Companies House has issued a fresh scam warning to directors, and it’s a reminder of a pattern that keeps working on businesses: fraudsters piggybacking a real regulatory deadline to make a fake email convincing. The genuine requirement — all directors and People with Significant Control must complete identity verification, with a 12-month transition period running to November 2026 — has created exactly the kind of background anxiety scammers rely on.
The scam emails impersonate Companies House directly, telling recipients they must complete identity verification urgently or face penalties, restrictions, or compliance action. They typically link to a fake login page designed to harvest personal details or account credentials. Because the underlying deadline is real and the language mirrors genuine official communications, even careful directors are reportedly being caught out.
The stakes if you fall for it are higher than a normal phishing scam. Companies House accounts control statutory filings — a compromised account could let fraudsters submit unauthorised filings, alter company records, or impersonate a director when dealing with suppliers, customers or banks. That’s a harder problem to unwind than a compromised email inbox, and it can take weeks to get fraudulent filings corrected and confidence with suppliers or lenders restored in the meantime.
This is also a pattern worth recognising beyond this one scam. Whenever a government body or regulator introduces a genuine new requirement with a hard deadline — identity verification, tax digitalisation, licensing changes — a wave of impersonation emails tends to follow within weeks, built specifically to exploit people who know the deadline is real but aren’t sure exactly what compliance looks like.
How to tell the real thing from the scam
Companies House will never ask you to click a link to “urgently” verify your identity via email. Verification happens through GOV.UK One Login or in person at a Post Office, not via a link embedded in an email that arrived out of nowhere.
Check the sender address character by character. Scam domains typically use small substitutions — an extra letter, a hyphen, a different top-level domain — designed to look right at a glance.
Urgency is the tell, not the deadline. The real deadline runs to November 2026. Any email implying you must act in the next 24 hours to avoid immediate penalties is applying pressure a genuine government communication wouldn’t.
Don’t trust the email — go direct. If you’re unsure whether you’ve completed your verification, log in to your Companies House account by typing the address in yourself, not by following a link, or check gov.uk directly.
What to do if you get one
Report it to phishing@companieshouse.gov.uk and delete it from every mailbox it landed in. If anyone in the business has already clicked through and entered details, change the password immediately, enable two-step verification on the account if it isn’t already on, and check the filing history for anything unrecognised. If you spot a filing you didn’t make, Companies House has a process to flag it as fraudulent — do that immediately rather than waiting to see if it causes a problem.
It’s also worth a quick note to anyone else in the business who might receive this — directors and PSCs aren’t the only people who open what looks like official correspondence, and one forwarded warning to the team is cheaper than one person acting on the fake version. If your business handles a lot of this kind of official and financial correspondence and wants a proper incident-response plan rather than an ad hoc reaction, KeepSafe monitors for exactly this kind of targeted business fraud.
The takeaway
The Companies House ID verification requirement is genuine and worth completing properly, through GOV.UK One Login or in person — but never through a link in an unsolicited email. When in doubt, go to the site directly rather than clicking anything that landed in your inbox.