HMRC admits £47 million loss in breach of taxpayer accounts
Two senior civil servants at HM Revenue and Customs (HMRC) told the Treasury Committee that 100,000 people have been contacted, or are in the process of being contacted, after their accounts were locked down in what they said was an 'organised crime' incident which began last year.
Taxpayers who are being affected will suffer 'no financial loss', according to John-Paul Marks, the chief executive of HMRC, the UK's tax authority.
Mr Marks told the Committee: 'It's about 0.2% of the PAYE population, around 100,000 people, who we have written to, are writing to, to notify them that we detected activity on their PAYE account.'
Asked if this applied to individual working people's PAYE accounts, not companies, he replied: 'That's right, individuals. To be clear, no financial loss to those individuals.
Mr Marks added: 'This was organised crime phishing for identity data outwith of HMRC systems, so stuff that banks and others will also unfortunately experience, and then trying to use that data to create PAYE accounts to pay themselves a repayment and/or access an existing account.'
An investigation into the matter, which took place last year 'including jurisdictions outside the UK', led to 'some arrests last year,' Mr Marks told MPs.
Angela MacDonald, HMRC's deputy chief executive and second permanent secretary, added: 'At the moment, they've managed to extract repayments to the tune of £47 million.
'Now that is a lot of money, and it's very unacceptable.
'We have overall, in the last tax year, we actually protected £1.9 billion worth of money which sought to be taken from us by attacks.'
Get your tax return done early and find out sooner if you're owed money. ⏲️
We'll let you know if you've overpaid tax after you file your Self-Assessment tax return and refund you. 💷
File today. 👇 https://t.co/OIh3mAczQk pic.twitter.com/vbmz1AjfKK
Ms MacDonald stressed the breach was 'not a cyber attack, we have not been hacked, we have not had data extracted from us'.
She later added: 'The ability for somebody to breach your systems and to extract data, to hold you to ransomware and all of those things, that is a cyber attack. That is not what has happened here.'
HMRC said it had locked down affected accounts and deleted log-in details to prevent future unauthorised access.
Any incorrect information has been removed from tax records and officials have checked to ensure no other details have been changed.
People affected will receive a letter from HMRC over the next three weeks.
Elsewhere, Mr Marks told MPs that HMRC phone lines were down on Wednesday afternoon, but said this was 'coincidental'.
They will be 'back up and available in the morning', he added.
Recommended reading:
An HMRC spokesperson said: 'We've acted to protect customers after identifying attempts to access a very small minority of tax accounts, and we're working with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.
'This was not a cyber-attack – it involved criminals using personal information from phishing activity or data obtained elsewhere to try to claim money from HMRC.
'We're writing to those customers affected to reassure them we've secured their accounts and that they haven't lost any money.'
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Daily Mirror
2 hours ago
- Daily Mirror
DWP issues urgent warning to millions who claim benefits
You need to look out for text messages and emails from the Department for Work and Pensions The Department for Work and Pensions (DWP) has sent out an urgent warning across its social media channels, cautioning the millions of people on benefits to watch out for fake text messages trying to swipe their "personal or financial details". The alert has been sent to the up to 23.7 million people in Great Britain benefitting from payments that include State Pension, Universal Credit, Personal Independence Payment (PIP), Attendance Allowance, and Jobseeker's Allowance (JSA). Taking to Twitter and Facebook, the DWP said "Be aware of scam text messages claiming to be from @dwpgovuk. Always be careful about links and never share personal or financial details, only engage with trusted official sources." The department has also asked anyone who's been targeted by suspicious texts to report them through under 'avoid and report internet scams and phishing'. Amidst the current cost of living squeeze, scammers are stepping up their game, posing as credible authorities like the DWP or HM Revenue and Customs (HMRC) via 'impersonation scams'. There has been a spate of texts floating around, dangling bait such as 'unclaimed cost of living payments' and bogus Warm Home Discount offers. The DWP pointed out they'd never send 'direct links' for claims – interactions for Universal Credit beneficiaries typically happen through their work coach and online journal. If you receive