Scammers stole £47m from the online accounts of 100,000 people through posing as taxpayers, HMRC has revealed.
The tax authority said it is writing to those affected to confirm it has secured their accounts and that they haven’t lost any money.
“These are attempts to claim money fraudulently from HMRC, not from customers,” HMRC said.
The has already been a criminal investigation with arrests made last year, HMRC confirmed.
It said the scammers used phishing attacks to gain customer details and attempted to claim rebates.
Phishing is when criminals use personal information gathered externally to imitate a person and access services.
The tax authority said this was not a cyber or hacking attack, the likes of which have affected major retailers in recent weeks.
Angela MacDonald, HMRC’s deputy chief executive, told MPs at an evidence hearing that a “lot of money” was taken and “it’s very unacceptable”.
The committee from several HMRC members and was told that “a lot of work [was] then done to intercept this incident. We identified and locked down the compromised accounts.”
HMRC’s representatives were reprimanded by MPs for not writing to the Treasury Committee about the fraud at the time.
The BBC understands that the government will be making further investments in the HMRC IT systems at next week’s spending review.
