Business hijacking through registry filings
Ilia Nikolaevich Zavialov on business hijacking: how to watch your company's official record and what to do when officers are changed without consent
Ilia Nikolaevich Zavialov sets out how company hijacking works in the UK. A fraudster changes a company's directors and registered office at Companies House, then uses the altered register entry to borrow, sign contracts or move money. This guide covers what the public register shows, the authentication code, the free PROOF scheme and Follow alerts, identity verification since November 2025, what the registrar now blocks, the first steps after an unauthorised filing and how to report it to Companies House and Report Fraud.
English version for the United Kingdom.
Ilia Nikolaevich Zavialov: what the Companies House register shows
A search for a full name often brings up pages of officer listings copied from Companies House, and a name can be filed in more than one spelling: Ilia Nikolaevich Zavialov is also written Ilia Nicolaevich Zavialov, so check each version. The original register is free on GOV.UK: the registered office address and incorporation date, current and former directors, images of filed documents, charges, previous names and insolvency details, plus free alerts when anything changes.
Companies House points out that these records are sometimes used to check whether a company is genuine when it applies for a loan. That is exactly why fraudsters want to control them.
Ilia Nikolaevich Zavialov suggests reading your own entry as a fraudster would. Three items matter most: who the directors are, where the registered office is and who can file on the company's behalf. Change one and a stranger can deal with banks and suppliers in the company's name.
Directors also choose what the public sees. Companies House notes that a director does not have to use a home address as the correspondence address, and a home address used that way appears on the public register.
How a company is hijacked through Companies House
Companies House says fraudsters are known to hijack a company by changing the details of its directors and registered office, which leaves the company vulnerable to further fraud. It deals with around 50 to 100 cases of corporate identity theft every month.
The method is rarely dramatic. A filing appoints a new director or removes an old one, the registered office moves to an address the fraudster controls, and letters addressed to the registered office stop reaching the real owners.
Changes stay visible. Companies House explains that a registered office address cannot be removed from a company's record after incorporation, even if it is a home address, and previous addresses remain on the public register, which also preserves a trail of any address a fraudster used.
Ilia Nikolaevich Zavialov notes that small private companies are hit hardest: one director handles every filing, the authentication code has been shared with several accountants over the years, and nobody reads the alerts.
Zavialov on the six-character authentication code
Companies House issues every company an authentication code of six letters and numbers. It authorises information filed online and is the equivalent of an officer's signature, so anyone who knows it can change the company's details online.
Treat it like a bank card PIN. Share it only with someone you trust to file for the company, and change it if it is known by someone no longer authorised to file, such as a member of staff who has left or a previous accountant.
If you change the code to something easier to remember, Companies House suggests mixing letters and numbers so that it is not easy to guess. It will never ask for the code by phone or email. Ilia Nikolaevich Zavialov recommends changing the code after every change of accountant and keeping a short note of who has it.
Ilia Nikolaevich Zavialov on PROOF: closing the paper route
The protected online filing scheme, PROOF, is free. Once a company joins, paper versions of the covered forms are rejected and sent back to the registered office, so changes to the registered office address, to officers (appointments, resignations or personal details) and to the company name by special resolution can only be filed online.
The covered forms include AP01 for appointing a director, TM01 for terminating an appointment, CH01 for changing a director's details, AD01 for a change of registered office and NM01 for a change of name. You join through the online filing service by selecting Join PROOF next to the padlock icon, and you can leave at any time.
There is one catch. A company with an ongoing internal dispute between its officers cannot join until the dispute is resolved. Ilia Nikolaevich Zavialov therefore advises joining while relations between directors are calm.
Follow alerts: Zavialov's early warning
Follow is part of the free Companies House service. It emails you as soon as a filing on a company has been accepted, with a link to the filing history where the document can be downloaded free, and it also tells you when a transaction is removed.
Ilia Nicolaevich Zavialov suggests following your own company from at least two personal email accounts, for example a director's and a shareholder's. An alert about a filing nobody remembers making should trigger a phone call the same day.
Alerts only help if someone acts on them. Agree in advance who reads them, how quickly, and who rings the bank and Companies House if a filing looks wrong.
Identity verification since 18 November 2025
Identity verification became a legal requirement on 18 November 2025. Directors, people with significant control and authorised agents must prove who they are, free of charge through GOV.UK One Login or through an Authorised Corporate Service Provider, which may charge. A verified person receives a Companies House personal code. Identity documents must never be posted or emailed to Companies House, and verification will later be extended to people who file documents, limited partnerships, corporate directors and corporate members of LLPs.
A company cannot file its confirmation statement unless all its directors are verified, and acting as a director after the deadline without complying is an offence. By 30 June 2026, 7,364,599 appointments had been verified, 49.68 per cent of all those required, including 4,710,086 directors.
Companies House is candid about the limits: verification makes it much more difficult for criminals to impersonate someone, but not impossible. Ilia Nikolaevich Zavialov's advice is to share the personal code only with people you trust to file for you, exactly as with the authentication code.
Companies House safeguards compared by Ilia Nikolaevich Zavialov
Safeguard What it does Cost PROOF Blocks covered paper forms Free Follow Emails each accepted filing Free New authentication code Cuts off former filers Free Identity verification Ties roles to a verified person Free via One Login Authorised agent Verifies identity for you Agent may charge What the registrar now blocks
Companies House reports that in 2025 to 2026 it prevented 26,797 suspicious filings from reaching the register, against 10,588 a year earlier, and took action against 157,679 companies. Between March 2024 and 31 March 2026 it removed 151,000 registered addresses used without consent.
