HMRC faces scrutiny over phishing scam and poor customer service

Phishing scam

It was reported on Gov.uk during the hearing that around 100,000 taxpayers’ Personal Tax Accounts had been locked down by HMRC after HMRC’s security systems had detected unauthorised access. Also during the hearing it emerged that HMRC’s phonelines had gone down. Committee chair Dame Meg Hillier was passed a note by an adviser alerting her to this and asked the HMRC officials what was going on.

Angela MacDonald, Deputy Chief Executive of HMRC, explained that criminals had tried to access identity information and “masquerade” as taxpayers, and had extracted £47 million at HMRC’s expense. She emphasised that the nature of this was “organised crime is not a cyber breach of HMRC” - it was phishing activity. Many customers, she added, had never created an online digital account and were unaware of the fraud until contacted.

HMRC's Chief Executive, John-Paul (JP) Marks, reiterated MacDonald’s comment, saying that compromised accounts had been locked down and taxpayers who are being contacted will suffer “no financial loss”. He stated: “It’s about 0.2 per cent of the PAYE population, around 100,000 people, who we have written to, are writing to, to notify them that we detected activity on their PAYE account”.

He told MPs that there had been a criminal investigation last year, some arrests were made and HMRC had then taken action to delete compromised accounts to protect customers.

MacDonald added that “what has been a challenge in terms of... cleaning the accounts up is being clear that we were then talking to the genuine customer and not in fact talking to the criminal who was on the other end of the account”.

She concluded that HMRC is working closely with the Information Commissioner and investing in systems to stay ahead of digital threats, saying: “every single organisation [is] facing some kind of cyber threat… it is a continuing piece of work for us to invest in our systems... to try to outpace the criminals”.

Hillier expressed disappointment that the committee had only heard about the scam when it was reported on Gov.uk, and said: “A word to the wise... let me use my position as chair just to remind you, gently – well perhaps not so gently – that it would be normal to advise parliament of things if you're appearing in front of a committee. Not to have it announced during the committee hearing”.

Marks told MPs that the telephony issue was unrelated to the phishing attacks. MacDonald confirmed that HMRC's phone lines were out of use on that day (Wednesday). She explained that it wasn’t that the lines themselves were down, rather that the system used by HMRC advisers to handle incoming calls had experienced an outage. “We've had a system outage, which means that, at the moment, we've had to close all our phone lines,” she stated, adding that the one exception was the phone line set up for recipients of the PAYE phishing fraud letter.

HMRC’s poor customer service

Lola McEvoy (Lab) expressed concern about HMRC’s customer service, highlighting delays and dropped calls that had left many taxpayers ‘enraged’. She cited a Public Accounts Committee (PAC) report revealing that 44,000 people were left on hold for 70 minutes before their calls were cut off.

In response, HMRC's Chief Executive acknowledged the frustration, saying: “We apologise, and that frustrates us as much as anyone, and we want to improve it”. He told MPs that the PAC report said that in 2024, 66% of calls were answered, but now it has moved up to 73%.

JP Marks brought up the issue of demand versus supply, adding that at the end of the last Spending Review, the team faced significant challenges - demand had risen sharply, while supply was constrained due to the funding settlement. He said HMRC needs to shift the channel, “enabling more people to self-serve through the app, making that as easy as possible, and then for those that do need to contact us, increasingly being able to get through”. He emphasised HMRC’s efforts to establish a new contact centre that would not have a cut off time and to reduce call wait times to 10–12 minutes.

Angela MacDonald, echoing Marks, highlighted that the number of individual taxpayers increased from 31.7 million in 2021 to 37 million in 2024/25, projected to reach 41.1 million by 2030. She explained that changes in thresholds on individual savings led to 3 million additional P800s being issued this year. The Deputy Chief Executive also emphasised the need to shift more services online, stating: “We need to make sure more and more people are doing things digitally… making sure, therefore, that the telephony system is available for those people who we don't have a service for, or who genuinely are digitally excluded”. She defended HMRC’s aim to discourage taxpayers able to interact digitally from trying to contact HMRC by phone.

MacDonald reported that the HMRC app now has 5.9 million unique users, a significant rise from the previous year, with increasing adoption by those over 65. She concluded that HMRC's ambition is to deliver service targets ‘fully’ on phones and post for 2025/26; however, “We are not funded for 100% service, and we're funded for a good service”, she said.

