Business identity theft and cloned companies: protect your company name before fraudsters open accounts or seek credit

Corporate identity theft can involve fraudsters changing genuine company records or creating a cloned company that looks almost identical to a real business. The goal can be to open bank accounts, obtain credit, place supplier orders or solicit investment under a trusted name. Companies House expanded identity verification and anti-fraud powers in 2025 and 2026, but businesses still need to monitor their own records.

Fraudsters can copy or slightly alter a genuine company identity

Companies House has reported cloned companies using names that differ from established businesses by only a character or punctuation mark. Such entities can deceive suppliers and financial institutions and can attempt to open business bank accounts under false pretences.

Monitor similar company names and customer reports. A supplier asking why the company suddenly uses a new bank can be the first signal of a clone.

Changes to genuine company records can support wider fraud

Companies House warns that fraudsters can hijack companies by changing registered office or officer information. Public register changes can then be used to make fraudulent documents look credible.

Follow the company's own Companies House record and investigate unexpected filings immediately rather than waiting for the confirmation statement.

Identity verification is now a legal Companies House requirement

Companies House says identity verification became mandatory from November 2025 for relevant directors and people with significant control under the staged implementation. Verified individuals receive a personal code that should be shared only with trusted people who need it for filing.

Identity verification makes impersonation harder but does not make fraud impossible. Protect the personal code like other sensitive corporate credentials.

Use protected online filing and controlled company-secretarial access

Companies House continues to provide PROOF for specified filings and has introduced wider anti-fraud powers. Limit who can make company filings and keep authentication credentials out of shared email accounts.

Reconcile filings to board decisions. An unexpected director appointment, address change or company-name change should trigger immediate investigation.

Tell banks quickly when a company identity is being abused

If a fraudster appears to have opened or attempted to open accounts using the company's identity, contact the relevant banks and provide the genuine incorporation and director evidence.

Ask customers and suppliers to use established payment details until the incident is resolved. Fraudsters can exploit confusion by sending new "corrected" invoices during the investigation.

Use the Companies House fraud and correction processes

Companies House provides routes to report scams and cases where personal details are used without permission. Preserve fraudulent filings, letters, account details and emails.

Coordinate Companies House, bank, insurer and law-enforcement reporting where money or credit has been lost.

Worked example: a supplier finds a newly incorporated company with almost the same name as a genuine customer and receives a large order on credit. The clone provides a new bank account and copied branding. A direct callback to the genuine customer exposes the fraud before goods are shipped.

Set alerts for Companies House changes and review them with treasury. Company-secretarial fraud and bank fraud are linked because public register data is often used during bank onboarding and supplier credit checks.

Keep genuine bank details on a secure supplier-information page or known communication channel where appropriate. Customers then have a trusted reference when fraudulent invoices circulate.

Worked example: fraudsters incorporate a company whose name differs from a well-known supplier by one character and open a bank account. They send invoices to customers using copied branding. Customers that verify the Companies House number, established domain and known bank details are more likely to spot the mismatch before paying.

Use domain monitoring alongside company-register monitoring. A cloned business often needs a lookalike website or email domain as well as a company name, and the combination can make fraudulent bank-detail notices more convincing.

Restrict who receives Companies House authentication and personal identity codes. The company secretary can need them for legitimate filings, but broad sharing by email increases the risk that a compromised mailbox is used to make unauthorised changes.

Keep a response pack containing incorporation certificate, current officers, official domain and genuine bank contacts. Providing this evidence quickly can help banks and suppliers distinguish the real company from a clone.

Review credit-reference and supplier enquiries after an identity incident. Fraudulent companies can apply for trade credit as well as bank accounts, leaving the genuine business to answer collection letters for goods it never ordered.

Keep customers informed through an authenticated channel if a clone is actively circulating false bank details. Clear, consistent warnings can stop secondary losses while formal register and banking corrections are still in progress.