HMRC-branded phishing scams up 87% in 2020/21

The figures, obtained through a Freedom of Information (FOI) request by accountancy group Lanop Outsourcing, also show that reports of suspected SMS scams grew by 52% when compared to 2019/20, going from 67,497 to 102,562 attacks. Additionally, email scams surged by 109%, and reports of phone call scams increased by 66%.

Commenting on the data collected from the FOI request, email security company Tessian’s chief executive Tim Sadler, said: “Impersonating an authoritative organisation like HMRC is a tried and tested way for cybercriminals to create a sense of urgency and fear, in order to manipulate people into sharing financial information or credentials via phishing or smishing scams. And they’ve upped the ante, particularly over the past 12 months, in the hope that by sending more emails, more people might fall for their schemes.

“Sadly, spotting the scams isn’t always easy, and hackers are making them even harder to detect.”

Lanop Outsourcing analysed the amount of scams reported between 2018/19 and 2020/21. Of those listed, the majority were tax rebate or refund scams which rose by 90%, with voice scam attacks rising by 66%.

HMRC also received reports for the Driver and Vehicle Licensing Agency and acted on its behalf to initiate website takedowns. In the 2019/20 financial year there were 5,549 reports, whereas there were 42,233 reports in 2020/21 – an increase of 661%.

Andy Harcup, a senior director and cyber expert at IT security company Gigamon, said: “All it takes is a single employee to unwittingly handover confidential passwords and user details and cyber criminals are free to enter and wreak havoc across the network.

“The fact is that companies cannot neutralise these attacks without full visibility into network traffic and getting complete visibility into potential hostile threats. The days of allowing security blind spots to remain unchecked are over and getting a complete view of what’s happening and when should now be the new normal in terms of security protocol.”