Company directors are being warned about convincing scam emails claiming to be from Companies House.
The emails tell directors that they must urgently verify their identity and invite them to click a link marked “Verify Your Identity Now”. However, the link is designed to capture valuable personal information, potentially including passport details and financial data.
With identity verification now a legal requirement for directors and people with significant control, fraudsters are taking advantage of the fact that many business owners are still unfamiliar with the new process.
Why this scam may appear genuine
The fraudulent emails copy some of the language used in legitimate Companies House communications. They may refer to:
- a “formal notification” about identity verification;
- an “official government service portal”;
- preparing government-issued identification;
- an urgent deadline or risk of non-compliance; and
- an apparent security warning advising recipients to use GOV.UK.
These details are deliberately included to make the email look official.
The message may also create a sense of urgency, hoping that a busy director will click the link before checking it carefully.
The first warning sign: check the sender
Some of the scam emails have reportedly been sent from Gmail accounts.
Genuine Companies House emails will come from an email address ending in “.gov.uk”. An email sent from Gmail, Outlook or another private domain should immediately be treated as suspicious.
However, checking the visible sender’s name is not enough. Fraudsters can make an email appear to have been sent by “Companies House” even when the underlying email address is completely unrelated.
Always inspect the full sender address before taking any action.
Do not rely on the link shown in the email
A link may display official-looking words while directing you to a fraudulent website.
Before clicking a link, hover your mouse over it to view the actual destination. On a mobile device, press and hold the link without opening it.
If the web address does not look exactly as expected, do not proceed.
The safest approach is to avoid using the email link altogether. Instead, open your browser, type www.gov.uk yourself and access the Companies House service through the official website.
When do directors need to verify their identity?
Identity verification became a legal requirement from 18 November 2025, but that date was the beginning of a 12-month transition period—not a single deadline applying to every existing director.
For most existing directors, the relevant Companies House personal code must be provided as part of the company’s next confirmation statement during the transition period. A director involved with more than one company must provide the code separately for each company.
People with significant control may have different submission requirements and time limits.
You can check the official guidance on when identity verification is required.
This variation in deadlines creates an opportunity for scammers. Directors who are uncertain about when or how to verify may be more likely to respond to an urgent-looking email.
Why the information is so valuable to criminals
The identity verification process can involve sensitive information, including:
- passport or driving licence details;
- residential address history;
- date of birth;
- National Insurance number in some circumstances;
- bank or building society information; and
- facial or photographic identification.
If these details fall into the wrong hands, they may be used for identity theft, fraudulent borrowing, false company registrations or other financial crimes.
Never send copies of identity documents in response to an unexpected email unless you have independently confirmed the recipient and the secure method being used.
The safe ways to verify your identity
There are two recognised routes:
- Verify directly through the official GOV.UK service
Directors can use GOV.UK One Login and follow the official Companies House identity verification process.
- Use an Authorised Corporate Service Provider
A registered Authorised Corporate Service Provider, or ACSP, such as an approved accountancy or legal firm, can verify a director’s identity on their behalf.
Sterling Finance (UK) Limited is registered as an ACSP and can support clients with their Companies House identity verification and related filing requirements.
What should you do if you receive a suspicious email?
If an email claims to be from Companies House and you are not certain that it is genuine:
- do not click any links;
- do not open attachments;
- do not reply to the sender;
- do not provide personal or financial information;
- report the email to phishing@companieshouse.gov.uk;
- inform your accountant if the email relates to your company; and
- delete it from your inbox and deleted-items folder.
If you have already clicked the link or submitted information, act immediately. Change any affected passwords, contact your bank where appropriate, inform Companies House and seek professional advice.
Our advice to company directors
Companies House identity verification is genuine, but not every email requesting verification is genuine.
Do not allow an urgent-looking message to pressure you into handing over your passport, driving licence or financial information. Take a few minutes to check the sender, avoid email links and confirm your position through GOV.UK or your accountant.
If Sterling Finance deals with your company affairs, please contact us before responding to any unexpected Companies House identity verification request. We can check whether the communication is genuine, confirm your applicable requirements and guide you through the correct process.