Universal Credit claims 21. The government introduced UC in April 2013. It is one single benefit payment that is intended to gradually replace other means tested benefits, including tax credits. From January 2019, it was no longer possible to make a new tax credit claim and new claimants were directed to claim UC instead.
22. The legislation preventing new tax credit (TC) claims is set out in the various UC roll out commencement orders which bought into force different provisions of the Welfare Reform Act 2012.
23. Miss U is a single parent and was in receipt of TC. In May 2020, the DWP told HMRC that Miss U had made a claim for UC. HMRC ended her TC claim.
24. This happened because, in line with the UC Transition Regulations 2014, a claim for UC means that DWP will automatically issue a stop notice terminating entitlement to certain other benefits including TC. As such when HMRC receive notice from DWP to stop a customer’s TC claim because they have claimed UC, it is legally obliged to do so. Since DWP are responsible for any fraudulent claims to DWP, HMRC cannot reinstate a TC claim until DWP advise it to do so.
25. In May 2020, Miss U called the TC helpline to find out why HMRC had closed her TC claim. HMRC explained that this was because it appeared she had made a claim for UC. HMRC advised her to speak to DWP about the UC claim if she believed it had been made by a third party.
26. She called the TC helpline again at the end May 2020 to ask when her TC claim could be reinstated. HMRC told her to contact Action Fraud and the DWP. It said there was nothing it could do without permission from DWP to reinstate her TC claim.
27. Miss U says she called the TC helpline every week and HMRC could not tell her when or if it could reinstate her TC claim.
28. She complained to her MP, who wrote to both the DWP and HMRC in June 2020.
29. Around a week later, HMRC told Miss U that DWP had agreed it could reinstate TC payments. HMRC started paying manual payments from the end of June 2020.
30. In November 2020, another fraudulent UC claim was made in Miss U’s name. As before, on receipt of the UC claim, DWP instructed HMRC to end Miss U’s TC claim.
31. Miss U again called HMRC to ask for her TC claim to be reinstated and was advised again to talk to the DWP and Action Fraud.
32. Miss U contacted her MP immediately about what had happened, and they again contacted both HMRC and DWP. DWP subsequently told HMRC in December 2020 that it believed Miss U had been a victim of identity theft and this had resulted in the fraudulent UC claims. HMRC commenced manual tax credit payments again in mid-December 2020.
33. In April 2021, a third fraudulent UC claim was made in Miss U’s name. On this occasion, DWP did not contact HMRC to end her TC claim and HMRC continued to pay tax credits manually and there was no break in payment. DWP did not instruct HMRC to end the claim on this occasion because the manual payments did not show on Miss U’s records as a formal claim.
Self-assessment application 34. In January 2021, HMRC received an SA registration application in Miss U’s name but with a different address. HMRC created an SA record and this resulted in a change of address on Miss U’s records. She discovered this had happened in the same month from her HMRC mobile phone application.
35. Miss U contacted HMRC to query the change of address and initially could not pass security because of the discrepancy in addresses. HMRC insisted she had changed the address on her records and it could not do anything to help. She says the adviser finally agreed to look further into the matter, although initially HMRC retained the ‘new’ address on its system rather than changing it back to her actual address.
36. Between February and April 2021, HMRC received tax returns and repayment claims in Miss U’s name for the years 2017/2018, 2018/2019 and 2019/2020.
37. HMRC carried out security checks on the repayment claims. As part of the identity verification process, it sent a letter to Miss U in April 2021 which she did not receive. She suspects this is because the letter went to the fraudster’s address. Since HMRC did not receive a response, it locked down the SA record in June 2021.
38. HMRC sent a further letter to Miss U in November 2021 to verify her identity. She received this letter and telephoned HMRC in the same month. She told HMRC that she had never been self-employed and had not registered for SA. She explained that she had been a victim of identity theft in the past and she suspected the fraudulent SA application was related to what had happened before. HMRC asked her to confirm this in writing and she did so before the end of November 2021.
39. Miss U discussed this further with HMRC on the telephone in late November 2021 and explained she did not want to provide documentation to verify her identity due to the identify theft that had already taken place. HMRC told her she did not have to do anything else but wrote to her at the end of November 2021 to ask her again to confirm her address and identity.
40. Between March 2022 and January 2023, she contacted HMRC several times to discuss the fraudulent SA application. In November 2022 HMRC told her she would receive a call back before mid-December 2022 but this did not happen.
