Criminal investigators from HMRC joined more than 100 Romanian police officers to arrest 13 men and women in the counties of Ilfov, Giurgiu and Calarasi in Romania, and a further gang member was arrested in Preston, Lancashire.

The raids resulted in 14 arrests and seizures of more than a million pounds in cash in large wads of notes, euros, jewellery and luxury cars. At the moment there are no more details about the full extent of the seizures.

The arrests are part of ongoing investigations into tax fraud, linked to sophisticated phishing attacks, and follows the disclosure last month that around 100,000 taxpayer online accounts have been compromised, resulting in the theft of £47m from HMRC itself.

A video of the raid is available on YouTube.

A joint investigation team was set up earlier this year and brought together Romanian prosecutors, HMRC and the Crown Prosecution Service (CPS). 

It is suspected that organised criminal gangs have stolen data and used it to submit fraudulent PAYE claims, as well as VAT repayments and child benefit payments. The arrests are part of ongoing investigations linked to phishing attacks.   

The men and women, aged between 23 and 53, were arrested by Romanian Police’s Economic Crimes Investigation Directorate on suspicion of computer fraud, money laundering and illegal access to a computer system.

A 38-year-old man was also arrested in Preston today in another investigation linked to the phishing attacks. He continues to be questioned by HMRC officers who also seized electronic devices.

Simon Grunwell, operational lead in HMRC’s Fraud Investigation Service said: ‘These arrests show we work across borders with our international partners to combat tax crime in all its forms.

‘We have a number of live criminal investigations, and we are grateful to our Romanian partners for their support.

‘We have already acted to protect customers after identifying attempts to access a very small minority of tax accounts, and we continue to work with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.’

Two other men, aged 27 and 36, were arrested in Bucharest in November on suspicion of cybercrime and fraud offences. Those investigations are also ongoing.

Following the identification of the phishing attack, which started last autumn, HMRC took swift action to stop theft from taxpayers’ online accounts, but not before £47m had been stolen. The money was not taken from individual taxpayer accounts, but was stolen directly from HMRC through fake repayment claims.

It was not until June of this year that the phishing attack came to light after HMRC started writing to around 100,000 affected taxpayers, equivalent to 0.2% of UK tax base, informing them that their accounts had been compromised. These letters were sent out from 4-25 June this year.

The letters informed affected taxpayers that HMRC had ‘detected unauthorised attempts to access their online HMRC account, reassure them that their account has been secured, and that they have not suffered any financial loss’.

Affected taxpayer online accounts were locked down and their login details, including Government Gateway user ID and passwords, were deleted.

Information for affected taxpayers is available on HMRC’s website explaining what action to take and action to take if they have not received a letter. See Unauthorised access of HMRC online accounts.

Anyone with information about any type of tax fraud can report it online, and also report a scam or suspicious activity.

HMRC online accounts hit by unauthorised access | 4 Jun 2025