Hi I wonder has anyone experienced this before. We received a letter yesterday from HMRC confirming a client refund has been processed but we didnt recognise the nominee. Checked with client and they have never heard of the nominee either so contacted HMRC to discover the refund was requested this month online - this was not generated from us or the client. After some more investigation we discovered that the client address has also been changed with HMRC so we have today requested its treated as an account breach with HMRC and they investigate. Problem being the agent I spoke with was very vague - she was not aware of the process said she would complete a form then it would be a case of waiting on HMRC security team calling back. She cant give any timelines? Has anyone else experienced anything like this and what were the timescales? I am concerned as at present we dont know if its a breach through the client or through our agent logins. Obviously if it is our agent logins it could impact a lot more clients so really concerned with this lack of information. Also i dont see any functionality to change agent login passwords?