Companies House email scam: what it is, how it works, UK fraud explained - is it a phishing attack?

One of the more horrible aspects of the cost of living crisis has been a surge in the number of scams targeting people.

As well as generic types of attempted financial crime that have been around for years, like phishing and smishing, we have also seen more and more sophisticated examples. These have included delivery text scams that have convincing fake websites, and complex strategies, such as authorised push payment scams.

Recent research by the high street bank TSB found impersonation scams had risen 58% in 2022. Another report by Lloyd’s warned that criminals were also increasingly looking to separate people from their money through advance fee fraud, with incidences of the scam going up 82% year-on-year.

Business people have also been subjected to attempted fraud of late, especially those that are self-employed. Emails purporting to be from accounting app FreshBooks have been just one tactic scammers have used to try to steal hard-earned cash or commercially sensitive details.

Now, they are being bombarded by emails purporting to be from Companies House - the UK government body in charge of officially registering businesses operating in the country. But what does this scam look like - and how can you guard yourself against it?

What is the Companies House email scam?

According to consumer watchdog Which?, scammers have begun to send out emails impersonating Companies House. Threatening legal action, the messages contain clickable web links that could install malware (i.e. spy software) onto your device or get you to part with vital personal information.

Which? said the examples of the scam it had seen came from a domain name that has nothing to do with Companies House - <@intouristxobatumi.com>. Meanwhile, the web link contained in the email appeared to lead to a website address that also bore no relation to the public body. But the message had been made convincing through the inclusion of a Companies House banner, official-sounding language and the suggestion that the link is to an ‘e-sign platform’.

The subject line of the email that the consumer site advised people to look out for reads: ‘Correction request: do not ignore to avoid legal action!’ The email also carries the threat of enforcement action for failing to provide key information by a deadline - something a government agency would never do, let alone phrase in such a threatening manner.

How can you avoid being scammed?

The Companies House scam is a classic use of the phishing fraud tactic. But it has one big problem - the government agency says it will never contact you by email (or even over the phone) to request what it calls “secure information” - in other words, private details and documents.

Other tell-tale signs of the scam include an impersonal greeting, such as ‘Dear sir/madam’ or ‘Dear customer’. And the inclusion of a deadline is a classic example of fraudsters attempting to create a sense of urgency intended to bounce you into making a decision without thinking it through.

Which? says one of its key bits of advice is to take time to consider the email and ask yourself some questions. Is the sender’s email domain anything to do with the organisation or business in question? Is the link taking you to a website associated with the company (you can find out by hovering over it and not clicking through)? Sometimes, you can easily tell it’s a scam email because you won’t have anything to do with the business or body the message purports to be from (e.g. if you don’t own a firm or have a senior role in a business, why would Companies House contact you?).

If you have any doubts, the best option is to directly contact the organisation or company the email purports to be from by visiting their website and speaking to them over the phone to find out if the email, text or call really has come from them. In the case of Companies House, it also asks that you forward the scam onto a special email address: [email protected].

Generally, you should report scam emails to your email provider and the government’s cybersecurity department [email protected]. Once you have done so, you should delete the scam email.