41. Miss U says HMRC sent two further letters in January 2023, again asking her to verify her identity. She responded to the second letter sent in January 2023 and HMRC asked her again to explain the situation in writing even though she had already done so. She wrote as requested in January 2023 and explained the situation again. HMRC wrote to her again in February 2023 asking for the information previously requested.
42. Her MP contacted DWP in May 2023. DWP looked again at the case and referred it to the Risk and Intelligence Service (RIS) for investigation. RIS is part of HMRC’s compliance team and looks at any information which potentially indicate non-compliance or fraud.
Value Added Tax registration 43. In late March 2022, HMRC received a VAT registration application in Miss U’s name. In April 2022, it sent her a letter advising her of the registration.
44. Miss U telephoned HMRC in April 2022 to say she had not set up the company and HMRC told her it would refer the matter to RIS for investigation.
45. Miss U also contacted HMRC in June 2022 and August 2022 and received five letters in total in April, June, July, and twice in August relating to the VAT registration. She says some of the letters thanked her for making changes to her VAT registration and she assumes these were in response to the person who had submitted the registration pretending to be her.
46. HMRC did not action the referral to RIS for investigation until November 2022. In the same month, RIS found that the relevant company was fraudulent. HMRC then closed the associated HMRC corporation tax records and deregistered the fraudulent VAT record.
47. In January 2023, HMRC wrote to Miss U and advised her about RIS’ decision. It said a fraudster had used her details to register a false limited company. It explained it had removed the fraudulent tax and VAT records from its systems. It also advised her to contact Companies House for help to remove her personal data from their records.
Complaint handling 48. In March 2023 Miss U complained about the ongoing delay to resolve the fraudulent SA application and the repeated requests for ID verification at tier one of HMRC’s complaint procedure. She did not receive a response.
49. Her MP contacted DWP in May 2023. DWP looked again at the case and referred it to a specialist team for further review. It appears HMRC did not contact Miss U about this so Miss U’s MP contacted the DWP again about the complaint. By this stage the complaint also included the delay in investigating the fraudulent VAT registration.
50. HMRC responded to Miss U’s complaint at the end July 2023 and offered an ex-gratia payment of £30 for the repeated requests for identify verification. In mid-August 2023, she responded saying she was not satisfied with the outcome. HMRC looked at her complaint at tier two of its complaint procedure and agreed to pay an additional £30 for the delay in responding to her complaint at tier one.
51. She complained to the Adjudicators Office (AO) in September 2023. AO responded on in February 2024. Its investigation found failings in HMRC’s management of the fraudulent VAT and SA applications. It recommended an additional £200 to recognise the emotional impact of the above maladministration upon her.
Help to save account 52. In August 2024, Miss U complained again to HMRC. The complaint concerned the fraudulent withdrawal of all her funds totalling £1500 from her HTS account. HTS is a type of savings account which some UC claimants can open with National Savings and Investments (NS&I).
53. Miss U discovered what had happened after she had tried to unsuccessfully log into the account to make a payment in August 2024. HMRC told her that account had been suspended because someone had tried to log into it. HMRC advised her to contact NS&I to find out how she could make a payment into the account. NS&I set up a new password for her and told her that there was a nil balance.
54. NS&I told her the name and account details of the person who had withdrawn the money. She referred the matter to Action Fraud on the advice of the police. Action Fraud is the UK national reporting centre for fraud and cybercrime. HMRC agreed to investigate what had happened in response to her complaint.
55. HMRC called her on 13 November 2024 to update her on her complaint. It told her that the preventative security measures placed on her other accounts did not extend to her HTS account. It subsequently added the additional security measures to block access to her HTS account. This would prevent withdrawals or any changes to her details. It also set up a password for her to use when she made any calls to the HTS helpline.
Personal tax account 56. In September 2024 Miss U complained again to HMRC. This was about changes HMRC had made to her personal tax account without her consent.
57. Earlier in the month, she received an email from HMRC saying her tax code had been changed. She says HMRC told her that this had happened because, according to her records, she had two new employees. She confirmed to HMRC that she did not have any employees. She also then discovered that her address and her child benefit bank details had been changed.
