HMRC blocks £153m and arrests two over alleged TikTok tax repayment fraud

HMRC says its cybercrime unit stopped £153 million in suspected fraudulent claims thought to have relied on tax details harvested from TikTok users.

What HMRC announced

HM Revenue and Customs has arrested two men suspected of running a multi-million pound tax fraud through TikTok. According to the department, cybercrime investigators detained the pair in east London after blocking £153 million of suspected fraudulent claims believed to have used personal tax details taken from TikTok users.

The men, both in their twenties and Romanian nationals, are accused of using the platform to talk taxpayers into handing over the login details for their tax accounts, with the lure of a financial reward in return. HMRC's notes to editors confirm the suspects are aged 22 and 25, that they were arrested at addresses in the Newham area of London on 23 April 2026, and that both were later released on bail while the investigation continues.

How the alleged scheme worked

The mechanics HMRC describes are simple but effective. Criminals use social media to find people willing to share their personal or sign-in details, then use those credentials to submit tax repayment claims in the victim's name. Because the fraudster operates behind someone else's identity, it is usually the victim, rather than the criminal, who is left owing money to HMRC.

The posts tend to follow a recognisable script, promising "risk free" rewards and often sliding into direct messages to draw people in. HMRC notes it has seen similar suspected scams across other platforms, including Instagram and Snapchat, rather than TikTok alone. Anyone who shares their details, the department warns, risks identity theft, a frozen bank account, and liability to repay the money or even face prosecution themselves.

The offences under investigation

The suspects were arrested on suspicion of a spread of offences that illustrates how these schemes are assembled rather than run by a lone actor. According to HMRC, they were held on suspicion of fraud by false representation, under section 2 of the Fraud Act 2006; encouraging or assisting the commission of offences, under section 46 of the Serious Crime Act 2007; unauthorised access with intent, under section 2 of the Computer Misuse Act 1990; and money laundering offences under sections 327 to 329 of the Proceeds of Crime Act 2002.

That combination of deception, recruitment, computer misuse and the handling of proceeds reflects the structure of modern repayment fraud, which depends on persuading real taxpayers to volunteer their own credentials.

What HMRC is telling taxpayers

Simon Grunwell, Head of Cybercrime Investigations at HMRC's Fraud Investigation Service, urged people to guard their tax credentials as carefully as their banking details. He said claims of quick, risk-free cash in exchange for personal information are a scam designed to defraud both the individual and the taxpayer, and encouraged anyone approached in this way to think twice and report it on GOV.UK.

HMRC also reminded the public that it will never use social media to offer a tax rebate or to ask for personal or payment information. Suspicious accounts and messages can be reported to the department's security team, and anyone with information about tax fraud can report it through GOV.UK.

Implications

The number HMRC leads with is the £153 million it says it stopped, not lost, and that distinction matters. It points to a tax authority trying to intercept repayment fraud before money leaves the building rather than chasing it afterwards, with cybercrime specialists increasingly at the centre of that effort.

For businesses and individuals, the case is a reminder that the weakest link in tax security is usually a person rather than a system. Anyone who handles tax logins, whether their own or, for employers and agents, those tied to staff and clients, should treat an unsolicited offer of "free" money as a red flag by default. It is also worth keeping the legal status in view: these are arrests, not convictions, the suspects have been released on bail, and the allegations remain to be tested.