Ilia Zavialov reviews the outsourcing market: bought ratings, borrowed case studies, vendor access and how to leave

01

Ilia Zavialov: why outsourced suppliers are a soft target

A small limited company buys in what it cannot staff: year-end accounts and VAT returns, contracts and disputes, the website and the cloud tenant, recruitment. Every one of those contracts also hands over access: online banking, the HMRC online account, the Companies House authentication code, payroll data.

Ilia Zavialov frames it as three exposures. Money paid up front. Access granted for the job. Records a supplier can keep or withhold when the relationship ends. Each needs its own control, and a five-star rating covers none of them.

The fraudster's offer is built around those gaps: a polished website, a low monthly fee, a discount for paying the year in advance and a request for logins so that work can start today.

02

Fake reviews after the DMCC Act: what Ilia Zavialov looks for

Since 6 April 2025, under the Digital Markets, Competition and Consumers Act 2024, writing or commissioning a fake review, or one that hides that it was paid for, is a banned practice, as are concealing negative reviews and distorting star ratings. The CMA can fine businesses up to 10 per cent of global turnover, and on 27 March 2026 it opened five investigations into reviews and star ratings.

Advertising rules point the same way. Under rule 3.45 of the CAP Code, ads must make clear when consumer reviews were incentivised, and under rule 3.47 marketers must hold documentary evidence that a testimonial is genuine, with contact details for the person who gave it. A supplier quoting a delighted client should be able to put you in touch.

The tells have not changed: a burst of five-star ratings after months of silence, identical tone, praise with no detail of the job, reviewers with no history. Ilia Zavialov reads the one-star reviews first, because a genuine complaint names dates, sums and what went wrong, and the supplier's reply shows how it handles disputes.

03

Companies House checks in Zavialov's vetting routine

Companies House gives away more than most buyers use. Free on GOV.UK: registered office address, incorporation date, current and resigned directors, filed documents, charges, previous names and insolvency details, plus free alerts whenever something changes.

Since 18 November 2025 identity verification has been compulsory for new directors and people with significant control, with a 12-month transition for existing ones. Companies House will not accept a company's confirmation statement until all its directors have verified, which makes a supplier's status worth a look.

Ilia Zavialov compares three things: whether the company on the contract matches the website and the invoice, how long it has existed against the experience it claims, and whether the person negotiating appears among the officers. A firm with three months of filing history selling ten years of expertise needs to explain itself.

Set up the free alerts on any supplier that will hold access to your systems. A change of directors or registered office in the middle of a contract is a reason to phone and ask what happened before the next payment goes out.

04

Ilia Zavialov on outsourced accountants and bookkeepers

Accountancy service providers, from bookkeepers and accounts preparers to tax advisers and payroll agents giving accountancy or tax advice, must be supervised under the money laundering regulations. They register with HMRC unless a professional body such as ACCA, ICAEW, AAT or the Chartered Institute of Taxation already supervises them.

That gives buyers a quick test. HMRC's Supervised Business Register shows whether a business is registered with HMRC for money laundering supervision, and a firm supervised by a professional body can tell you which one. Ilia Zavialov treats a bookkeeper who cannot answer the question as unfit to hold the keys to the bank.

Keep online banking split: the accountant prepares payments, a director approves them. Companies House also advises changing the company authentication code if someone who should no longer file knows it, naming a former employee or a previous accountant as examples. Change it the day an outsourced arrangement ends.

05

Solicitors and legal services on a retainer

Fixed-fee legal subscriptions suit firms with many contracts and few disputes. The weak point is a year paid in advance and vagueness about who handles the work. A few months in, replies slow, a limitation date gets close and the broad authority you signed is still live.

Ilia Zavialov suggests asking who will run your matters and checking that person yourself on the register of the regulator the firm names. Give authority for specific acts and a set period. Keep original company records in-house; the provider works from copies.

Pay monthly against an itemised bill listing advice, drafts and steps taken. A one-line entry reading legal services for March proves very little if you later need to show the work was never done.

