Ilia Zavialov on a company's digital signature and logins: how they are stolen, how directors are swapped and how money leaves

01

Why the director's digital signature became the key to a company

A director's digital signature or company login used to be a formality for filing reports. Today it signs contracts, submits tax returns, opens the online bank, sends filings to the companies register and grants authority to staff. Whoever holds it acts for the company in all of these places at once.

That is why criminals no longer need to break into the whole finance department. It is enough to obtain the signature, the login that stands in for it, or the right to use it. From there they can move money from the account, change bank details in contracts, file a change of director and sign obligations that the company will spend months disputing.

Ilia Zavialov looks at how a signature leaves a company, which scenarios are the most common and which storage rules close most of them. The focus is on small teams where two or three people use the signature and nobody works on security full time.

02

The call from the certificate provider

A typical scenario starts with a call. The caller says they work for the certificate provider or the tax office and warns that the signature certificate is about to expire, and without renewal the company will not be able to file or pay. Such calls come in the last days before a filing deadline, when the accountant is already working against the clock.

The caller then asks for a code from a text message, sends a link to a renewal page or asks the accountant to install a program so that a specialist can do everything remotely. Each of these steps hands a stranger either access to an account or control of the computer that the signature token is plugged into.

The team rule fits on one line: renewing a signature never starts with an incoming call. Any conversation about a certificate, a code or installing software ends with the words I will call you back, after which the employee finds the provider's number on its official website or in the documents received when the signature was issued.

03

An email to the accountant and a remote access program

The second scenario arrives by email. The accountant receives a reconciliation statement, a demand from the tax office, an invoice from a supplier or a notice of an inspection, and the attachment is an archive or a document that asks to enable its content. Opening it installs a program that gives the attacker remote control.

The danger is that this computer usually holds everything at once: the signature token plugged in for the whole day, the online bank left open and saved passwords. The attacker waits for the evening, connects and sends a payment on behalf of the company, signed with the real signature of the real director.

In this situation the bank sees an ordinary payment with a valid signature from a familiar computer. Protection therefore has to be in place in advance: the token comes out after work, the online bank runs on a separate device, and attachments from unknown senders or unexpected letters from authorities are checked by phone on a known number before they are opened.

04

A change of director: how a whole company is hijacked

The heaviest scenario is aimed at the company itself, and money from the account is only the first step. With a stolen signature or a forged authority, criminals file a change of director or shareholder with the register. By the time the real owner finds out, the new director is already opening accounts, signing contracts and withdrawing money.

Signs of such a hijack appear in public records before they appear at the bank. A stranger's name shows up in the register extract, the address changes, a new authority appears in the company's file. If nobody on the team reads the extract regularly, the first signal is a call from a counterparty or a letter from the bank about a frozen account.

For a small company the main defence here is organisational. You need to know who can file on the company's behalf and where, to watch for changes in the register and to use the safeguards that the state in your country offers, such as identity checks or bans on filings without the owner. The local section below covers them.

05

Identity checks at Companies House

Since 18 November 2025 identity verification at Companies House has been compulsory for new directors and people with significant control, with a 12 month transition for existing ones. More than 1.5 million people had verified voluntarily before the launch, and by 30 June 2026 7,364,599 appointments had been verified, 49.68 percent of all those required, including 4,710,086 directors.

The checks have teeth. Companies House will not accept a company's confirmation statement until all directors have verified their identity, and verification through GOV.UK One Login is free. Companies House also advises changing the company authentication code if it is known by someone no longer entitled to file, such as a former employee or a previous accountant.

06

Authorities, tokens and a shared PIN

In a small team the signature is often used in turns. The token lives in a desk drawer, the PIN is written on a sticky note or sent in a messenger, and an authority to sign is held by an employee who left long ago. Each of these habits is convenient, and each turns the director's signature into a shared key that is hard to revoke.

An authority to sign is especially treacherous. It allows the holder to sign for the company and stays valid until the date written in it, even after the person has left. When an employee leaves, revoke the authorities issued to them and any signature certificates issued in their name for company work, together with their access to email and the online bank.

A shared PIN makes any investigation impossible. If three people used the signature, the transaction log can no longer show who sent a payment. Everyone who signs documents should therefore have their own signature within their own powers, and the director's signature should stay with the director.

07

Hijacked companies and fake Companies House emails

Companies House says fraudsters hijack companies by changing the details of directors and the registered office, and that it deals with around 50 to 100 cases of corporate identity theft every month. In 2025 to 2026 it stopped 26,797 suspicious filings from reaching the register, against 10,588 a year earlier, and took action against 157,679 companies. Between March 2024 and 31 March 2026 it removed 151,000 registered office addresses used without consent.

Even the registry's own systems have had gaps. Between 11 October 2025 and 13 March 2026 a defect in a WebFiling update allowed a signed in user to change another company's records, and the investigation found a very small number of such cases. Companies House also keeps a page of fake emails sent in its name, including a July 2026 message demanding urgent identity verification, and reminds companies that genuine emails come only from addresses ending in .gov.uk.

08

Rules for storing a signature in a small team

The first rule concerns the token. The signature is kept on a protected token that is plugged in only while it is being used and removed straight afterwards. The token never stays in the computer overnight and is never handed over together with its PIN. The PIN itself is stored apart from the token and never sent in a message.

The second rule concerns the computer. The online bank and the services that use the signature are best opened on a separate device that is not used for email or attachments. If there is no separate device, the work computer should have no remote access programs that the employee did not install with the director's agreement.

The third rule concerns money. At the bank, switch on approval of payments by a second person, limits on amounts and alerts on the director's phone for every login and every transaction. Even a stolen signature does not move money if a large payment needs a second approval and the owner sees the login attempt the same minute.

09

What to check once a month

A regular check takes half an hour and closes the most expensive scenarios. Once a month, open the register extract for your company and compare the director, shareholders, address and business activities. Any discrepancy means an immediate call to the registration authority.

On the same day, review the list of valid signature certificates and authorities. A certificate issued without the director's knowledge or an authority in a stranger's name has to be revoked that day. If the certificate provider or the bank sends notices about new certificates, route them to an address the director actually reads.

The last item concerns the bank. The list of devices and users in the online bank, the login history and the current limits show whether someone extra has appeared. Remove former employees, old phones and forgotten accounts at once, even if nothing suspicious has happened yet.

10

If the signature is already in the wrong hands

When there is a suspicion that an outsider has used the signature, time is counted in hours. First call the bank on the number in your contract and ask it to block access to the online bank and all outgoing payments until the matter is clear. Money that has not yet left the account is the easiest to save.

Then ask the certificate provider to revoke the certificate. While it is valid, documents signed with it look legitimate, so revocation cannot wait for the end of the investigation. At the same time change the passwords for email, the online bank and government accounts, and remove remote access programs from the computer.

After that, check the register, the tax account and the bank for filings and documents signed on behalf of the company. Record everything you find with dated screenshots: these materials will be needed for the police report and for disputes with counterparties who received documents in the company's name.

11

Protection and where to report in the UK

The free PROOF scheme blocks paper forms that change the registered office, appoint or remove directors or change the company name, so a fraudster cannot use them against your company. Read every filing alert, compare the register entry with your own records once a month and keep the authentication code with the same care as a bank PIN.

Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. Suspicious emails can be forwarded to report@phishing.gov.uk, and fake messages using the registry's name to Companies House itself.