Fraudulent attacks on HM Revenue & Customs by organised criminals have proven to be an expensive and embarrassing problem.

Tax credit fraud and VAT carousel fraud have been the major trouble areas, but as if that were not enough, the taxman has revealed that a new fraud threat has emerged in the most unexpected area – self-assessment.

In its report on HMRC’s accounts for 2006/07, the National Audit Office revealed that the department had uncovered evidence of criminals attacking the self-assessment system and defrauding the government coffers of millions.

The revelations shocked advisers. PricewaterhouseCoopers partner John Whiting described the situation as ‘bizarre’ and Patrick Stevens, a tax partner at Ernst & Young said the fraud was a ‘strange one’.

Both advisers expressed surprise that self-assessment should be vulnerable to this kind of skulduggery, as the filing of self-assessment returns was a far simpler process, than say managing VAT, which because of its complexity and the number of people involved, was more vulnerable to criminal attack.

HMRC told the NAO that the fraud attacks involved the filing of unsolicited self-assessment returns that made claims for tax repayments.

So what is going on? Are we seeing the beginning of another scam that could reach the proportions of carousel fraud, or is this simply a case of systems not matching up to basic security requirements?

Comments from the NAO suggested the latter. In its report the government watchdog said: ‘A lack of formalised accountabilities has historically made it difficult for the department to establish central oversight and responsibility over repayments, including the extent to which agreed controls were being operated. Deficiencies in management information have also made it difficult to establish the degree to which these controls could prevent or detect error and irregularities.’

Steven voiced similar concerns: ‘It struck me that there must be a problem with the IT system. It should be simple enough to check that tax has actually been paid before making a repayment.’

But even if there are weaknesses in systems, there does appear to be a concern that the problem runs deeper than that. The NAO report said there had been ‘one particularly virulent example which involved 50 purported tax agents, 14,000 false self-assessment returns and potentially £34m in false repayments’.

Those figures suggest that there are organised and aggressive criminals structuring the self-assessment frauds, rather than a ragged bunch of amateurs who have managed to take advantage of IT weaknesses.

HMRC would not disclose the scale or nature of the self-assessment fraud, but did say that it was reviewing its systems and had brought in outside help, possibly in the form of the police or Serious Organised Crime Agency.

The battle against fraud looks to be a long way from being won.