Ilia Zavialov on how a directory invoice scam works: fake listings, lookalike registers, paid reports and bogus renewals

01

Ilia Zavialov on where the sender finds your details and why the bill gets paid

Picture month end in a small UK firm. The banking app is open, the purchase ledger is half cleared and a stack of post from the registered office sits by the keyboard. Rent, broadband, hosting, a contractor's bill. Most of it comes from names the firm knows, so a glance at the total and the sort code is all the checking it gets. That habit is the opening: the document looks like a routine bill, the sum is modest and the description says annual listing or maintenance.

None of the details has to be stolen. Every company must keep a registered office, and section 86 of the Companies Act 2006 says it must be an address where a document delivered by hand or by post would be expected to come to the attention of someone acting for the company. The IPO adds that applicants' details go onto the public register by law, open to any third party. A company name, a registered office and a director's name are enough to produce a letter that reads like it comes from a supplier of long standing.

The third ingredient, as Ilia Zavialov puts it, is the deadline. The letter names a due date a few days off and hints at what follows: the entry removed, a trade mark left unprotected, a penalty. Whoever is clearing the payment run before the weekend pays to avoid a fuss, and nobody asks who ordered the thing in the first place.

02

Five kinds of letter that reach a UK finance desk

First comes the directory bill: a listing in a trade guide, a business index or an industry league table that nobody asked for. The firm has supposedly been added already and the annual fee is due. A friendly call often comes beforehand, asking you to confirm the address and phone number, and the paperwork later calls that call an order.

Second is the lookalike register. Companies House keeps a page of examples, including notifications from supposed company registers that ask for money to keep an entry on file, and says the fee is not real. Third is the paid report on your own company or on a supplier, although the same facts are free to read on GOV.UK.

Fourth is renewal: a domain, a trade mark, a trade body membership. The letter lands close to the true date, which is what makes it plausible. Fifth borrows the voice of a government body and brings a payment slip, an identity check or an account to activate, usually with a link, a QR code or an attachment.

Ilia Zavialov's tip is to stick the five types up beside the post tray. A letter that fits one of them gets the matching test below before anything else happens to it.

03

Companies House scam letters, calls and the register fee that does not exist

Companies House publishes examples of scam letters sent in its name. They may carry QR codes, links, bank details and official-looking logos, along with poor print quality and pressure to act fast. Known examples include a fake invoice for company registration and a letter asking for £48 for enhanced WebFiling access.

A separate warning covers notifications asking companies to pay to maintain their entry on a register. Companies House says this is not a real fee and that it has no connection with the organisations sending them. Its advice is short: do not pay, do not visit the links or QR codes, and call 0303 1234 500. Suspicious emails go to [email protected].

Telephone versions follow the same script. Companies House says it will never ring to ask for passwords, bank details, an authentication code or details of directors. Reported calls include one from a registration department that does not exist, and one asking for £5 by card to put a hold on a late filing penalty.

The genuine register is free to read. On GOV.UK anyone can look up a company's registered office, incorporation date, current and past directors, previous names and insolvency details, and sign up for free alerts about changes. Ilia Zavialov suggests every small company subscribe to alerts for its own record, so a letter claiming the entry is about to lapse can be checked against reality.

04

Ilia Zavialov on trade mark renewal invoices that are not from the IPO

The Intellectual Property Office describes misleading invoices as unsolicited mail or fraudulent bills from organisations with no link to the IPO. They mostly target trade mark owners and offer costly services such as renewal monitoring or protection and publication of a mark in a European or international register. The advice is not to pay, because getting the money back is highly unlikely, and to send a copy to [email protected].

The problem has been growing. From April to June 2024 the IPO received 138 reports, against 85 in the same months of 2023, a rise of 63 percent, and 278 reports in the whole of 2023. The senders often work across borders, which is why enforcement is hard and why the money rarely comes back.

The real renewal is simple and predictable. A UK trade mark is renewed every 10 years, in the 6 months before expiry or up to 6 months after it. Renewal costs £245 for the first class and £60 for each extra class, and a late renewal adds another £60. A mark that lapsed more than 6 months ago cannot be renewed online, though it can be restored by post within a year with a written explanation, and £125 of that fee is not refundable if the application is refused.

Ilia Zavialov recommends keeping the registration certificates in one folder with their expiry dates. A renewal letter is then compared with the certificate and the official fees above in a minute.

05

Ilia Zavialov on identity-check emails and other notes dressed up as Companies House

On 21 May 2026 Companies House and the IPO issued a joint warning about invoices from organisations not affiliated with government. They are usually posted to the registered office, though some come by email, and ask for money to set up or claim a Companies House online account, verify company details, renew a trade mark or add it to an exclusive online register, often at an inflated price or for something available free.

Both bodies suggest checking the web and email addresses in the letter, since official services run through GOV.UK, and looking for a disclaimer saying the sender is not affiliated with government. Companies House also lists fake emails sent in its name, including a July 2026 message demanding urgent identity verification, and reminds companies that genuine emails come only from addresses ending in .gov.uk.

