HMRC snares website scammer 6,500 miles away

Cybercrime experts at HM Revenue and Customs (HMRC) have helped bring down a prolific fraudster who sold scamming software to criminals across the world.

HMRC worked with Indonesian cybercrime police to track down and arrest the 36-year-old in a remote village – a 12-hour drive from the capital of North Sumatra.

He now faces up to 12 years in prison for selling website phishing kits that targeted UK taxpayers.

He posted more than 3,000 adverts in just a year, promoting the illegal spoofing software on social media channels and crime forums for up to $250 each.

The software mimicked genuine webpages of major international business and institutions – including global banks, tax authorities and Government webpages in the UK, Canada, United States and Australia.

As well as HMRC, he also sold software that mimicked the websites of other UK-based organisations, including the Royal Mail and TV Licensing.

HMRC launched an investigation earlier this year and worked alongside international partners, including the Indonesian National Police (INP), the Royal Canadian Mounted Police (RCMP), the Federal Bureau of Investigation (FBI) and the Australian Federal Police (AFP).

Simon Grunwell, Operational Lead in HMRC’s Fraud Investigation Service’s Cybercrime Team, said:

“This case shows that we can and do work across borders and with international law enforcement partners to combat tax crime in all its forms to make the world a smaller place for criminals like this.

“HMRC is one of the most spoofed organisations in the UK and we are doing all we can to protect the taxpayer from criminal attack, even if that attack is launched from the other side of the world. This case should show to others involved in fraud that we can and will find you.

“Our expert teams use various tools to detect phishing scammers and we are grateful for support from police in Indonesia who helped locate and arrest the suspect in this case. We also received vital support from partners in Canada, the US and Australia.

“We continue to urge taxpayers to be aware that scammers often pose as HMRC. If someone contacts you saying they’re from HMRC and asks you to give personal information or urgently transfer money, be on your guard. Search ‘HMRC scams’ advice on GOV.UK to find out how to report scams and help us fight these crimes.”

A spokesperson for the Royal Canadian Mounted Police said:

“The suspect, identified with the aid of the Royal Canadian Mounted Police’s (RCMP) Cybercrime Investigation Team in Ottawa, targeted the Canada Revenue Agency along with other Canadian businesses and financial institutions.

“The RCMP continue to foster international relationships in order to better address the borderless nature of cybercrime and cybercriminals across the globe.

“This file illustrates the strengthening of international cooperation to detect, disrupt and deter illegal cyber activities that threatens Canada's integrity, economy and reputation.”

HMRC investigators travelled to Jakarta earlier this year and they returned to the country last month to meet with Superintendent Ardian Satrio Utomo, the Chief of Cybercrime Sub Directorate Polda Metro Jaya, and to recover intelligence following the arrest. A Bitcoin wallet was seized along with electronic devices.

Anyone with information about any type of tax fraud can report it to HMRC by calling the Fraud Hotline on 0800 788 887.

Visit GOV.UK for information on how to report a scam or suspicious activity.

Notes to Editors

• A 36-year-old man was arrested by Unit 1 of the Indonesian National Police (INO) Cybercrime Sub Directorate Polda Metro Jaya on 3 September 2023 in collaboration with HMRC, the Royal Canadian Mounted Police (RCMP), the Federal Bureau of Investigation (FBI) and the Australian Federal Police (AFP). He is facing up to 12 years in prison.
• Phishing kits are a readymade collection of tools, scripts and web pages designed to mimic a legitimate site. The sale of phishing kits allows fraudsters to launch phishing campaigns against unsuspecting customers.
• According to the National Cyber Security Centre, HMRC was the third most spoofed government body in 2022, behind the NHS and TV Licensing. You can Avoid and report internet scams and phishing

In the last year October 2022 – September 2023 HMRC has:

• responded to 183,874 referrals from the public of suspicious contact; 58,389 of these offered bogus tax rebates
• worked with the telecoms industry and Ofcom to remove 342 phone numbers being used to commit HMRC-related phone scams responded to 60,859 reports of phone scams in total, up 6% up on the previous year. (In April 2020 we received reports of only 425 phone scams. In September 2023 this had risen to 5,449.)
• reported 25,933 malicious web pages for takedown.
  

HMRC’s advice:

Protect

criminals are cunning - protect your information

take a moment to think before parting with your money or information

use strong and different passwords on all your accounts so criminals are less able to target you

Recognise

if a phone call, text or email is suspicious or unexpected, don’t give out private information or reply, and don’t download attachments or click on links

check on GOV.UK that the contact is genuinely from HMRC

do not trust caller ID on phones. Numbers can be spoofed

Report

if you’re unsure about a text claiming to be from HMRC forward it to 60599, or an email to phishing@hmrc.gov.uk. Report a tax scam phone call on GOV.UK

contact your bank immediately if you’ve had money stolen, and report it to Action Fraud. In Scotland, contact the police on 101

by reporting phishing emails, you help stop criminal activity and prevent other people falling victim

• Find out more about HMRC's approach to tax fraud at GOV.uk.
• As well as our work with international partners in this case, HMRC is also a founding member of the J5, which includes tax authorities from Australia, US, Canada and the Netherlands. The operational alliance is dedicated to tackling transnational tax crime and money laundering.
• Interviews with Simon Grunwell are available on request.
• Follow HMRC’s Press Office on Twitter @HMRCpressoffice.