Winter fuel payment reclaim

Meg Hillier began the hearing by asking the officials about reports that the government were looking at means-testing the winter fuel payment using a charge similar to the High Income Child Benefit Charge to reclaim it from pensioners on higher incomes. Would HMRC be able to identify these taxpayers, she asked.

HMRC’s Director General, Customer Strategy and Tax Design, Jonathan Athow, told the committee that if HMRC were asked to do this (DWP would also be an option) they would aim to do it by linking it to the code of the highest earner in the household. He said HMRC had experience of working with DWP, in respect of Cost of Living Payments, to make sure people did not get paid twice. That had worked very successfully, he said.

Athow added that what had happened with child benefit showed that there is flexibility in the tax system, that it does not require self-assessment to levy such a reclaim charge.

How quickly could such a change be introduced, asked Hillier. It depends, said Athow. Pressed further he suggested it would be likely to take “several months” to implement such a change.

Athow explained how the timing of such a charge would be expected to work: “At the end of every tax year we do a reconciliation, so again you would need to have that reconciliation before you could take any action. So we would have to get to the end of the tax year, at which point a payment had been made, to understand people’s overall income, and if that was the basis for making decisions you would have to get to April next year before you knew somebody’s income or before we could then make any decisions about how that would then be implemented.”

Putting it through the tax code would be one option, he agreed.

HMRC's Chief Executive priorities

Dame Meg Hillier asked HMRC’s Chief Executive what his top priorities are for the next three to five years.

JP Marks identified reducing fraud and error, closing the tax gap and improving service level and transparency as key areas. He continued that there are also ongoing efforts to combat threats like PAYE fraud, adding that HMRC will shortly launch a transformation roadmap to upgrade systems and cyber-resilience.

The chair asked what the areas are that Marks thinks he needs to learn more about as someone who has come from the wider civil service and is heading up a very technical organisation.

Marks responded that, as permanent secretary to the Scottish government, he has been “working with HMRC on and off for 20 years doing income tax reform in Scotland, leading and delivering universal credit, tax credit migration and the implementation of real-time earnings”. He acknowledged the complexity of the tax system and said that HMRC have a very strong board, and have people such as Bill Dodwell (a board member) and Paul Aplin (an independent adviser to the board’s Closing the Tax Gap Committee) joining them.

Tax gap and HMRC modernisation

Rachel Blake (Lab) asked about the timeline for returns on new compliance staff, saying “you estimated that you would bring in an additional £45 million as a result of investing in additional HMRC debt management capacity to increase the collection of overdue tax debt. Have you achieved that within the quarter?”

JP Marks replied positively, saying, “To date, we are on track with them”. Penny Ciniewicz, HMRC Director General for Compliance, explained that HMRC are recruiting 5,500 people over the spending review period, and 500 have already joined the authority.

Blake questioned why the hiring of 500 new tax compliance staff wouldn’t show significant financial returns until 2026–27. Ciniewicz said that these compliance officers do not become “really productive” until later in the training programme. Marks reiterated that the delay is due to the time required for training and consolidating the new recruits.

On HMRC IT modernisation, Dame Meg Hillier asked about progress and confidence in delivering major IT transformation programmes, saying that “government IT projects are fraught with failures”. Marks acknowledged the size and risk of the transformation but expressed confidence. He continued that HMRC want to accelerate their digital reform and are seeking additional Treasury support to move faster.

Wealthy individuals and compliance

Dr Jeevun Sandher (Lab) asked why HMRC find it difficult to collect taxes from the wealthy, noting that the tax gap for wealthy individuals is estimated at about £2 billion in 2022-23.

Penny Ciniewicz responded that HMRC’s compliance team collected £5.2 billion from wealthy individuals in the last year for which figures were available, up from £2.2 billion in 2019–20, emphasising that HMRC are “very focused on the wealthy tax gap”. She continued that 400 new staff are being recruited to focus on offshore risks, adding: “We are going to continue to build that not just in terms of civil work but in the criminal work, where we are going to be expanding the number of positive charging decisions”.

Sandher asked about the importance of having specialised knowledge within HMRC to get the right tax from those individuals. Ciniewicz considered this expertise “incredibly important”, highlighting that HMRC use a whole range of teams and international data to track complex assets and trusts.

