Authorities Arrested 14 Hackers in Connection With Large-Scale Tax Fraud Operation

Fourteen individuals have been arrested in a coordinated international operation targeting a sophisticated cybercriminal network responsible for large-scale tax fraud through phishing attacks and fraudulent benefit claims. 

The arrests represent a significant breakthrough in combating cross-border financial cybercrime affecting thousands of taxpayers.

Key Takeaways
1. 13 suspects detained in Romania and 1 in Preston, UK, aged 23-53, in a coordinated international operation targeting a cybercriminal network.
2. Phishing network used stolen data to file fake PAYE, VAT, and Child Benefit claims.
3. ~100 000 HMRC accounts flagged, secured, with no financial losses.
4. Joint Investigation Team between HMRC, CPS, and Romanian prosecutors led the operation.

Sophisticated Phishing Operations Target Tax Systems

The criminal network employed sophisticated phishing techniques to steal personal data, which was subsequently used to submit fraudulent Pay As You Earn (PAYE) claims, Value Added Tax (VAT) repayments, and Child Benefit payments. 

The perpetrators gained unauthorised access to HMRC online accounts using personal information obtained through various external sources rather than direct cyberattacks on HMRC systems.

Approximately 100,000 HMRC customers, representing 0.22% of the total customer base, were notified about unauthorised access attempts to their accounts. 

HMRC confirmed that affected customers’ accounts have been secured and no financial losses occurred. 

The attacks specifically targeted tax repayment systems, exploiting vulnerabilities in digital identity verification processes.

Thirteen suspects, aged between 23 and 53, were apprehended by the Romanian Police’s Economic Crimes Investigation Directorate in the counties of Ilfov, Giurgiu, and Calarasi.

A fourteenth individual, a 38-year-old man, was simultaneously arrested in Preston, UK, as part of related investigations. 

The operation involved over 100 Romanian police officers working alongside criminal investigators from HM Revenue and Customs (HMRC).

The UK suspect faces multiple charges under various legislation, including fraud by false representation contrary to Section 2 of the Fraud Act (2006), possession of articles for fraud under Section 6 of the Fraud Act (2006), and unauthorised computer access violations under Sections 1 and 2 of the Computer Misuse Act (1990). 

Additional charges include money laundering offences under Sections 327-329 of the Proceeds of Crime Act (2002) and cheating the Public Revenue contrary to Common Law.

A Joint Investigation Team (JIT) established earlier this year brings together Romanian Prosecutors, HMRC, and the Crown Prosecution Service (CPS) to facilitate the swift investigation of serious cross-border crimes. 

This international partnership enables the pooling of resources, expertise, and intelligence across jurisdictions to combat evolving fraud tactics.

Simon Grunwell, Operational Lead in HMRC’s Fraud Investigation Service, emphasized the importance of international cooperation in combating tax crime. 

The government announced further investments in HMRC’s IT security systems during the Spending Review on 11 June 2025. 

According to the National Cyber Security Centre, HMRC was ranked as the third most spoofed government body in 2022, highlighting the ongoing threat landscape.

Two additional suspects, aged 27 and 36, were previously arrested in Bucharest in November on related cybercrime and fraud charges, with investigations remaining active. 

The coordinated response demonstrates the effectiveness of international law enforcement collaboration in addressing sophisticated financial cybercrime networks.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now