Businesses targeted by ID "hijack" scam

UK firms are being warned about a new online scam that targets the Companies House database in an attempt to hijack the identity of registered companies.

The scam involves fraudsters accessing a form on the Companies House website to change the registered office for a limited company.

The only details they need to do this are the head office postal address and registered company number, which can easily be searched for on the internet. Companies House does not notify firms of any change in address.

The fraudsters then change the address to a mailbox address or a short let residential property, which they can use to open trade accounts and have goods delivered to.

Online fraud prevention firm Early Warning discovered the scam and said firms whose details have been hijacked will only find out when the debt collectors arrive or legal action is initiated to recover goods that have been fraudulently obtained.

A Companies House spokesman told silicon.com that it was aware of actual cases where firms have been scammed this way.

"It's difficult to say how many but it is an emerging problem and we feel that it is growing. We are working with the Home Office and the Metropolitan Police," he said.

But the spokesman added that it now encourages firms to file all documents electronically using its new Proof online filing system, which requires a unique security code for changes to be made.

Companies opting to remain with paper filing will still be vulnerable to the hijack fraud, but the spokesman said firms can opt to use its monitoring service, which notifies firms if any changes have been made to its registered details for a fee of 50 pence per notification.

Andrew Goodwill, MD at Early Warning, said that as an added precaution every Limited company should check its registered office details on the Companies House website every month or so.