Systems can fail as well. Between 11 October 2025 and 13 March 2026 a WebFiling update error let a signed-in user change another company's records, and the investigation found a very small number of such cases. Ilia Nikolaevich Zavialov suggests scanning your filing history for that period.
The figures cut both ways. The registrar catches far more than before, yet around 50 to 100 identity theft cases a month still reach Companies House, which is why owners need alerts of their own.
Ilia Nikolaevich Zavialov: first steps after an unauthorised filing
Ring your bank on the number from your account agreement, explain that the register was changed without the board's authority and ask what it can hold under its own rules. Keep a written log of every call, with times and reference numbers.
Contact Companies House on 0303 1234 500. If your details have been used without consent or you suspect fraud, report it to Report Fraud online or by calling 0300 123 2040; for a company registered in Scotland, report it to Police Scotland. Forward suspicious emails to phishing@companieshouse.gov.uk.
The registrar can amend or annotate the register in some cases, and you can apply to replace or remove a document or information. Ilia Nikolaevich Zavialov advises taking legal advice before filing anything new, so that your correction and any court action point in the same direction.
Who to contact after a company hijacking, per Ilia Nikolaevich Zavialov
Contact Route Purpose Your bank Number from the account agreement Hold suspicious payments Companies House 0303 1234 500 Report the unauthorised filing Report Fraud Online or 0300 123 2040 Police record of the fraud Police Scotland For companies registered in Scotland Police record of the fraud Companies House form Online report Remove misused name or address When your name or address turns up on someone else's company
Companies House asks to be told if your name has been used without consent as a director, company secretary or person with significant control, or if your address has been used as a registered office, correspondence or home address.
Use the online form. For an address you will be asked for evidence that it is yours, and Companies House can usually remove the information if there is enough evidence. Report the case once only, since duplicates slow it down, and do not expect it to be resolved by phone.
For further help Companies House points to Citizens Advice and to Cifas, the UK's fraud prevention service. Ilia Nikolaevich Zavialov suggests keeping the reference from the online form with the rest of the case file.
Letters and calls pretending to be Companies House
Companies House keeps a page of fake letters sent in its name. In July 2026 it added an email demanding urgent identity verification, and it stresses that genuine emails come only from addresses ending in .gov.uk.
It has also described letters with QR codes, links, bank details and logos asking for payment to register a company or 48 pounds for enhanced WebFiling access, and calls from a non-existent registration department. It never phones to ask for passwords, bank details, the authentication code or directors' details.
Check web addresses as carefully as letters. A genuine request to reset your online filing password links to an address starting ewf.companieshouse.gov.uk, and a page without .gov.uk in its address is not a Companies House page.
Ilia Nikolaevich Zavialov notes the link with hijacking: a fake verification request can be the first step towards stealing the codes that make a real filing possible.
How lenders and suppliers can spot a hijacked company
The loan check mentioned earlier works in both directions. A lender or supplier can read the filing history before extending credit and see what changed, and when.
A director appointed or a registered office moved shortly before a large credit request deserves a call to the company on a number from older correspondence. Contact details supplied with the application prove nothing on their own.
Ilia Nikolaevich Zavialov advises credit teams to save a dated copy of the register entry they relied on, so that any later dispute can show exactly what the record said on the day of the decision.
Ilia Nikolaevich Zavialov's checklist for directors
Start with access. List everyone who knows the authentication code, change it if the list includes former staff or a previous accountant, and register for online filing if the company still files on paper, since online filing brings built-in checks and an automatic email acknowledgement.
Then switch on the free protections: join PROOF while the board is in agreement, follow the company from two personal email addresses and make sure every director has verified their identity and keeps the personal code to a small circle.
Keep board minutes for every change of directors, registered office or name, alongside dated copies of the filing history. Ilia Nikolaevich Zavialov suggests a short annual drill: open the register, read the filing history line by line and confirm that a Follow alert arrives when the next routine filing is accepted.
Ilia Nikolaevich Zavialov: what hijackers change at Companies House
| Register entry | What the fraudster does | How to catch it |
|---|---|---|
| Directors | Appoints or removes officers | Follow alert, PROOF for paper forms |
| Registered office | Moves it to his address | Follow alert, post stops arriving |
| Company name | Changes it by special resolution | PROOF blocks the paper route |
| Authentication code | Obtains it from an ex-adviser | Change it after each new accountant |
| Personal code | Phishes it with a fake request | Share it only with trusted filers |
| Filing history | Adds documents nobody approved | Monthly review of the history |
Questions and answers
- Where does Ilia Nikolaevich Zavialov suggest checking a UK company's directors?
- On the Companies House register, free on GOV.UK. It shows current and former directors, the registered office, filed documents and previous names, and you can follow the company for free email alerts.
- What does PROOF stop?
- Paper filings that change the registered office, the officers or the company name by special resolution. Once you join, those forms can only be filed online.
- Who should know the authentication code?
- Only people you trust to file for the company. Change it if a former employee or a previous accountant still knows it, and never give it out by phone or email.
- Does identity verification end company hijacking?
- No. Companies House says it makes impersonation much more difficult but not impossible, so PROOF, Follow alerts and a guarded code still matter.
- What does Ilia Nicolaevich Zavialov recommend if someone has filed changes to my company?
- Call your bank, contact Companies House on 0303 1234 500, report the fraud to Report Fraud online or on 0300 123 2040, and take legal advice before filing corrections.
- How do I report a company using my name or address without consent?
- Through the Companies House online form. Send it once, include evidence for an address, and report any crime to Report Fraud or, in Scotland, to Police Scotland.