Gone are the days when the administrative side of running a business was a bureaucratic mess of red tape and paperwork. The digitalisation of services has made it much easier to set up and manage the administration of a limited company. The centralised register of all limited companies created in the UK and the officers that run or own them is Companies House.
The online database is incredibly useful to find out information about an organisation, who its directors are and detail on their filing history.
Unfortunately, the Companies House branding is also commonly used in attempts to defraud organisations, as the example to the left shows. The call to action here is to follow the “here” URL which will take you to a website asking for details about the organisation that aren’t publicly available so that they can be used for further scams.
The suggestion of having to download a document (an Excel workbook) is also a major flag here – any document downloaded can also include nefarious payloads such as malware or ransomware.
There are a number of red flags in this email that tell you it is a scam attempt:
- It is not personalised in any way
- The sent from address is not a ‘.gov.uk’ domain name
- It uses unusual phrases such as “sharp practice”
- The grammar is poor – no space after Excel for instance or the use of a semi-colon in the second paragraph rather than a full-stop.
- No department would ever call itself “Compliance and Targeting Investigations and Enforcement Services Insolvency Service” – can you imagine that on a business card?
- The only way to contact them is by post, to an address which is incorrect – Cannon House is real but is based in THE Priory and a slightly different postcode.
For many start-ups who have never dealt with organisations such as Companies House or HMRC before, they may be fooled into believing this is genuine and will follow the request. For the fraudsters their return on investment is often one or two people scammed and whilst they can still scam someone, they will carry on.