Anyone who runs a limited company appears on a public register, and that makes company directors an easy group for fraudsters to target. Criminals pose as Companies House, the government body that runs the register, to steal authentication codes, personal details or small payments. New identity verification rules have given scammers a fresh script. This guide draws on Companies House guidance on GOV.UK and its own advice to directors, and it is general information rather than professional advice.
What Companies House says it will never ask for
Companies House’s guidance on reporting scams says it will never call to ask for secure information such as passwords, bank details, authentication codes, or the details of directors or company officers. If someone calls claiming to be from Companies House and asks for this, the guidance says not to give out any information, to try to get a return telephone number, and to contact Companies House immediately on 0303 1234 500.
Known phone scams
The guidance lists examples of phone scams that have been reported:
- a caller claims to be from a Companies House “registration department”, which does not exist, and asks for contact details to send out “registration documents”;
- a caller asks for a late filing penalty to be paid over the phone, saying a £5 payment by credit or debit card will “place a hold” on further action; and
- a caller says there is a “discrepancy with the information held on the register” and asks for information such as directors’ full dates of birth.
The guide to impersonation scams covers the wider pattern.
Scam emails and how to check them
Companies House says deceptive emails often carry logos and formatting that make them look official, wording copied from genuine emails, false and confusing information, spelling or grammatical errors, pressure to act quickly, demands for payment, and pressure to open an attachment or link or provide an authentication code. It advises always checking the sender, because real Companies House emails come from an address ending “.gov.uk”, and hovering over links to see where they go, not clicking if the address looks unexpected.
For a suspicious email, the guidance says to report it immediately to [email protected], share no personal information, open no links or attachments, and delete the email from all mailboxes, including deleted items. Its published examples include a message with an “Access Now” button about a WebFiling account and a request to complete “Know Your Customer” verification.
Identity verification: the genuine process and the scam version
Identity verification is a real requirement. The GOV.UK guidance says that from 18 November 2025 it became a legal requirement, and that this date is not a deadline but the start of a 12-month transition period for companies to make sure all directors and people with significant control have verified their identity by their due dates. A director can verify online with GOV.UK One Login using photo ID such as a biometric passport, a UK photo driving licence or a biometric residence permit, or can ask an Authorised Corporate Service Provider, such as an accountant or solicitor, to verify on their behalf.
Because the process is real, scammers copy it. The guidance’s scam examples include a Gmail-address email impersonating Companies House and telling the recipient to verify their identity, an email using the HMRC logo, and one demanding verification within 24 hours. The safe route is to start from the GOV.UK page for the service rather than from a link in a message. The service page also carries this fraud warning: do not let others use your identity, and do not sell or give it away to enable people you do not trust to set up or run a company, because criminals can take out loans and other debt in your name and you will be legally responsible.
Protecting the company itself
A Companies House blog post on protecting a company from fraud sets out three main steps.
- Register to file online. Each company has a six-character authentication code that authorises online filings and acts as the equivalent of an officer’s signature. It should only be shared with someone trusted to file for the company, and changed if it becomes known to someone who should not have it. The protected online filing scheme (PROOF) prevents certain paper forms, including changes to the registered office, officers’ information and the confirmation statement, from being filed, so those changes can only be made online. The free Follow service sends email alerts when filings are accepted.
- Take security precautions. A director does not need to use a home address as the correspondence address or as the registered office. If they do, it appears on the public register and cannot be removed from records. Check that a website address is genuine before entering email details or an authorisation code.
- Report suspected fraud. The post says to contact Companies House on 0303 1234 500 about a suspicious letter, invoice or call, and names Action Fraud as the national fraud and cyber-crime reporting centre for the police if details have been used without consent. The blog is dated 17 August 2022, so the guide to where to report a scam lists current routes.
Related risks for small businesses
Requests that appear to come from a supplier or director to change bank details, or to pay an urgent invoice, are covered in the invoice and business email compromise guide. The Companies House scam page also points people whose details were used without permission to a separate process.
The bottom line
Companies House says it will never ask for authentication codes, passwords, bank details or details of directors by phone or email. Genuine emails come from a .gov.uk address, and identity verification, though now a legal requirement, should always be started from the official GOV.UK service, never from a link in an unexpected message. Protecting the authentication code, using PROOF and Follow, and keeping a home address off the register reduce the risk of company hijacking.