Seven arrested in cross-border probe into attempted £200 million tax fraud
Romanian police and HMRC arrested seven people in a phishing investigation targeting tax professionals and repayment systems across several countries.
- Development
- 13 November 2026
- Coverage
- Breaking news
- Current status
- Developing case
- Source record
- 2 verified sources
The verified development
Romanian authorities arrested six men and one woman during searches in Bucharest and three other cities, according to HM Revenue & Customs. Investigators suspect the group used phishing attacks to obtain data from British tax professionals and then tried to submit fraudulent repayment claims. Twenty-one properties were searched during the coordinated action. This report attributes the claim to the named source and does not extend it beyond the public record. Where a person is accused rather than convicted, the presumption of innocence remains central. [1] [2]
What the available record shows
HMRC linked the operation to attempted fraud valued at nearly £200 million, while stressing that the overwhelming majority of suspect claims were detected and blocked. The investigation also identified suspected attacks involving tax authorities in Ireland, Canada, Australia and New Zealand. No direct loss to UK taxpayers was reported. Documents, images and public statements can establish a timeline, but each item still requires authentication and context. Independent corroboration matters most when an early account is incomplete or contested. [1] [2]
The legal meaning
Arrest on suspicion is not a conviction. Romanian prosecutors must connect individual suspects to specific computer access, fraud attempts or organised activity under the applicable law. The multinational nature of the inquiry means evidence may be held by tax agencies and service providers in several jurisdictions. Criminal charges, civil allegations, arrests, convictions and sentences describe different procedural stages. The language used here follows the stage actually documented rather than implying a result that has not occurred. [1] [2]
What investigators or courts still must resolve
Phishing against accountants can provide access to many clients at once, making professional accounts attractive targets. Investigators are likely to examine login records, devices, payment trails and the infrastructure used to submit claims. A headline estimate of attempted fraud should not be confused with money actually paid. A responsible follow-up should be tied to a filing, hearing, agency statement or independently verified fact. Unattributed social-media claims are not a substitute for evidence and are not included. [1] [2]
Why the next update matters
HMRC urged businesses to report suspicious activity and strengthen account security. The next reliable milestones will be charging decisions, court-authorised restraint of assets and a clearer accounting of attempted versus successful claims. Until then, the seven people remain suspects entitled to the presumption of innocence. The primary and reporting links below allow readers to inspect the underlying material. Corrections or later developments should be published transparently without changing the original event date. This account avoids claims that the available sources do not support, separates official allegations from independently established facts and identifies the procedural posture as it stands today. Readers should expect the record to develop through formal filings, evidence review and responses from affected people or organisations. Any later report must explain what changed, cite the new record and preserve the distinction between an allegation, an investigative conclusion and a judicial finding. That discipline matters because fast-moving crime and justice stories can otherwise harden preliminary claims into a misleading public narrative. [1] [2]
Sources & further reading
- Seven arrested in international cybercrime tax probe ↗HM Revenue & Customs · 2026-11-13 · Primary source
- International judicial cooperation against cyber-enabled tax fraud ↗Eurojust · 2026-11-13
Reader comments.
Keep it respectful and relevant to the report. No personal information, harassment or unsupported accusations. Comments are readers’ views.
Loading your sign-in status…