HM Revenue and Customs, the U.K.'s tax authority, was warned about the flaw more than six months ago. However, it only closed the tax credit Web portal down last week after it discovered criminals had used the identities of 1,500 government employees at the Department of Work and Pensions to make fraudulent claims.
The tax credit Web site handles around half-a-million transactions a year. The criminals were able to change claim details and redirect the money into their own bank accounts by getting ahold of a genuine claimant's name, date of birth and National Insurance number, which is the U.K. version of a Social Security number.
The fraud involving innocent staff at the Department of Work and Pensions only came to light during compliance checks by HM Revenue and Customs. British lawmakers were told that the tax credit Web site has been hit by more than 30 million pounds, or about $52 million, in fraudulent claims.
The police have now been called in, and a representative for the tax agency declined to comment further while the criminal investigation is going on. However, the representative said the tax credit Web site will remain down until the review of its security is completed.
David Laws, the Work and Pensions secretary for the Liberal Democratic party, slammed the Labor government and said ministers must make a statement as to why they took so long to take action to stop the fraud. "This complicated and chaotic system is wide open to fraud," he said. "Ministers have known for some time that organized criminals were using the Internet to defraud the system."
The debacle is yet another embarrassment for the U.K. government's flagship tax credits program, which has suffered from problems since it was launched in 2003. Much of that has been due to an IT system described as a "nightmare" by British lawmakers. EDS, for example, was last month forced to shell out 71 million pounds, or about $123.5 million, to HM Revenue and Customs to settle a dispute over problems with the tax credits IT system.
Andy McCue of Silicon.com reported from London.