Fourteen arrested in phishing attack investigations

Thirteen people have been arrested in Romania on suspicion of making fraudulent tax repayment claims using personal data that was stolen in sophisticated phishing attacks.

Criminal investigators from HM Revenue and Customs (HMRC) joined more than 100 Romanian police officers to arrest the men and women in the counties of Ilfov, Giurgiu and Calarasi. A fourteenth man was arrested in another investigation in Preston.

A joint investigation team was established earlier this year and brought together Romanian Prosecutors, HMRC and the Crown Prosecution Service (CPS).

It’s suspected that organised criminal gangs have stolen data and used it to submit fraudulent PAYE claims, as well as VAT repayments and Child Benefit payments. The arrests are part of ongoing investigations linked to phishing attacks.

The men and women, aged between 23 and 53, were arrested by Romanian Police’s Economic Crimes Investigation Directorate on suspicion of computer fraud, money laundering and illegal access to a computer system.

The 38-year-old man arrested in Preston today in another investigation linked to the phishing attacks, continues to be questioned by HMRC officers who also seized electronic devices.

Simon Grunwell, Operational Lead in HMRC’s Fraud Investigation Service said:

“These arrests show we work across borders with our international partners to combat tax crime in all its forms.

“We have a number of live criminal investigations, and we are grateful to our Romanian partners for their support.

“We have already acted to protect customers after identifying attempts to access a very small minority of tax accounts, and we continue to work with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.”

Two other men, aged 27 and 36, were arrested in Bucharest in November on suspicion of cybercrime and fraud offences. Those investigations are also ongoing.

Anyone with information about any type of tax fraud can report it online. You can also report a scam or suspicious activity here.

Footage of the arrest operation in Romania is available here: PERCHEZIȚII DOMICILIARE ÎNTR-UN DOSAR PENAL CU UN PREJUDICIU DE PESTE 1 MILION DE LIRE STERLINE

Notes to Editors

• We are unable to provide any more detail about today’s arrest operations.
• 13 people were arrested near Bucharest on suspicion of computer fraud, money laundering and illegal access to a computer system.
• A 38-year-old man was arrested in Preston today on suspicion of:
  
  Fraud by false representation contrary to Section 2 Fraud Act (2006).
  Possession of an article for use in the course of fraud contrary to section 6 Fraud Act (2006).
  Unauthorised access to computer material contrary to section 1 Computer Misuse Act (1990).
  Unauthorised access with intent to commit or facilitate commission of further offences contrary to section 2 Computer Misuse Act (1990).
  Cheating the Public Revenue contrary to Common Law.
  Money laundering offences contrary to section 327-329 of the Proceeds of Crime Act (2002).
  
  
• A joint investigation team has been established between Romanian and UK authorities, bringing together the Prosecutor's Office attached to the Court of Appeal in Bucharest, HMRC and the Crown Prosecution Service (CPS). This international partnership enables the swift investigation of serious cross-border crimes by pooling resources, expertise, and intelligence across jurisdictions.
• We’ve written to around 100,000 people – equivalent to approximately 0.22% of our customers – to inform them we have detected unauthorised attempts to access their online HMRC account, reassure them that their account has been secured, and that they have not suffered any financial loss. We have provided more information for customers: Unauthorised access of HMRC online accounts - GOV.UK.
• This was not a cyber-attack. These involved criminals using personal information from various sources elsewhere (for example, phishing activity or data obtained through other organisations) to access HMRC services.
• We continuously enhance our security measures to tackle evolving fraud tactics. At the Spending Review on 11 June 2025 the government announced further investments in the security of HMRC’s IT systems.
• According to the National Cyber Security Centre, HMRC was the third most spoofed government body in 2022, behind the NHS and TV Licensing. You can Avoid and report internet scams and phishing
• Find out more about HMRC's approach to tax fraud here
• Follow HMRC’s Press Office on X @HMRCpressoffice.