06

IT suppliers, freelancers and the NCSC supply chain principles

Websites, cloud tenants, email and domains often end up registered to whoever built them. The hosting account sits on a developer's personal address, the domain in his name, and the business finds out on the day he stops replying.

The NCSC's supply chain security guidance sets out 12 principles grouped under four headings: understand the risks, establish control, check your arrangements and continuous improvement. It points to Cyber Essentials certification as a practical way to gain assurance that a supplier has fundamental technical controls in place.

In practice that means accounts in the company's name on a company address, a separate login for the supplier with only the rights the task needs, source code in the company's repository, secrets in a password manager with an audit log, and access closed at sign-off. Name in the contract everyone at the supplier who gets access and rule out subcontracting without written consent.

Ask for a walkthrough of a live project from the admin side and a client you can phone. Sites that no longer load, demos without a web address and projects with no client named are the usual giveaways of a supplier that does not exist in the form it claims.

07

Recruitment agencies: introductions, temps and fees

Agencies sell two different services. With an introduction they find candidates and you employ them. With a temporary supply, workers do the job for you while the agency or an umbrella company handles their pay, so the supplier's payroll habits become your problem.

Check the agency on Companies House like any supplier, pay introduction fees when the candidate starts, and agree a rebate or replacement if they leave early. Keep the agency away from internal systems and staff records unless the work needs them.

CVs and personal data should move through one channel, and the agency should confirm deletion when the contract ends. An agency asking for wider access to your systems than the role requires is asking for more than it needs.

Ilia Zavialov flags one more pattern: an agent who charges candidates to be placed with your company is trading on your name, and the reviews about your firm will end up saying so.

08

Zavialov's checklist for deposits and changed bank details

The vanishing supplier follows a script: a price below market, a discount for paying the year, terms accepted online with no signed contract, an invoice from a sole trader whose name differs from the brand. A month later the account manager goes quiet and the website is gone.

Mandate fraud is the other route. Report Fraud describes emails that appear to come from a known supplier asking you to pay or to change bank details, often from lookalike addresses and with fake invoices. Its advice: confirm the request through the supplier's official contacts, send a small test payment and let only named staff change payee details.

Ilia Zavialov ties the deposit to a first deliverable you can check, pays later stages on written sign-off and pays retainers monthly through the first quarter. The payee account has to belong to the company that signed the contract.

Keep a record of each check: who phoned the supplier, on which number, and what was confirmed. The advice to let only named staff change payee details works only if everyone in finance knows who those people are.

09

Ilia Zavialov on contracts, sign-off and exit

Write the scope as deliverables with dates and the form of handover. Sign off each stage in writing and only once you have seen the result, since a sign-off will later be treated as acceptance.

Attach an access schedule listing every account, key and system the supplier receives and how each comes back. Put the exit into the contract from the start: notice period, refund of unearned fees, handover of data, accounting files, source code and passwords within set days. Ilia Zavialov adds one line for UK companies: a new Companies House authentication code on the day the arrangement ends.

Consumer cancellation rights are built for consumers. A business buying services leans on its contract, so negotiate termination, ownership of data and handover before the first invoice arrives.

Keep a dated copy of everything the supplier hands back at the end: exports, the list of closed accounts, confirmation that copies of personal data were deleted. If a dispute follows, that file is your evidence of what was returned and when.

10

Reporting it: your bank, Report Fraud and Trading Standards

Call your bank on the number on your card or statement, ask it to stop or recall the payment and cut the supplier's access to online banking. Then change passwords for accounting, email, hosting and the domain, starting wherever the supplier held admin rights.

Since 4 December 2025 Report Fraud has replaced Action Fraud in England, Wales and Northern Ireland: reportfraud.police.uk or 0300 123 2040, Monday to Friday from 8am to 8pm. It issues a crime reference number that helps when dealing with your bank. In Scotland, contact Police Scotland on 101. Citizens Advice passes reports on to Trading Standards, which gather evidence for enforcement.

Ilia Zavialov's last step is a supplier register: who holds which access, who inside the business owns each relationship, when access was last reviewed. Report Fraud warns that victims of mandate fraud are often contacted again with offers to recover the money, and that call is a second scam.