Beat the Scam Scam checks, alerts, and consumer protection guides
Check a message
Home / Guides / Email Scams / Companies House Email Scam UK: How to Check and Report a Message
Email Scams

Companies House Email Scam UK: How to Check and Report a Message

Companies House scams copy official wording and branding. Verify the sender, link and request through GOV.UK or Companies House before acting.

· · · 6 min read

Quick answer: Treat an unexpected Companies House email demanding urgent payment, an attachment, or your company authentication code as a likely scam — Companies House says it will never ask for that code. Verify by starting fresh at GOV.UK rather than using the email's links, and forward suspicious messages to phishing@companieshouse.gov.uk.
Key rule: verify through an official route you opened yourself, not the link, number, app, or payment details supplied by the suspicious message.
On this page
  1. What the scam looks like
  2. Warning signs
  3. What genuine Companies House email can look like
  4. How to verify a message safely
  5. If you clicked, disclosed information or paid
  6. How to report it

What the scam looks like

Criminals send emails that imitate Companies House notices and use copied wording, logos, reference numbers or information from the public company register. Current examples published by Companies House include fake identity-verification requests, WebFiling notices, email-verification messages, complaint notifications and requests to open an attachment or supply an authentication code.

The aim may be to steal a password or company authentication code, collect identity or payment details, install malware through a link or attachment, or induce a payment. Companies House also warns about misleading register-payment requests from organisations that are not connected with it.

Urgency, branding or correct company information does not establish authenticity. Much company data is public and can be used to personalise a scam.

Warning signs

  • Pressure to act immediately, make a payment, open an attachment or disclose an authentication code.
  • A sender domain that is not a genuine .gov.uk address, or a display name that hides an unrelated address.
  • A link whose actual destination is different from the expected GOV.UK or Companies House address.
  • A request for a password, bank details, authentication code or sensitive officer information.
  • False or confusing wording, spelling errors or inconsistent formatting.
  • An unexpected invoice to maintain a company on a private “register” that suggests government affiliation.

These are indicators, not a complete authentication system. Email sender addresses can be spoofed, and a message ending in .gov.uk should still be checked if the request or link is unexpected.

What genuine Companies House email can look like

Companies House says its real emails come from an address ending in .gov.uk—not exclusively @companieshouse.gov.uk. For example, its published notice of 17 March 2026 about the WebFiling security issue said those emails would come from companies.house@notifications.service.gov.uk. That is a documented example of one genuine Companies House sender for that specific communication — not a permanent universal address, and not authentication on its own, because sender details can be spoofed.

Genuine Companies House services can also send emails containing links. Its Follow service sends alerts linking to a company's filing history, and its guidance gives ewf.companieshouse.gov.uk as an example of a genuine password-reset address. Companies House and the Intellectual Property Office also stated in 2026 that invoices are usually posted but can be sent by email.

Therefore, “it contains a link”, “it asks for payment” or “it does not come from @companieshouse.gov.uk” cannot each be used as an automatic verdict. Verify independently.

Companies House says it will never ask for your company authentication code. It also says it will not call to ask for passwords, bank details, authentication codes, or details of directors or company officers.

How to verify a message safely

1. Do not reply, open an attachment or use a link while you are checking. 2. Expand and inspect the complete sender address. Genuine Companies House email should end in .gov.uk, but remember that the visible From address is not conclusive by itself. 3. Hover over a link without opening it and inspect the destination. Genuine services use GOV.UK and Companies House .gov.uk addresses. Be alert to deceptive endings such as an unrelated domain placed after familiar words. 4. Open a new browser tab and start at the GOV.UK Companies House service: https://www.gov.uk/government/organisations/companies-house.

Check the public company record, filing history and official guidance relevant to the request. 5. Contact Companies House using details obtained from GOV.UK. Its published enquiry number is 0303 1234 500.

Not every genuine matter will necessarily be reproduced as a private alert in an online account, so the absence of an account notification is not definitive. Confirm the specific filing, deadline, invoice or identity-verification request through the official service or by contacting Companies House.

If you clicked, disclosed information or paid

  • If you entered a password, change it through the real service and anywhere else it was reused. Secure the associated email account and enable two-step verification where supported.
  • If you disclosed a company authentication code, contact Companies House immediately. The code authorises online filings and should be protected like a signature or bank PIN.
  • Review the company's filing history and details for unauthorised changes. Consider Companies House's Follow alerts and relevant account-protection services.
  • If you entered card or bank details, contact the provider immediately through its official app, website or phone number. Follow its advice about cards, account security and disputed transactions.
  • If you sent a UK bank transfer to a fraudster, ask the bank about APP-scam reimbursement. The rules cover many eligible Faster Payments and CHAPS scam payments, subject to scope, caps and exceptions.
  • Preserve the email, headers, URL, screenshots and transaction details for your provider and investigators. Do not open a suspect attachment just to collect evidence.

Do not assume that a bank requires a police crime reference number before it can act. Contact the bank first and follow its instructions; report the fraud separately through Report Fraud in England, Wales or Northern Ireland, or Police Scotland on 101 in Scotland.

How to report it

  • Forward a suspicious Companies House email to phishing@companieshouse.gov.uk, then delete it as Companies House advises.
  • You can also forward a suspicious email to the NCSC at report@phishing.gov.uk and submit a suspect URL through the NCSC scam website reporting service at https://www.ncsc.gov.uk/section/about-this-website/report-scam-website.
  • If money or information was stolen, use Report Fraud at https://www.reportfraud.police.uk/ or call 0300 123 2040 in England, Wales or Northern Ireland. In Scotland, report fraud to Police Scotland on 101.
  • Mark the message as phishing with your email provider.
  • For consumer advice, use the service for your nation: Citizens Advice in England and Wales on 0808 223 1133, Advice Direct Scotland in Scotland on 0808 800 9060, or Consumerline in Northern Ireland on 0300 123 6262.

Frequently asked questions

Do all genuine Companies House emails end in @companieshouse.gov.uk?

No. Companies House says genuine messages end in .gov.uk. It has documented legitimate use of companies.house@notifications.service.gov.uk.

Does a link prove the email is fake?

No. Some genuine services send links. Do not use an unexpected link; navigate independently to GOV.UK and verify its destination and purpose.

Will Companies House ask for my authentication code?

Companies House says it will never ask you to disclose the code. Treat any such request as suspicious and report it.

Can stolen credentials let someone change company information?

A company authentication code authorises online filings, so disclosure creates a serious risk. A stolen password can also compromise the relevant account. Secure both, inspect filing history and contact Companies House about unauthorised activity.

Where do I report a suspicious message?

Send it to phishing@companieshouse.gov.uk; you can also forward it to report@phishing.gov.uk. Report actual loss through Report Fraud in England, Wales or Northern Ireland, or Police Scotland on 101 in Scotland.

Sources checked

Think you’ve spotted a scam? Use the AI scam checker for an automated second opinion, or report it to Report Fraud for England, Wales and Northern Ireland, or Police Scotland on 101 for Scotland.

Reporting routes in this guide are checked against our verified canon of official UK sources — Report Fraud for England, Wales and Northern Ireland, or Police Scotland on 101 for Scotland, the National Cyber Security Centre, and the consumer service for each nation — by an automated accuracy gate before publication. Editorially updated by , Founder & Editor, on 2026-07-30. Read about how Beat the Scam writes guides.

Check a message Start recovery