Share this content
25

Companies House email

Companies House email

Didn't find your answer?

A couple of days ago I changed a companies ARD at Companies House via web-filing.

Today, I (and my employee was CC'd) have received this email from "web-filingATcompanies-house.gov. uk". The case number does not match the submission number, also when I view the source of the link, it points to "wavetecbrasil.com/solve/index". Does this mean our email is compromised (we use a hosted exchange server), or do you think the email is speculative?

-------------------------------

A company complaint was submitted to Companies House website.

The submission number is: 90909090
 For more details please click:  wavetecbrasil.com/solve/index (number amended by me)
[and link deactivated by Editor]

Please quote this number in any communications with Companies House.

All Web Filed documents are available to view / download for 10 days after their
original submission. However it is not possible to view copies of accounts that
were downloaded as templates.

Companies House Executive Agency may use information it holds to prevent
and detect fraud. We may also share such information, for the same purpose,
with other organisations that handle public funds.

If you have any queries please contact the Companies House Contact Centre
on +44 (0)303 1234 500 or email [email protected]

Note: This email was sent from a notification-only email address which cannot
accept incoming email. Please do not reply directly to this message.

Companies House
4 Abbey Orchard Street
Westminster
London
SW1P 2HT
Tel +44 (0)303 1234 500 
 

Replies (25)

Please login or register to join the discussion.

d
By puzzel
19th Feb 2014 10:59

On the move?

Did not know Companies House had changed its address, but not the phone number. Very strange.

Thanks (0)
By petersaxton
19th Feb 2014 11:03

It's the London office

It's a scam

Thanks (0)
By ShirleyM
19th Feb 2014 11:08

I know it's a scam

Scam emails usually go to a single email address. It seemed odd that my employee should be CC'd in, and that's why I wondered if our email exchange server had been compromised.

Thanks (0)
Stepurhan
By stepurhan
19th Feb 2014 11:12

Compromised?

Worth getting your IT people to check anyway as a precaution.

However, does you website show all the CCed employees e-mail addresses on it? If so, it is far more likely that all those e-mail addresses have been picked up from the website and mass mailed in the hope one of them will action it.

Thanks (0)
By ShirleyM
19th Feb 2014 11:26

Thanks, Stepurhan

My email address doesn't appear on our website, so that wasn't the source.

It is my email address that is used for Companies House communications, but they don't have my employees email address. I am curious as to how they linked up the two. I don't know enough about this sort of thing, and it drives me potty when I can't work it out.

Thanks (0)
avatar
By TerryD
19th Feb 2014 11:31

SCAM!

It's definitely a scam. We got a few of these back in September/October. It contains an attachment with a zip file. In my experience, that alone confirms it as a scam!

Thanks (2)
Stepurhan
By stepurhan
19th Feb 2014 11:51

Mystery source then

Could be your server is compromised, so worth checking. More likely someone who has all the CCed addresses has been compromised. You'll never know for sure.

Thanks (0)
By ShirleyM
19th Feb 2014 12:12

oops!

Just received another, but no CC this time!

Looks like I'm the favourite for todays scams. ;)

Thanks (0)
John Stokdyk, AccountingWEB head of insight
By John Stokdyk
19th Feb 2014 12:51

Phishier than a Brazilian trawler

Thanks for your post, Shirley - everything about the message is wrong, as you found when you hovered over the supposed Companies House weblink.

I actually went in and removed the automatic link just to prevent the possiblity of someone getting a drive-by infection from pressing the link (and to reduce any traffic from our site to theirs).

This one has been in circulation since September, when JC raised the alert in Any Answers and is the latest in a series of increasingly plausible spoof mails that have been sent to accountants in recent months and has been in circulation 

HMRC has been ramping up its anti-phishing defences (and education) because of the risk from bogus tax returns, but Companies House too has long been a favourite target, because of the potential to hijack company addresses and directors to siphon off payments.

Their advice is to forward any unsolicited email message to [email protected] and then delete it.

Spammers can get your email address from all sorts of places, so they don't necessarily have to have infiltrated your mail host. But it's worth checking with your provider, and potentially asking if they have facilities to filter out the worst and most obvious spam messages before you get them. Even if you still do that, you'll still need to be vigilant about not responding to plausible phishing messages that do get through.

