation by Romanian law enforcement officers has led to the arrest of 13 suspects in a case of mass phishing of British tax officials. An organized group hacked more than a thousand HMRC accounts, stealing personal data of more than 100,000 British citizens and receiving illegal payments worth £ 47 million
The operation was jointly carried out by Romanian police, the prosecutor’s office, the British tax service HMRC and the Crown Prosecution Service. According to the investigation, the fraudsters have been carrying out sophisticated phishing attacks since September 2023, stealing data to log in to taxpayers’ accounts. They changed information in the HMRC system or created fake accounts using real personal data, after which they submitted false requests for tax, VAT and social security refunds. The funds received were transferred to bank accounts opened in advance, which indicates systemic money laundering.
The case involves more than 250 participants, from the leaders of the criminal group to small-time perpetrators. Police seized cash, electronics and luxury goods during searches in Bucharest and other regions of Romania. HMRC sent warnings to victims between 4 and 25 June, assuring them that it had taken measures to protect customers. In parallel, one suspect was also arrested in England.
The case illustrates how international criminal networks are able to exploit government digital platforms for multi-million-pound scams. And even in 2025, the protection of personal data and multi-factor authentication remain key barriers to phishing. Combating such schemes requires not only a technical response, but also international coordination.
