HMRC faces scrutiny over phishing scam and poor customer service

Note: This report will be added to once the transcript for the hearing has been published.

Phishing scam

It was reported on Gov.uk during the hearing that around 100,000 taxpayers’ Personal Tax Accounts had been locked down by HMRC after HMRC’s security systems had detected unauthorised access. Also during the hearing it emerged that HMRC’s phonelines had gone down. Committee chair Dame Meg Hillier was passed a note by an adviser alerting her to this and asked the HMRC officials what was going on.

Angela MacDonald, Deputy Chief Executive of HMRC, explained that criminals had tried to access identity information and “masquerade” as taxpayers, and had extracted £47 million at HMRC’s expense. She emphasised that the nature of this was “organised crime is not a cyber breach of HMRC” - it was phishing activity. Many customers, she added, had never created an online digital account and were unaware of the fraud until contacted.

HMRC's Chief Executive, John-Paul (JP) Marks, reiterated MacDonald’s comment, saying that compromised accounts had been locked down and taxpayers who are being contacted will suffer “no financial loss”. He stated: “It’s about 0.2 per cent of the PAYE population, around 100,000 people, who we have written to, are writing to, to notify them that we detected activity on their PAYE account”.

He told MPs that there had been a criminal investigation last year, some arrests were made and HMRC had then taken action to delete compromised accounts to protect customers.

MacDonald added that “what has been a challenge in terms of... cleaning the accounts up is being clear that we were then talking to the genuine customer and not in fact talking to the criminal who was on the other end of the account”.

She concluded that HMRC is working closely with the Information Commissioner and investing in systems to stay ahead of digital threats, saying: “every single organisation [is] facing some kind of cyber threat… it is a continuing piece of work for us to invest in our systems... to try to outpace the criminals”.

Hillier expressed disappointment that the committee had only heard about the scam when it was reported on Gov.uk, and said: “A word to the wise... let me use my position as chair just to remind you, gently – well perhaps not so gently – that it would be normal to advise parliament of things if you're appearing in front of a committee. Not to have it announced during the committee hearing”.

Marks told MPs that the telephony issue was unrelated to the phishing attacks. MacDonald confirmed that HMRC's phone lines were out of use on that day (Wednesday). She explained that it wasn’t that the lines themselves were down, rather that the system used by HMRC advisers to handle incoming calls had experienced an outage. “We've had a system outage, which means that, at the moment, we've had to close all our phone lines,” she stated, adding that the one exception was the phone line set up for recipients of the PAYE phishing fraud letter.

HMRC’s poor customer service

Lola McEvoy (Lab) expressed concern about HMRC’s customer service, highlighting delays and dropped calls that had left many taxpayers ‘enraged’. She cited a Public Accounts Committee (PAC) report revealing that 44,000 people were left on hold for 70 minutes before their calls were cut off.

In response, HMRC's Chief Executive acknowledged the frustration, saying: “We apologise, and that frustrates us as much as anyone, and we want to improve it”. He told MPs that the PAC report said that in 2024, 66% of calls were answered, but now it has moved up to 73%.

JP Marks brought up the issue of demand versus supply, adding that at the end of the last Spending Review, the team faced significant challenges - demand had risen sharply, while supply was constrained due to the funding settlement. He said HMRC needs to shift the channel, “enabling more people to self-serve through the app, making that as easy as possible, and then for those that do need to contact us, increasingly being able to get through”. He emphasised HMRC’s efforts to establish a new contact centre that would not have a cut off time and to reduce call wait times to 10–12 minutes.

Angela MacDonald, echoing Marks, highlighted that the number of individual taxpayers increased from 31.7 million in 2021 to 37 million in 2024/25, projected to reach 41.1 million by 2030. She explained that changes in thresholds on individual savings led to 3 million additional P800s being issued this year. The Deputy Chief Executive also emphasised the need to shift more services online, stating: “We need to make sure more and more people are doing things digitally… making sure, therefore, that the telephony system is available for those people who we don't have a service for, or who genuinely are digitally excluded”. She defended HMRC’s aim to discourage taxpayers able to interact digitally from trying to contact HMRC by phone.

MacDonald reported that the HMRC app now has 5.9 million unique users, a significant rise from the previous year, with increasing adoption by those over 65. She concluded that HMRC's ambition is to deliver service targets ‘fully’ on phones and post for 2025/26; however, “We are not funded for 100% service, and we're funded for a good service”, she said.

Winter fuel payment reclaim

Meg Hillier began the hearing by asking the officials about reports that the government were looking at means-testing the winter fuel payment using a charge similar to the High Income Child Benefit Charge to reclaim it from pensioners on higher incomes. Would HMRC be able to identify these taxpayers, she asked.

HMRC’s Director General, Customer Strategy and Tax Design, Jonathan Athow, told the committee that if HMRC were asked to do this (DWP would also be an option) they would aim to do it by linking it to the code of the highest earner in the household. He said HMRC had experience of working with DWP, in respect of Cost of Living Payments, to make sure people did not get paid twice. That had worked very successfully, he said.

Athow added that what had happened with child benefit showed that there is flexibility in the tax system, that it does not require self-assessment to levy such a reclaim charge.

How quickly could such a change be introduced, asked Hillier. It depends, said Athow. Pressed further he suggested it would be likely to take “several months” to implement such a change.

Athow explained how the timing of such a charge would be expected to work: “At the end of every tax year we do a reconciliation, so again you would need to have that reconciliation before you could take any action. So we would have to get to the end of the tax year, at which point a payment had been made, to understand people’s overall income, and if that was the basis for making decisions you would have to get to April next year before you knew somebody’s income or before we could then make any decisions about how that would then be implemented.”

Putting it through the tax code would be one option, he agreed.

Other areas

Other areas covered in the session included:

• HMRC's priorities for the next three to five years
• Business rate tax gap
• HMRC’s collection of taxes from wealthy individuals
• Exodus of non-doms following the recent changes
• HMRC’s delays in processing refunds 

Further reporting covering some of these areas will appear in next week’s review. The session can be viewed here. At the time of writing, a transcript has not been published, but when it is a link will appear here.