Thanks (1)
avatar
By Carolynne
19th Feb 2014 13:04

I've had one today

I have had two of these emails this week alone, and repeatedly get them saying they are from Companies House, one supposedly from HMRC today, regarding a tax refund being due, I get them from supposed HMRC sites, thanking me for submitting my vat return reference number xxxxx.  Also re: payroll submissions saying received but not able to process.  Most of these have tell tale signs of either a 'link' to click (to download their virus), or a ''zipped' attached file to open. 

I only started to get them,after I had a virus on my PC which was cleaned up.  I now receive at least 1 of the above types per day and it really is getting me down.  I move the sender to my junk mail folder but still find it time consuming.

Does anyone know how to block so as not to receive even into my junk folder, in Outlook?

Thanks (0)
By ShirleyM
19th Feb 2014 13:12

Hosted Desktop UK host our exchange server

They filter out a lot of junk and suspicious emails, but these scam emails are getting through.

Thanks, John, for fixing the link. I did try to stop it being used by changing the reference number, but didn't know how to paste it in without it being an actual link. Is it easy to do?

Thanks (0)
By Marion Hayes
19th Feb 2014 13:19

Some are not scams so blocking is dangerous too

I posted the other day about an email I had received asking me to access a link

https://www.accountingweb.co.uk/anyanswers/question/email-customer-and-stakeholder-team 

They have rung me this morning to remind me  TTTThey have rung me this morning and reminded me that I volunteered to test a new system for them on my personal records. They saw my post and wanted to reassure me about the email, supplied enough information for me to look back in my inbox so I know it is real.

Apologies if I have made anyone disregard a similar email

You can pm me for the contact details of the testing teams if you want to check your own position

Thanks (0)
avatar
By DMGbus
19th Feb 2014 13:59

London address

As it happens Companies House DOES have a contact address in London:

http://www.companieshouse.gov.uk/contact/contactUs.shtml

However the similar eMails that I (and colleagues) have received past day or two have the tell tale signs of a virus being attached, ie. a .zip file.

As a variation on a theme here's details of another .zip attachment eMail received by me today:

HM Revenue tax rebate 

HMRC [[email protected]]

Then name at eMail address,

 

After the last yearly computations of your financial functioning we have defined that you have the right to obtain a tax rebate of 934.80. Please confirm the tax rebate claim and permit us have 6-9 days so that we execute it. A rebate can be postponed for a variety of reasons. For instance confirming unfounded data or applying not in time.

To access the form for your tax rebate, view the report attached. Document Reference: (92054568).

Regards, HM Revenue Service. We apologize for the inconvenience.

The security and confidentiality of your personal information is important for us. If you have any questions, please either call the toll-free customer service phone number.
© 2014, all rights reserved 

Problem is that the senders are using fake eMail headers so that having filed a company amendment at Companies Gouise there IS an expectation of a reply from Companies House.

However, as always there's at least one of the following indications of foul play:

#  A .zip attachement.

#  A link that when the mouse pointer hovers over it shows a webpage that's highly unlikely to be from or connected with the genuine authorities.

My greatest concern is that clients could receive such eMails and not be aware of the problem.

It appears to me that as these fake eMails are directed at firms of accountants rather than individuals then there is a suspicion that Government departments have been hacked - I use about 8 (eight) eMail addresses and only one (a company one) gets these eMails.

 

 

 

 

 

 

 

Thanks (0)
Replying to newmoon:
avatar
By the_Poacher
23rd Feb 2014 14:39

Literacy standards?
I know that literacy standards in HMRC have plummeted in recent years but surely no one at HMRC would send an email like that?

Thanks (0)
John Stokdyk, AccountingWEB head of insight
By John Stokdyk
19th Feb 2014 15:13

I just got one too!

Pretty much when I was typing out my earlier reply one of these landed in my in-tray. It actually helped a bit to assess how clever the attempt was - not very...

I think the bogus links and references in the message are irrelevant, what they want you to do is click the ATT0001.txt attachment to download a trojan horse virus.

Some of the anti-virus sites are identifying the messages as carriers for the dreaded CryptoLocker virus, as Tony Margaratelli from ICPA warned on AccountingWEB in December. This is a particularly nasty blackmail virus that encrypts all the data on your computer and threatens to destroy the only decryption key unless you pay up within 72hrs. In some cases, people have paid, but never got the key anyway.

There's a very technical, but authoritative summary available from bleepingcomputer.com

Thanks (0)
avatar
By landscaper
19th Feb 2014 16:26

Me too

A day after I had filed some change of details at companies house - so if you weren't concentrating hard enough it would be easy to assume it was real. 

