Scam alert: bogus Companies House email threatens legal action

A fake Companies House email is doing the rounds, threatening recipients with legal action. It's sent by scammers hoping to steal data or infect devices with malware.

This is the latest in a string of impersonation scams, following fake emails targeting Microsoft and Apple users in recent weeks. 

Here, we explain how this scam works and how to protect yourself.

Sign up for free Which? scam alert emails to find out about the latest scams news and advice 

A closer look at the fake Companies House email 

Which? readers have sent us examples of a scam email impersonating Companies House, the government's company register.

The message states it is from Companies House but a closer look at the sender address, <@intouristxobatumi.com>, reveals it has nothing to do with them. 

There are other giveaways that this email is bogus:

• It fails to address the recipient by name. Emails that open with ‘Dear customer’ should also arouse your suspicions.
• The email has a loosely threatening tone, stating ‘Correction request: do not ignore to avoid legal action!’ and referring to enforcement action for failure to provide requested information, which is inappropriate for a government agency. There is also a sense of urgency, providing a short deadline for responding. 
• There is a clickable web link to 'download' documents, but hovering a mouse over the link shows it doesn't go to the genuine Companies House website. 

The website this email links to is no longer accessible, but it’s likely that the fraudsters had set up a copycat website to steal company data from potential victims. Scam emails and dodgy websites can also contain malicious code that can infect your device. 

On its website, Companies House states that it will never contact you by email or telephone to ask for secure information about your company.

If you’ve received one of these emails, forward it to phishing@companieshouse.gov.uk and then delete it. 

Spotting and reporting other scam emails 

If you receive an unsolicited email from a company or government agency, don’t click on any attachments or disclose personal information until you’ve established it’s genuine. 

Check the sender’s email address carefully. Even if it does appear to be correct, the safest option is to contact the relevant business using a trusted method such as the phone number or messaging service on its official website. 

Forward suspicious emails to report@phishing.gov.uk. You can also flag dodgy emails to your email provider. For example, Gmail users can select the ‘Report spam’ button on the toolbar when they view an email and Outlook lets you report spam messages and phishing attempts.

• Find out more: How to protect yourself from scams