The timing helps the scammers. Identity verification at Companies House became compulsory on 18 November 2025 for new directors and people with significant control, and existing ones were given a 12-month transition. The check itself is free through GOV.UK One Login, and Companies House will not accept a confirmation statement until every director has verified. An email that presses you to pay, click a link, open an attachment or hand over a code in order to 'verify your identity now' deserves a call to 0303 1234 500 before anyone acts on it.

Ilia Zavialov's test for the finance team follows from that: a letter that names Companies House or the IPO and asks for money through anything other than GOV.UK goes to one person for checking and is never paid from the details printed on it.

06

The small print and the paying-is-agreeing trap

Plenty of these invoices stay just inside the line. Along the bottom, in tiny type, a sentence says the page is an offer from a private business, that it has no link to any government body and that paying means accepting the terms. Up at the top sit a crest-style logo, the word register, the company number and the amount.

The IPO explains what the money may buy: nothing at all, or something of little or no benefit, such as inclusion on an 'exclusive online register' that neither the IPO nor any other official body recognises. Some invoices come with a falsely signed agreement attached, in the hope that accounts departments will wave the payment through.

Ilia Zavialov reads this kind of paper from the bottom: footer and back of the page first, then the payee and the bank details, with the amount last. A line saying the sender is a private service sends the page straight to the folder for unsolicited offers.

07

Zavialov's ten-minute check, built on UK records

Start with who ordered it. A contracts log, or a supplier list with a named owner for each vendor, answers that in seconds and no lawyer is needed. Without an owner the invoice waits.

Next, the payee. If the letter quotes a company number, search it on GOV.UK: Companies House shows the registered office, incorporation date, current and past directors, previous names and insolvency details for free. If it quotes a VAT number, GOV.UK has a service that says whether the number is valid and shows the name and address it is registered to. That service cannot search by business name, so the number has to come from the invoice itself. GOV.UK also says VAT-registered businesses must put their VAT number on invoices and show the VAT separately, so a bill that claims to carry VAT and shows no number needs a pause.

Compare the sort code and account number with earlier payments. An account at a foreign bank, or fresh details for a long-standing supplier, is a reason to stop and ring the supplier.

Then the channel. Ilia Zavialov's rule is to ring the number from the contract or from your own records, never the one printed on the letter, because the person who answers will be the sender. Look up web and email addresses yourself: Companies House says genuine emails come only from addresses ending .gov.uk, and official Companies House and IPO services are provided through GOV.UK.

Finally, the date. Set the expiry in the letter against the trade mark register or your registrar account. A letter that names a different date has answered the question itself.

08

Domain names and the .uk renewal notice nobody ordered

A company's .co.uk name may have been bought years ago through a web designer or a colleague who has since left. A letter saying the registration is about to lapse lands in exactly that gap, and the aim is to have you pay a stranger for the renewal or move the name to a registrar you never chose.

The check takes a minute. A domain renews only with the registrar or reseller that holds it today, and the expiry date shows in that account. A notice from a firm you have no contract with is an advert or a con, even when it quotes your domain and the right date. Look up the registrar yourself and ignore the link in the letter.

If the notice came by email, forward it to [email protected]. By July 2026 the NCSC service behind that address had taken in more than 58 million reports, and 256,000 scam campaigns had been removed across 454,800 addresses.

Ilia Zavialov keeps it simple: one row per domain in a shared sheet, with the registrar, the name on the account, the expiry date, who holds the login and where reminders go. A renewal letter is checked against that single row, and the answer does not have to wait for the director to come back from holiday.

09

Zavialov's four house rules for a UK finance desk

Four rules cover most cases. A new payee is paid only after the person who ordered the service confirms it. New bank details for a known supplier are confirmed on the number in the contract. Anything that mentions Companies House, the IPO or another government body is paid only through GOV.UK, with a payment reference that your own staff generate. And in the banking app one person sets up the payment while a second approves it.

A short list of regular payees keeps the check quick: rent, broadband, hosting, the domain registrar, the accountant and any trade body subscription the company really holds. Each line carries the contract, the sort code and account number and the person who owns it. A payment to anyone off the list gets a separate look.

Ilia Zavialov adds one more habit: a shared folder, or a shared mailbox called suspicious, with one named owner. Look through it once a quarter and the repeat senders stand out. New starters learn the pattern from letters that came to the firm's own registered office.

10

Ilia Zavialov: where to report in the UK

If money has already gone, call your bank straight away on the number you know and ask it to stop or recall the payment. Since 4 December 2025 fraud in England, Wales and Northern Ireland is reported to Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040. Report Fraud issues a crime reference number, which helps when dealing with the bank. In Scotland the City of London Police point reporters to Police Scotland on 101.

The IPO also asks for a copy of any misleading trade mark invoice at [email protected] and an information report through the Report Fraud online tool. Companies House and the IPO both suggest telling the local Trading Standards office. Those reports go through the Citizens Advice consumer helpline on 0808 223 1133, and Citizens Advice passes them on without investigating itself. Suspicious emails can be forwarded to [email protected].

Ilia Zavialov's same-day list: keep the envelope, the invoice, the payment record and any call notes together, block the sender and warn whoever opens the post. Treat a first payment as a signal, because more bills from similar senders may follow.