Yuan Yang (Lab) asked about HMRC’s definition of wealth and said HMRC call affluent individuals with an income of over £200,000 a year or assets greater than £2 million, and then high-net-worth individuals are those with assets over £10 million and above. “Are those figures for wealth gross or net,” she asked.

JP Marks explained that definitions are based on gross income, and the number of wealthy individuals was increased from 700,000 to 850,000 in 2023-24.

Yang cited the National Audit Office (NAO) recommendation that there should be an impact assessment of merging the affluent individuals and high-net-worth individuals units into one big unit called the wealthy unit, and asked what HMRC’s view is on that.

Marks stated: “One of the points that the NAO was making was whether we should be targeting based on high net worth and income and whether we have diluted our focus somehow by merging the teams. I have stepped through that with Penny and the team. I do not think that is the case”.

The HMRC Chief Executive continued that the majority of case managers still target high-risk individuals, with Ciniewicz adding, “Over 70% of the yield that we took in my wealthy directorate in 2023-24 came from those customer compliance-managed cases. We are really putting a focus on that complexity and risk.”

Bobby Dean (Lib Dem) asked whether tax compliance efforts should focus more on the wealthiest individuals, suggesting that those with over £10 million in wealth are likely to present greater opportunities to close the tax gap. He believed that it would be logical to prioritise resources toward this upper tier, rather than waiting for signs of non-compliance.

Marks reiterated that targeting is based on a risk model, where income is one factor among others. He stated that if a billionaire presents a tax compliance risk, they would be included in compliance activities.

Furthermore, Dean said, given that HMRC have a good understanding of wealthy taxpayers, does this undermine claims that a wealth tax is unfeasible due to data limitations.

Ciniewicz responded that HMRC understand “taxable wealth”, but not total wealth, as individuals aren’t required to declare all assets unless there’s a taxable event. She acknowledged data gaps—particularly for offshore and non-financial assets—but said that HMRC receive financial asset data through international agreements and are working to expand this to include crypto and other asset types.

Asked if HMRC need more powers, Ciniewicz believed that the issue is less about legal powers and more about the complexity of obtaining and exchanging such data internationally.

Non-doms

Yuan Yang asked about the impact of non-dom reforms, suggesting that it has been difficult to find any data on the outflows of people emigrating or moving their assets. JP Marks reported that data to scrutinise this issue won’t be available until 2027 tax returns are filed. He continued that the Office for Budget Responsibility has factored in a 12–25% behavioural response in its forecasts.

Jonathan Athow, HMRC’s Director General, Customer Strategy and Tax Design, explained that the non-dom population is quite mobile, making real-time tracking difficult. He said that last year, before the changes were announced, HMRC had data indicating that 12,900 non-doms moved into the UK and around 8,900 moved out.

R&D and CIS

Chris Coghlan (Lib Dem) expressed concerns about refund delays under the Construction Industry Scheme, suggesting that it has caused “very serious cash flow issues” for some businesses.

Angela MacDonald said that 93% of self-assessment refunds are processed quickly, but fraud checks delay others. She continued that “the process of extracting repayments is a prime target for criminals”, and the challenge is that there are a lot of genuine customers making genuine repayments who get caught up in that. It is not a resourcing issue, she said.

On R&D tax credits, Coghlan asked if there is a risk that issues with refunds could act as a disincentive to investment.  JP Marks said that the total number of R&D tax credit claims is still ‘healthy’, and whilst additional checks have been made, “some 85% of the claims are being processed within 40 days”. Jonathan Athow emphasised that HMRC has put in place new measures, including advance clearances, which aim to balance fraud prevention with business certainty.

Meg Hillier raised concerns about HMRC's understanding of R&D tax credits in niche sectors like craft brewing, suggesting a disconnect between tax officials and businesses. Athow acknowledged this and said HMRC is recruiting external experts to support the technical side of R&D assessments.

John Glen (Con) suggested that there are practical challenges with the R&D tax credit process, including a lack of accessible phone support and concerns over how claims are sampled.

Penny Ciniewicz responded by emphasising HMRC’s efforts to improve the system, such as increasing transparency and communication with claimants, and growing the R&D compliance team to 500 people.

The session can be viewed here. 

A transcript is available here.