Thirteen individuals have been arrested in Romania following phishing attacks targeting the UK’s tax authority, HM Revenue & Customs (HMRC). The suspects are believed to have used stolen data to fraudulently claim millions of pounds in tax payments, HMRC announced on Thursday.
The arrests involved a coordinated effort with over 100 Romanian police officers, focusing on the southern counties of Ilfov, Giurgiu, and Calarasi. During the raids, authorities seized cash and luxury vehicles. The arrested individuals, aged between 23 and 53, face charges including computer fraud, money laundering, and illegal access to computer systems.
Additionally, a 38-year-old man was arrested in Preston, northwest England, on the same day. These actions follow HMRC’s disclosure last month that a criminal gang had stolen approximately £47 million ($63.7 million) by accessing over 100,000 customer accounts through phishing schemes and submitting false payment claims to the government.
HMRC emphasized that the fraud targeted the tax office rather than individual customers, though around 100,000 people were notified as a precaution. Criminal groups allegedly used the stolen data to file fraudulent claims for income tax, value-added tax (VAT), and child benefit repayments.
Simon Grunwell, operational lead of HMRC’s Fraud Investigation Service, said the agency has already taken steps to protect affected customers after detecting attempts to access a small portion of tax accounts.
Earlier, in November, two men were arrested in Bucharest as part of related cybercrime and fraud investigations linked to these phishing activities.