58. The Fraud Prevention Centre complaints team investigated this complaint and her complaint about her HTS account.
59. In January 2025, HMRC responded to both her complaints about HTS and her personal tax account.
60. It provided an explanation as to how the fraudulent activity on her HTS and personal account may have happened.
61. HMRC explained that the fraudsters had enough information about her to be able to set up a new Government Gateway (GG) username and password in her name. Once they had created new login details, they were then able to use these to access her online account, as if they were her. This allowed them to change her address, bank details for child benefit and access her HTS account.
62. The GG is an IT system developed to allow applicants to register for online services provided by the UK Government, including applications to HMRC services such as self-assessment. This replaced the old system of paper submissions.
63. HMRC says that to pass its identity verification checks to set up new GG credentials, the fraudster would have had access to multiple items of the following data sources including Miss U’s: • name, national insurance number or current address • driving licence details • passport details • credit reference information • details from tax data, such as tax deducted on a recent payslip
64. HMRC said that the fraudsters also used the personal information they held about Miss U, to add false pay and tax information to her records relating to employers she did not work for.
65. HMRC confirmed that it did not disclose any of the above personal information to the fraudster. It also explained that it is often not able to determine how a criminal has obtained personal details about someone since this can happen in a range of ways.
66. HMRC also explained what it had done to keep Miss U’s account more secure. It said that its specialist teams had identified and suspended the fraudulent GG credentials linked to her National Insurance number (NINO), which disabled them from further contact.
67. It also explained that recent changes to the GG system meant that GG login details can now only be linked to each NINO. This means that she will have sole access to her GG account and no further accounts can be created using her details.
68. HMRC said it had also looked at her personal tax account and: • removed any false employment and financial information on her tax record • removed any false repayment claims • checked that fraudster has not changed any other details.
69. HMRC paid Miss U: • £75 in recognition of the delay in responding to her complaint • £500 in recognition of the distress resulting from the fraudulent withdrawal from her HTS account • £1500 to refund the withdrawal from her HTS account.
70. Finally HMRC provided Miss U with detailed advice about actions she could take herself to protect her personal information. It: • suggested she regularly reviewed her credit reference information and provided information about the Credit Industry Fraud Avoidance System (CIFAS) • provided information about how to protect herself from any suspicious email, text messages or phone calls which may ask for confidential information • suggested she use strong passwords including a password manager and multi factor authentication • provided details of the National Cyber Security Centre and Action Fraud.
71. In January 2025, Miss U escalated the above complaint to tier two. She said she did not understand how a fraudster was able to access her account despite the extra security and asked HRMC to explain what it was doing to make sure her accounts stayed secure.
72. HMRC responded in February 2025. It referred to the points discussed in its first response and did not make any changes to the financial remedies already proposed.
73. In late February 2025 she referred her complaints about her HTS account and personal tax account to the AO. At this stage we agreed with the AO that it would be more proportionate and provide a better level of customer service to Miss U if we considered these two later complaints at the same time as the initial complaint.
74. This is because from discussion with HMRC, we recognised that Miss U’s main concern, in respect of all three complaints, is that HMRC has not taken sufficient steps to prevent any further fraudulent activity. She also believes that HMRC are likely responsible for the fraudulent activity since she has not had similar problems with any accounts outside HMRC.
Change of address on personal tax account 75. In March 2025, Miss U discovered that the address on her personal tax account had been changed without her consent.
76. She contacted HMRC to report the matter and asked for the address to be corrected. HMRC told her that someone had submitted a SA application in her name with a different address and this had resulted in the change.
77. On 5 March 2025, she complained that this had happened again despite all the assurances HMRC had previously given to her.
78. She received a response which explained what had happened. In February 2025, someone had attempted to use her personal details to register for SA using a paper application form. HMRC said when an application is made on paper, HMRC will process the form first and then investigate afterwards. This meant that her address was changed initially in line with the information on the paper form. However, the operator noted the additional security measures in place on Miss U’s records and sent an ID verification request to her to confirm that she had requested the changes.
79. HMRC confirmed it did not send any correspondence to the temporarily revised address and the fraudster had not been able to access Miss U’s online account. It also confirmed it had removed the incorrect address and checked that no other details had been changed. Finally, it had added additional notes to her account so that if it received any further requests for changes to the information on her account, HMRC would run these by their specialist team in the Fraud Prevention Centre.
80. HMRC again provided advice and signposting details related to keeping her personal information secure.