Your business almost certainly has a profile on Companies House that you last thought about when you registered. It shows your registered address, your directors’ names, your filed accounts, and your company number. All of it is public, searchable, and — here’s the part most businesses don’t realise — editable by people who aren’t you.

Companies House fraud is a category of business identity crime that UK businesses consistently under-appreciate until it affects them. The mechanisms range from mildly disruptive to genuinely damaging, and the recovery process can be slow. Here’s how it works and what you can actually do about it.

How the Fraud Works

Companies House allows anyone to file changes to a company’s record. The intention is straightforward — if a director changes their address, or a new officer joins the company, the update should be easy to make. The problem has historically been that verification was minimal. Until the Economic Crime and Corporate Transparency Act 2023 began rolling out identity checks in 2025-26, a person’s date of birth and National Insurance number were often sufficient to “confirm” a director’s identity for filing purposes — and both are obtainable from data breaches, LinkedIn profiles, or social engineering.

The most common fraud patterns:

Director appointment fraud. Scammers add themselves or fictitious individuals as directors on legitimate company records. They then use the appointment as proof of authority to open business bank accounts, apply for credit, or sign contracts in the company’s name. By the time you notice, accounts may have been opened, debts incurred, and the fraudsters long gone.

Registered address hijacking. The company’s registered address is changed to one the fraudster controls. HMRC notices, statutory correspondence, and company communications then go to them rather than you. In some cases the hijacked address is used to make a fraudulent company look credible. If your registered address is your home or office, this is a real operational risk.

False accounts filing. Fraudulent financial information filed with Companies House can be used to misrepresent a business’s financial health to lenders, suppliers, or potential acquisition targets. The company’s public record shows accounts you’ve never seen or signed off.

Identity cloning. A new company is registered with a name closely resembling yours — “Smith Electrical Services Ltd” against your “Smith Electrical Services Limited”, or a similar variation — and used to approach your suppliers or customers posing as your business. A quick Companies House search turns up something plausible, and the victim makes a payment to the wrong entity.

The 2026 Context

The Economic Crime and Corporate Transparency Act 2023 introduced mandatory identity verification for company directors, and the rollout has been phasing through 2025-26. New directors must now verify identity before being registered, and existing directors were required to complete verification by spring 2026. This closes the most obvious attack vector — the ability to appoint a fictitious director with invented details.

However, it doesn’t eliminate the fraud entirely. The verification system is document-based and not instantaneous. There’s still a window between a fraudulent filing and detection, and address hijacking remains easier to execute than director appointment fraud. The reforms are meaningful progress but not a full solution.

Check Your Record Right Now

Go to find-and-update.company-information.service.gov.uk and search for your company. Look at:

  • Are all listed directors people you recognise? Are their addresses correct?
  • Is the registered address right?
  • Are the filed accounts ones your accountant actually submitted?
  • Have there been any recent changes you didn’t make?

If something looks wrong, you have options. For unauthorised director appointments, submit form RP04 — an objection to incorrect information. For address fraud, use form AD01 to correct the registered address with supporting documentation. For active fraud involving a new fraudulent company impersonating yours, email Companies House’s fraud team directly at fraud@companieshouse.gov.uk — they have a prioritised process for live fraud cases.

Always report to Action Fraud (actionfraud.police.uk, 0300 123 2040) if you’ve suffered financial loss. Get a crime reference number, which you’ll need for any insurance claims or bank dispute processes.

Prevention That Actually Helps

Register for PROOF (Protected Online Filing). This is a free Companies House service that prevents most online changes to your company record without a specific authentication code generated from your account. Without PROOF, many filing types — including officer appointments and address changes — can be submitted without the company’s knowledge. With PROOF active, those changes require a code that goes to your registered contact details. It’s one of the most effective preventive measures available and it’s widely underused. You set it up through your Companies House online profile.

Turn on change notifications. Companies House sends email alerts when changes are filed against your record. Sign up for these in your online account settings. The alerts arrive quickly — within a day of a change being filed — which is early enough to challenge a fraudulent filing before it causes damage.

Keep your registered address current and monitored. If statutory mail is going somewhere you don’t regularly check, you’ll miss early warning signs. Many small businesses use a professional registered address service through their accountant or a company formation agent — this creates a clear separation between operating and registered addresses and ensures correspondence reaches someone who’ll act on it.

Brief your bank. Let your business bank know you’re actively managing identity fraud risk. Ask whether they have procedures for flagging suspicious new signatory or mandate change requests against your account. Most business banks have fraud teams that will note this kind of proactive contact.

Companies House fraud rarely makes the headlines unless the victim is a well-known company. But it’s a consistent, low-noise problem affecting UK businesses of all sizes. The protective measures are free and take less than an hour to set up — PROOF registration and change notifications are the two that make the biggest difference with the least effort.