Self Assessment Account Hacked

Sarahjovi

Hi, I received a letter from the HMRC today telling me that I would be receiving a Tax rebate of over £4600. However, I haven't applied for a refund and I haven't filed my tax return yet.

I immediately telephoned the Self Assessment office and whilst hanging on I checked my Self Assessment Account and found that a tax return has been filed for 13-14 for far more than I earn and a refund has been issued and that my bank account details have been changed.

Whilst speaking to the advisor I suggested that this must happen quite often, and she said no not often and suggested my PC must have been hacked. I have obviously checked my bank accounts etc., and everything appears OK.

I am just concerned now as the Self Assessment advisor said someone would contact me to let me know what steps to take next , but this wouldn't happen now until after the Bank holiday weekend.

Can anyone advise me as to the consequences of all this. Obviously I will need to file my own return at some point.

I think I just need my mind putting at rest, if anyone can help?

Many thanks

Sarah:eek:

purdyoaten

I have been dealing with Self assessment since its inception in 1997 and have never come across this - scam 'you are entitled to a refund' e-mails but not the actual tampering with a self-assessment account. Worrying, not least because your UTR has a return filed against it!

System

If the return was filed online then yes your record has been hijacked.
If it has been filed on paper then it is possible that either the person submitting the return has made an error (deliberate or otherwise) recording their UTR on the form OR whoever processed the return at HMRC has made an error.
If it is the latter it is relatively simple for HMRC to get the form from storage and correct the error.
Either way following your call HMRC will investigate and stop the issue of the refund. It wouldn't do any harm to follow up your call with a letter.

hopelesswithmoney_2

Yes just had exactly the same thing happen on my account. HMRC were very unhelpful to say the least, when I tried to report.
I am really worried that I will be liable for the fraud payment and could spend years now trying to re-establish my tax records.
Can anyone help?

I think this is something people are not aware of and could cause major problems in the future.

OhReally_2

Amazing

Whenever I log onto the HMRC website the very first page I see is

Security message

For your information: You last logged in at the HM Revenue & Customs (HMRC) portal on [date] at [time].
Please check the HMRC Reporting online security issues page if this is not the last time you logged in.


Have you taken steps to protect yourself from online fraud?

Criminals are using increasingly sophisticated ways to commit online fraud and it is important that you do everything you can to protect yourself.

Please take some time to read the security advice on the HMRC Online security page to find out how you can do this and for details of the steps HMRC is taking to protect your information.

Please click the 'Next' button to continue.

Am I the only one who gets this security message?

Or perhaps the only one who bothers to read and digest it?

:cool:

chrismac1

In fact HMRC are pretty lax on security amongst most other things. I've had one mixed records case - where two unconnected taxpayers with exactly the same surname living 200 miles apart had their UTRs mixed up by HMRC.

It took a year of letters and threats to go to the Tribunal to get HMRC to admit that they had made a blunder, and that the threats they were making to bankrupt my client concerned the tax bill of someone completely different.

I have lots of standing orders and direct payments set up with my bank. Whenever I set up a new one, I get a text message saying "Your standing order / payment details have been changed. Please contact the bank immediately if it was not you who did it?"

How hard can that be HMRC? Proactive management of security, rather than the reactive style currently adopted and referred to by the previous poster?

My advice is to ask for chapter and verse on how this change came about, and the bank account details the payment went to. Make them aware that in your view if this bank account was not controlled by them, this is a reportable event into under their Anti-Moneylaundering (ML) regulations.

Believe it or not, HMRC is actually one of the major anti-ML supervisory bodies in the UK. If they should continue to prove awkward, threaten to ask for every piece of information they hold about you under the Data Protection Act. Threaten to write to your MP, to Danny Alexander, whatever.

It is utterly outrageous that they should take this contemptuous and ignorant attitude to this sort of thing, when they are actually regulating it and charging the regulated for the privelidge.

usignuolo

As the money is paid into a bank account then a valid bank account must have been set up for this fake claimant. One wonders what proof of identity the bank required?. My OH and (separately) another friend have both tried to open small business accounts at Lloyds recently and given up due to the run around.

And I think it is pretty hard to set up a valid bank account at any bank without appearing in person at the bank with your passport and proof you live where you say, just for starters.

Yet if you look up similar tales on the internet of this happening to other people there are quite a few. It seems to be targeted at clients of accountants. You start to wonder if this is an altogether more complex scam with some "inside" help.

http://www.tax-hell.co.uk/tax-rebates-stolen-by-revenue-and-customs-hackers-from-todays-sunday-times/

zygurat789

usignuolo wrote: »

As the money is paid into a bank account then a valid bank account must have been set up for this fake claimant. One wonders what proof of identity the bank required?. My OH and (separately) another friend have both tried to open small business accounts at Lloyds recently and given up due to the run around.

And I think it is pretty hard to set up a valid bank account at any bank without appearing in person at the bank with your passport and proof you live where you say, just for starters.

Yet if you look up similar tales on the internet of this happening to other people there are quite a few. It seems to be targeted at clients of accountants. You start to wonder if this is an altogether more complex scam with some "inside" help.

http://www.tax-hell.co.uk/tax-rebates-stolen-by-revenue-and-customs-hackers-from-todays-sunday-times/

That's a fairly derogatory assumption based on no facts and a bit of circumstantil.
If HMRC can be hacked then surelty the same could apply to accountants.

N_the_Beancounter

[QUOTE
Yet if you look up similar tales on the internet of this happening to other people there are quite a few. It seems to be targeted at clients of accountants. You start to wonder if this is an altogether more complex scam with some "inside" help.[/QUOTE]



I have certainly started to wonder the same thing.... and that is based on my personal experience as a tax agent whose clients have had fraudulent returns filed on their (or my) behalf. I am confident that my own security is good enough - the password has never been written down anywhere, and I have no evidence of my anti-virus software failing at any time. However, it could simply be that HRMC's systems are relatively easy to hack into, and no inside help is required.


As for the bank accounts, it is easy enough for fraudsters to open an account, claim and receive the refund, and promptly close the account again - I am sure that HMRC just pay using the sort code and account number provided without asking the bank to check the name beforehand.

sheramber

As the repayment would be an electronic payment the computer only checks the sort code and account number.

However, the repayment authority on the tax return does ask for the account holders name. But that need not be the taxpayer's name. They could authorise payment to someone else's account.

Spidernick

Anyone remembers years ago the scam of people setting up accounts in the name of 'Inland Revenue' (or very similar) and then intercepting and cashing cheques to the Revenue? The banks were forced to pay for these on the basis that they should have realised people didn't have names like that!