a text and you're uncertain whether it's genuinely from a DWP department or HM Revenue and Customs, the safest course of action is to ring them for confirmation, reports Bristol Live. Simple steps to avoid scammers. Here are some quick checks everyone can perform regularly to identify and avoid potential scams. Never disclose your financial or personal details. Avoid sharing your personal or financial information with anyone. This includes refraining from jotting down your banking details. If you can commit your information to memory, this is the safest approach, but if you do need to note down your details, ensure they're stored in a secure place and not carried around when shopping. Reputable retailers will never request your PIN, CVC number or other online banking identifiers. Regularly review your bank statement. If you spot an unfamiliar transaction, it's crucial to notify your bank straight away to have the card blocked. Most banks operate a dedicated fraud action line, where you can report the theft and ask for a refund. Keep tabs on your cards. If you misplace any of your bank cards or suspect they've been nicked, you should get in touch with your bank immediately so they can freeze it. Many banks now allow you to do this via their app rather than phoning up, which can expedite the process. It might be handy to have your bank's contact details and phone number at hand, so you can reach out to them if necessary. Be cautious of dubious emails or texts. Avoid replying to text messages or emails if you're unsure about their authenticity. A good rule of thumb is to never reveal private, personal information. This includes details such as your bank account information or passwords; no reputable company should ever ask for these. Emails or texts with grammatical errors can often signal a phishing scam from an illegitimate source, so it's best to steer clear of opening these. Refrain from clicking on any links if you're uncertain about their legitimacy. Avoid downloading anything sent to you via email or text. It's recommended to have antivirus software installed, which will scan for malware and protect against phishing attacks.
The Courier
2 hours ago
- The Courier
Fife school embroiled in child abuse scandal was 'house of horrors' says mum of ex-pupil
The mother of a pupil at a Fife residential school has described it as 'a house of horrors'. The woman's son John was a pupil at Starley Hall School in Burntisland in 2000 and 2001. She told the Scottish Child Abuse Inquiry that John, who died in February this year, was in fear for his life there after being physically and psychologically abused. She said the teenager was restrained, choked and had his face rubbed in vomit. Four men appeared at the High Court in Edinburgh in 2019, accused of physical and sexual abuse of 34 children at Starley Hall, a school for children with additional support needs. However, all were acquitted following trial. Despite that, Claire, a pseudonym, branded her son's treatment at the hands of some staff 'dehumanising'. She said her concerns began before John even started at the school. 'On the day we visited one of the young boys came up to him and said 'you don't want to come here',' she said. John, also a pseudonym, gave evidence in the 2019 high court case. And the statement he gave to police about abuse at Starley Hall School was read out to the inquiry. He was sent to Starley Hall as he had dyslexia, writing problems and poor memory. He was labelled disruptive and placed on a supervision order. John's statement told how he received regular 'back-handers' to the face from staff. And an incident between him and another pupil let to staff seriously assaulting him. 'I was restrained on the floor by four members of staff,' his statement said. 'One kneed me in the ribs, which made me vomit on the floor. 'They put my head in the vomit so I couldn't breathe. 'And I was choking on the vomit still in my mouth.' In another incident, a teacher restricted his breathing until he blacked out. John's evidence told how he wrote to his mother several times, telling her what was happening to him. However, staff did not post his letters. In 2019, John described Starley Hall as 'the place that ruined my life'. And he added: 'I want these people to be held accountable.' Claire told the inquiry the result of the court case sent her son into a spiral of anxiety and depression. She later sent a Freedom of Information (FOI) request to Fife Council asking for a Starley Hall inspection report from 1998, just two years before John attended. It revealed some of the accommodation was neglected, resulting in registration for those parts not being approved. It also said the number of incidents related to behaviour, accidents or bullying was a cause for concern. 'I find it beyond words that this house of horrors was allowed to exist,' Claire said.
