Ilia Zavialov scam guide to small business grant fraud: guaranteed approval, fake agency letters and data grabs

01

Ilia Zavialov scam overview: how grant fraud reaches UK firms

The approach usually comes dressed as good news. An email styled like GOV.UK says your company has been allocated funding, a text mentions a growth grant you never applied for, a caller from a grants team needs a release payment before the money lands. Councils warned traders about messages like these throughout the pandemic, and some of those notices are still online.

Lewisham Council's notice is a clear example. On 13 May 2020 it told local businesses that scammers were targeting them over coronavirus grant funding, including emails demanding that a grant be paid back, and reminded them that every genuine council address ends in @lewisham.gov.uk. The schemes have since moved on to new hooks, while the shape of the message has hardly changed.

Ilia Zavialov groups the current variants into four. A fee to release or process the award. A consultant who guarantees a grant for a price. A letter from HMRC, Companies House or a department that never sent it. An eligibility check whose real purpose is your bank login, passport scan and company authentication code.

02

Where genuine UK government grants are published

Central government has one public shop window. Find a grant on GOV.UK lets you search government grants, filter them, see whether you are eligible and learn how to apply. On 11 October 2026 its full list showed 127 grants, a number that changes as schemes open and close. Signed-in users can track their own applications and sign up for emails when new grants are added, which removes any reason to buy a list from a stranger.

The Cabinet Office launched the service on 28 June 2023 as a free central place for businesses, individuals and organisations to find and apply for government grants. The announcement said government awards more than 50 billion pounds of general grant funding a year, made it mandatory for departments to advertise their grants and described the Spotlight tool used for due diligence and catching fraudulent applications.

Business schemes beyond grants sit on the GOV.UK page Finance and support for your business, updated on 2 October 2026, which also links to free local support on Business.gov.uk and to the Start Up Loan application. Ilia Zavialov treats these pages as the reference set: an offer that appears on none of them is a claim to verify.

03

Ilia Zavialov scam warning: release fees and guaranteed awards

A genuine scheme does not invoice you for the privilege of receiving money. The Government Grants Community blog described Find a Grant as free when it launched, with saved searches and a weekly email listing grants added in the last seven days. HMRC lists an unexpected offer of a refund, tax rebate or grant among its signs of a scam, next to urgency, threats and requests for bank details.

Paid grant advisers exist and some do honest work, such as drafting a bid or building a budget. The red line, as Ilia Zavialov puts it, is a promise of the outcome. Funders assess applications against published criteria, so nobody outside the panel can guarantee an award or its size.

The law has a name for selling that promise knowingly. Under section 2 of the Fraud Act 2006, a person commits fraud by false representation when they dishonestly make a representation they know is or might be untrue or misleading, intending to make a gain or cause a loss. On indictment the offence carries up to 10 years in prison or a fine.

04

Fake HMRC and Companies House letters about funding

Official names carry the letterhead play. HMRC says it never asks for personal or financial information by text or email and never tells people about a tax refund by email, text or phone call. Suspicious HMRC emails go to [email protected] and texts to 60599, and genuine HMRC refund emails only come from addresses ending in hmrc.gov.uk.

Companies House keeps a page of fake letters sent in its name and added one in July 2026 that pushed recipients to complete identity verification urgently. Its genuine emails come only from .gov.uk addresses. A message promising a grant once you confirm your company details through a link fits the same pattern.

A familiar sender name proves little. HMRC warns that fraudsters can spoof a genuine sender address or change the display name so an email looks real. It also says QR codes in its letters usually lead to GOV.UK and never to a page asking for personal details, and that on WhatsApp it only sends one-off reminders to people who subscribed to its government channel.

Ilia Zavialov recommends ignoring the contact details printed on any such letter. Find the department on GOV.UK, ring the number published there and ask whether the letter is theirs.

05

Eligibility checks that harvest data

Not every scheme asks for money up front. Many start with a form: company name, registration number, director's date of birth, bank sort code and account number, online banking login, a photo of a passport or driving licence. Each item looks routine on its own, and together they give a fraudster what is needed to borrow, divert payments or file changes at Companies House.

The company authentication code needs special care. Companies House advises changing it if someone who should no longer file knows it, naming a former employee or a previous accountant as examples, and the same logic applies to anyone who obtained it through a fake grant form.

