Banks and security experts expect a wave of scam e-mails and bogus mailshots after the loss of the personal data of 25 million people.

Executives from the largest high street banks fear that if the data falls into criminal hands the most damaging attack could come in the form of fake direct mail campaigns, possibly conducted over several years. “They could post leaflets that appear to come from a customer’s bank, would be able to quote an account number, be correctly addressed and could invite recipients to phone a fake call centre to apply for, say, a special offer,” one banker said. “Once you call, they ask for your password – and bingo.”

Even if the data does not reach the criminal domain, e-mail con-artists are expected to tap into an increased public fear of ID theft. Experian, Britain’s largest credit-rating agency, said yesterday that the number of visits to its website had doubled. It expects a surge of fake “phishing” e-mails that play on such concerns by asking customers to update security details in the hope of stealing them.

Jonathan Armstrong, a partner at the law firm Eversheds, said: “It is likely that even now a large e-mail campaign is being planned.”

One model would be the attack this year on Nordia, the Scandinavian bank that lost about £800,000 when 250 victims fell for an e-mail scam. Customers who clicked on bogus messages had their computers infected by malicious software that logged key-strokes and picked up details of passwords.

The data lost by HMRC was not enough to access a bank account or open a new one, Mr Armstrong said. “It does not provide what cybercriminals call the full deck.”

Opening accounts on the high street has become harder as a result of measures taken to combat money laundering. Banks require new customers to present a full passport, national ID card or a tax letter from HMRC in person at a branch. However, such hurdles are regularly cleared by serious fraudsters, experts say. “ID thieves work closely with credit-card cloners and forgers,” said Graham Cluley, of the technology security group Sophos.

If the lost data were to be secured by sophisticated criminals it might be parcelled out and sold on via black-market brokers. A package of the HMRC information for one person could fetch between £20 and £100. If the victim holds a sensitive position, such as a security-related job, the price could rise to several hundred pounds.

Callers ringing the HMRC helpline (0845 3021444) about their missing personal data are being charged at least 10p from a landline, or 30p to 40p a minute for mobile phone users. The use of 0845 numbers is in breach of guidance from Ofcom, the telecoms regulator, which backs the use of 03 numbers for public services