Daily Mirror
5 hours ago
- Daily Mirror
Tax warning issued to freelancers ahead of shake-up next year
MoneyMagpie Editor and financial expert Vicky Parry warns self-employed workers and freelancers about the pitfalls of ignoring Making Tax Digital changes Making Tax Digital (MTD) has been slow to roll out, but it's nearing the end. And most freelancers and self-employed people have no idea what that means for them. This guide helps you understand what you need to know to avoid huge fines from HMRC. What is Making Tax Digital for income tax? HMRC reporting systems are outdated and unwieldy. Making Tax Digital is supposed to cut through the archaic system to help companies and freelancers manage their taxes more easily and accurately. The scheme has already rolled out for companies and sole traders registered for VAT. Making Tax Digital for Income Tax is the next stage in a years-long roll out of the new system. Rather than annual reporting with a deadline nine months after the end of the previous tax year, which is the current Self Assessment system, people will be required to submit quarterly assessments and the final, fifth, full report. The system is supposed to help freelancers and sole traders budget their taxes better. However, it does also add administrative burden to companies and freelance workers – and there is a requirement to use third-party software to submit, too. Who does it impact? By April 2028, all self-employed traders who earn over £20,000 a year will be part of MTD Income Tax. This will be rolled out in stages. For those earning above £50,000 a year, they will need to be registered for and using MTD for April 2026 – the next tax year from the one we're currently in. That means there are only ten months to get everything set up. Those earning £30,000 or above will need to comply by April 2027, and those earning £20,000 will be part of the scheme by April 2028. Landlords: You need to register too If you earn above the threshold amounts for any roll-out year of MTF for Income Tax from property rental income, you will need to register. If your property income is through the Rent a Room scheme, you won't need to register (unless your combined self-employed income also takes you over the threshold). You can ensure the tax-free portion of Rent a Room is managed on your final end of year full tax return. MTD for income tax exemptions There are some situations where you could be exempt from MTD for Income Tax. The first is if you know you will only use simplified expenses . Other exemptions include where HMRC cannot provide a digital service due to remote location, or a person cannot use a digital service due to age, disability, or location (i.e., it is too remote). You also do not need to register if you are under an insolvency procedure or your business is solely run by people of a religious order where electronic communication does not comply with religious beliefs. You may also withdraw from MTD for Income Tax if your business has received under the threshold income for three consecutive years, or your business is in a winding down procedure. Check the details of these and further possible exemptions on the Making Tax Digital Government pages . Self assessment and payments on account You will still need to complete an annual Self Assessment as well as file your quarterly reports. The Self Assessment is more detailed and will enable you to adjust for non-business income and other details. You're not penalised for adjustments between quarterly reports and your final Self Assessment. Payments on Account will still apply, too. This is where, if your tax bill is over £1000 for the year, you will need to pay the full tax bill plus 50% by January 31st, and the remaining 50% in July. PoA is supposed to estimate a regular annual income, so if you have an exceptional year – such as receiving an unusually large contract – you can apply to reduce these payments. However, if you apply to reduce the payment and then do manage to earn similar in the following tax year, interest can be applied on the difference in payments. Penalty points for late filing Late filing will still come with penalties, as with the usual Self Assessment process. However, in the trial years if you signed up to test the system early filing penalties will not apply. There is a new points-based penalty system for MTD Income Tax. You will not pay a fine for the first late filing, but cumulative errors will apply over ongoing tax years. Points will be applied for each late filing of quarterly and final reports, with a maximum fine of £200 for 4 points. The points will only reset when all filings are met to current dates. Points will expire after two years if you do not meet the threshold of 4 points. Penalties for late payments will also be changing under the new system. If you pay within 15 days of the due date, there is no fine. Within 16-30 days inclusive, the fine is 3% of the tax outstanding on the 15th day, and over 30 days the fine is 3% of the tax on the 15th day, plus 3% of the tax on the 30th day, and an extra 10% per annum charge until the payment is made. Interest will also be accrued daily. Standard fines for not maintaining accurate records, or for broken links in compatible software, will result in fines up to £3000. Choosing a third party software One of the rules of MTD for Income Tax is the use of third-party approved software. You can check which software is approved by HMRC here . You will need this software for your records even if you have an accountant filing on your behalf. While you can still keep spreadsheet records for your business, your filing must be done via one of these software platforms. Many business bank accounts now offer free access to integrated approved software, which could reduce the financial burden of your quarterly returns as well as make them faster as the software will have real-time information about your income and expenses. Sign up to free HMRC webinars While not widely advertised, HMRC does have some resources for freelancers and self-employed workers on their website. This includes a section about Making Tax Digital for Income Tax, including a recorded webinar or the ability to register for the next live webinar. It is strongly advised that freelancers, sole traders, and self-employed workers register for email updates from HMRC about Making Tax Digital, in case changes are implemented as the scheme rolls out through the trial phase. Some of the brands and websites we mention may be, or may have been, a partner of However, we only ever mention brands we believe in and trust, so it never influences who we prioritise and link to
