Skip to content
Romanian police officers enter a suspect's address
Romanian police raid a suspect's home

Press release —

Seven arrested in international cybercrime tax probe

  • Seven people have been arrested in Romania on suspicion of tax repayment fraud, linked to the phishing theft of data from UK tax professionals
  • HM Revenue and Customs (HMRC) joined Romanian National Police who led raids across Romania today
  • Investigators have linked fraudulent tax repayment claims in the UK to attacks on tax authorities in Ireland, Canada, Australia and New Zealand

Seven people have been arrested in Romania on suspicion of accessing computers and stealing data from UK tax professionals in order to make fraudulent tax repayment claims.

The six men and one woman, all Romanian nationals, were arrested earlier today in a joint HMRC operation led by the Romanian National Police’s Economic Crimes Directorate, with support from the Crown Prosecution Service. Twenty-one properties were also searched across Romania.

The seven, aged between 32 and 47 and from Oradea, Craiova, Pitești and Bucharest, are suspected of mounting sophisticated phishing attacks against UK-based tax professionals in order to steal their client data. This was used to submit fraudulent tax repayment claims to HMRC.

Today’s arrests are related to an attempted fraud against HMRC of almost £200m. The overwhelming majority of the suspected fraudulent claims were detected and blocked by HMRC systems.

The collaboration between Romanian authorities and HMRC, coordinated by the European Union Agency for Criminal Justice Cooperation (Eurojust) has also identified a wider organised crime network suspected of attacking tax authorities in Canada, Australia, Ireland and New Zealand.


Simon Grunwell, Operational Lead in HMRC’s Fraud Investigation Service, said:

“Our cybercrime teams work across borders to combat tax theft in all its forms, and this operation is another successful collaboration with our international partners in Romania.

“HMRC has acted to protect customer data and support tax accountants to better protect themselves from this type of attack. We encourage any business which has concerns to contact us. Suspicious activity happening in an HMRC account can be reported online.

“Our investigations are ongoing and we continue to work with other law enforcement agencies both in the UK and overseas to bring those responsible to justice.”

Footage of the arrest operation in Romania can be viewed here

Anyone with information about any type of tax fraud can report it online.

No UK taxpayer has suffered any direct loss as a result of these attacks.


Notes to Editors

1. We are unable to provide any more detail about today’s arrest operations.

  • Seven people were arrested in the Romanian cities of Craiova, Oradea, Pitești and Bucharest on suspicion of unauthorised access to a computer system, provided by Article 360 of the Criminal Code;
  • Computer fraud, provided by Article 249 of the Criminal Code;
  • Money laundering, provided by Article 49 para. 1 point a) of Law No. 129/2019.


2. A joint investigation team, supported by the European Union Agency for Criminal Justice Cooperation (Eurojust) has been established between Romanian and UK authorities, bringing together the Prosecutor's Office attached to the Court of Appeal in Bucharest, HMRC and the Crown Prosecution Service (CPS). This international partnership enables the swift investigation of serious cross-border crimes by pooling resources, expertise, and intelligence across jurisdictions.


3. We have taken action to contact affected accountants and tax agents and secure their accounts.


4. We continuously enhance our security measures to tackle evolving fraud tactics. At the Spending Review on 11 June 2025 the government announced further investments in the security of HMRC’s IT systems.


5. HMRC’s advice to prevent phishing attacks:


Protect
  • Criminals are cunning - protect your information
  • Take a moment to think before parting with your money or information
  • Use strong and different passwords on all your accounts so criminals are less able to target you

Recognise

  • If a phone call, text or email is suspicious or unexpected, don’t give out private information or reply, and don’t download attachments or click on links
  • Check on GOV.UK that the contact is genuinely from HMRC
  • Do not trust caller ID on phones. Numbers can be spoofed


Report

  • If you’re unsure about a text claiming to be from HMRC forward it to 60599, or an email to phishing@hmrc.gov.uk. Report a tax scam phone call on GOV.UK


6. Find out more about HMRC's approach to tax fraud here


7. Follow HMRC’s Press Office on X @HMRCpressoffice

Related links

Topics

Categories


Issued by HM Revenue & Customs Press Office

HM Revenue & Customs (HMRC) is the UK’s tax authority.

HMRC is responsible for making sure that the money is available to fund the UK’s public services and for helping families and individuals with targeted financial support.

Contacts

Related content

  • Two arrested for suspected £153 million TikTok tax scam

    Two men suspected of using TikTok in an alleged multi-million pound tax fraud have been arrested by HM Revenue and Customs (HMRC). Cybercrime investigators arrested the pair in East London after blocking £153 million of suspected fraudulent claims that are thought to have used personal tax details from TikTok users.

  • Fourteen arrested in phishing attack investigations

    14 people have been arrested on suspicion of using stolen data to steal millions of pounds of tax. HMRC officers joined Romanian police on raids which are linked to sophisticated phishing attacks.