Thanks (0)
avatar
By amosprophet
19th Feb 2014 16:50

companies huse scam emails

Hi

I received one the other day.

I looked at companies house website where I found out it was a scam. I didn't get the zip file attachment . Anyway I deleted the email immediately after that

 

 

Thanks (0)
avatar
By spellinn
20th Feb 2014 14:08

Phishing

I had one of these too, and forwarded it to [email protected] - which promptly bounced!

I contacted companies house to let them know their advice on their website was leading to a non-existing email address and "someone from the web team will look into it"

 

Thanks (0)
avatar
By pauljohnston
20th Feb 2014 14:14

Clients!

They forward those emails to me....

Thanks (0)
avatar
By ashbury
20th Feb 2014 14:21

Companies House and HMRC Scam Emails

These aren't just going to accountants. I have had several saying that a 'company complaint' has been filed against a personal blog that I run that has no link whatsoever to a limited company. I have also had several from 'HMRC' informing me that 'according to my recent fiscal activity' I'm entitled to a tax refund. People don't need to get paranoid about being selected for phishing emails. Everyone in the real world who runs one (or more) email accounts gets this stuff all the time nowadays so you're not unique. No, your email is unlikely to have been compromised but no harm in getting it checked if you can. Just make sure that you (and your employees) are aware of what such emails look like and that anyone who is responsible for things like on-line banking and web-filing knows what to look for and what to do when when they arrive in your/their inbox. That way you won't end up getting your company bank account emptied like a SME was reported to have recently because your bank (on that occasion Natwest) will not be held responsible.

Thanks (0)
avatar
By Michael C Feltham
20th Feb 2014 14:26

Waste Of Time!

Advising supposed business or government organisations of Phishing, is an utter waste of time.

Our practice mailserver is hit many times a day with fake messages which carry malicious code or point the naive users to a website which then instantly plants key loggers, trojans etc.

The first step is to ALWAYS check out the "Properties" of the sender: even where the header allegedly shows an email alias of credibility.

For example, this morning I received a mail purporting to emanate from a web fax service.

All apart from the reality of the practice fax number being on the "Contact Us" page on the website, the mail source when I drilled down stated:

From: "[email protected]"

However it actually came from "[email protected]"

Now if a client, say, did not possess a fax machine and wanted to fax a document, then they could perhaps scan and use a webfax service: however my clients would scan and email!

Shredded!

I receive waves of the scam Companies House mails.

Now, the ONLY email addresses published by Co's House are here:

http://www.companieshouse.gov.uk/about/tellUs_complaints.shtml

Now if they respond to you over a complaint, then the logical email alias will be probably: "[email protected]".

Thanks (0)
Image is of a pin up style woman in a red dress with some of her skirt caught in the filing cabinet. She looks surprised.
By Monsoon
20th Feb 2014 14:30

Loads and loads of these

I've lost track of all the different ones.

Fake CoHo filing receipts, fake CoHo complaints, fake HMRC tax refunds, VAT return can't be processed, FPS can't be processed etc etc. I just bin them all. Anything with a ZIP file is suspect unless it's from a source you can verify.

I do worry about lay people though - some of the emails look scarily realistic.

Thanks (0)
By petersaxton
22nd Feb 2014 18:28

We know

"As it happens Companies House DOES have a contact address in London:

http://www.companieshouse.gov.uk/contact/contactUs.shtml"

but it's very much for the public visiting and dropping off paperwork without departments who do the real action.

 

Thanks (0)
avatar
By Stalytax
24th Feb 2014 18:32

Another fake email.

I got a Companies House 'complaint' one last week. No zip file, but no company named either, which made me suspicious. It came via my website contact address, and the sender's IP address in the header led back to that well known CoHo HQ in Chennai, in the Tamil Nadu region of India.  

Thanks (0)
avatar
By garryh
25th Feb 2014 10:02

A Dangerous Bogus Email - Delete!!

The Companies House email that Shirley refers contains a dangerous virus if the link is clicked on. My client received this email last week which was copied internally and unfortunately curiosity caused a member of staff to open the link and within a short time the virus had worked its way onto the Server and corrupted the files. The Server required major surgery at considerable expense. For a number of reasons the anti- virus software did not prevent this attack............................................... Lesson learned!!      

Thanks (0)
Share this content

Related posts