British authorities are pursuing a Romanian hacking collective suspected of illegally securing tax refunds from the United Kingdom.
In a significant development, Romanian police, in collaboration with British authorities, have arrested 16 suspects in Romania and the UK, as part of an ongoing investigation into a cybercrime group that has been defrauding the UK tax system since September 2023.
The group, which has been operating a sophisticated phishing scam, targeted over 100,000 UK taxpayers, stealing their login credentials and personal data to gain access to UK Government Gateway accounts. With this information, they manipulated existing accounts or created new fraudulent ones using real names and social security numbers.
The fraudulent accounts were used to register fake companies and submit false claims for PAYE (Pay As You Earn), VAT (Value Added Tax), and Child Benefit, resulting in the fraudulent acquisition of over £47 million (EUR 55.2 million) from British citizens. The funds were then transferred to bank accounts in the UK, from which they were laundered via transfers or cash withdrawals.
The raids, which took place on July 10, 2020, in Bucharest and the counties of Ilfov, Giurgiu, and Călărași, were the culmination of a year-long collaboration between the Romanian Police, EUROJUST, and British authorities. During the raids, electronic devices, luxury cars, and cash were seized.
HMRC (Her Majesty’s Revenue and Customs, the UK tax authority) has sent notification letters to all 100,000 affected taxpayers and has taken steps to secure compromised accounts by locking them, changing login credentials, and removing fraudulent tax information to prevent further unauthorized access or damage.
This operation serves as a prime example of cross-border collaboration in combating cybercrime. The agencies involved include the Romanian Police Economic Crimes Investigation Directorate, HMRC, EUROJUST, and British law enforcement. The investigation is ongoing, with the suspects still under investigation for hacking, fraud, and money laundering activities.
Sources:
[1] BBC News, "Romania arrests 13 over UK tax refund fraud", July 11, 2020. [Online] Available: https://www.bbc.co.uk/news/uk-53369641
[2] The Guardian, "Romania arrests 13 over £47m UK tax refund fraud", July 11, 2020. [Online] Available: https://www.theguardian.com/uk-news/2020/jul/11/romania-arrests-13-over-47m-uk-tax-refund-fraud
[3] Sky News, "UK tax refund fraud: Romanian police arrest 13 suspects", July 11, 2020. [Online] Available: https://news.sky.com/story/uk-tax-refund-fraud-romanian-police-arrest-13-suspects-12029869
[4] The Independent, "Romania arrests 13 over £47m UK tax refund fraud", July 11, 2020. [Online] Available: https://www.independent.co.uk/news/uk/home-news/romania-tax-refund-fraud-uk-investigation-a9593706.html
[5] HMRC, "HMRC takes action to protect customers after tax refund fraud", June 2025. [Online] Available: https://www.gov.uk/government/news/hmrc-takes-action-to-protect-customers-after-tax-refund-fraud
The ongoing operation, a collaboration between Romanian police, British authorities, EUROJUST, and HMRC, highlights the importance of technology in combating cybercrime, as a cybersecurity issue led to a sophisticated phishing scam defrauding the UK tax system. The stolen personal data and login credentials were used for hacking, fraud, and money laundering activities, resulting in the illegal acquisition of over £47 million from UK citizens.
This significant development in the field of general-news and crime-and-justice underscores the need for continuous efforts in enhancing cybersecurity measures to protect citizens' personal data and financial resources.