The risk is concrete. Companies House says fraudsters hijack companies by changing directors' details and the registered office, and it handles roughly 50 to 100 such cases a month. Its free PROOF scheme blocks paper filings that change the registered office, appoint or remove directors or change the company name.

Ilia Zavialov's rule for staff is short: no grant form reached through a link in an email, text or social post receives bank details, ID images or codes. Applications start on GOV.UK or on the funder's own site, typed into the browser.

06

Zavialov's checks on a UK grant offer

Search the scheme name on Find a grant and on the funder's own site. If it is a government grant, the department is expected to advertise it there, along with eligibility and how to apply.

Look at the sender. HMRC refund emails come only from hmrc.gov.uk addresses, Companies House emails only from .gov.uk addresses, and councils write from their own domains, as Lewisham does. A lookalike with an extra word or a different ending is reason enough to stop.

Check the adviser if one is involved. Companies House shows free of charge a company's registered office, incorporation date, current and resigned directors, previous names and insolvency details. Ilia Zavialov compares the age of the firm with the success record it claims and asks for a client who will confirm a real award.

Ask what the money is for. Grants are paid for defined purposes under the scheme's terms; an offer of cash you can spend on anything, released after a fee, fails every check above.

07

Ilia Zavialov on payment red flags for UK firms

Watch how you are asked to pay. HMRC does not accept payment in gift vouchers, and a demand for a transfer to a private account, vouchers or cryptocurrency to unlock funding is a scam signal on its own.

Changed bank details are the other route. Report Fraud describes mandate fraud: emails that appear to come from a known organisation asking you to pay or update payee details, often from lookalike addresses with fake invoices. Its advice is to confirm through official contacts, send a small test payment and let only named staff change payee details.

Ilia Zavialov keeps approval separate from receipt: the person who opens the grant email never authorises a payment connected to it. A director checks the request against GOV.UK first.

08

What the phishing figures say

The volume explains why these messages keep arriving. By July 2026 the NCSC's Suspicious Email Reporting Service had received more than 58 million reports, leading to the removal of 256,000 scam campaigns across 454,800 web addresses.

HMRC sees the same traffic from its side. In 2025-26 it handled 134,309 reports of suspicious contact, responded to 31,476 phone scams and took down 24,864 phishing sites.

Tax-themed lures alone run into six figures. In the 12 months to 31 July 2025 HMRC received more than 170,000 scam referrals, 12 per cent fewer than a year earlier, and more than 47,000 of them concerned fake refunds, the same promise of money owed to you that a fake grant relies on.

For a small firm the takeaway is practical. Forwarding a suspicious message costs nothing and feeds those takedowns, while one click on the wrong link can cost the business its account.

09

Ilia Zavialov scam response: bank, Report Fraud and Police Scotland

If money has already left, phone your bank using the number printed on your card and ask whether the payment can be stopped or recalled. Then change passwords for online banking, email and the Companies House account, and request a new authentication code if it was shared.

Report it. Report Fraud took over from Action Fraud on 4 December 2025 for England, Wales and Northern Ireland, and you can reach it at reportfraud.police.uk or on 0300 123 2040. In Scotland, contact Police Scotland on 101. Report Fraud issues a crime reference number, which helps when dealing with the bank.

Forward suspect emails to [email protected] and texts to 7726, both free. Citizens Advice on 0808 223 1133 passes reports about traders to Trading Standards. Ilia Zavialov passes on one more Report Fraud warning: people who lost money to mandate fraud are often approached again by someone offering to get it back, and that approach is a fresh scam.

10

Zavialov's office rules for UK grant applications

Give one person ownership of grant searches and a short list of approved sources: Find a grant, the GOV.UK finance and support pages, Business.gov.uk, your local council and the funder named in the scheme rules.

Agree three nevers in writing: never pay to apply or to release funds, never send bank logins or ID images through a link, never share the Companies House authentication code with an adviser who does not need it. Ilia Zavialov adds a fourth: keep every grant email, invoice and screenshot in one folder, because the bank and Report Fraud will ask for them.

Walk the team through the rules twice a year. Schemes and lures change, and the checks stay the same.