The weird Companies House bank fraud

There was an intriguing report from Sky News yesterday that UK Finance had warned its members that 800 fraudulent forms discharging the liabilities of 190 companies had been submitted to Companies House.

UPDATE: it turns out this article was completely wrong, and the story was actually much weirder, involving a “sovereign citizen” acting in a very bizarre way. We’ll keep the article up because it demonstrates a Companies House vulnerability, albeit one that has hopefully now been closed.

The report doesn’t make at all clear what the fraud was. Often it’s a bad idea to make details of frauds public. In this case we think there’s a public interest in revealing how the fraud works, both so companies can protect themselves against it, and so policymakers can see what the underlying vulnerabilities are, and how they can be fixed.

Our informed guess is that the fraud looked like this:

• Let’s take a random business – call it Amalgamated Widgets Ltd.
• Amalgamated Widgets Ltd currently has a £1m loan from MegaBank, secured by a mortgage.
• The fraudsters submit a fraudulent form MR04 to Companies House, supposedly on behalf of MegaBank, saying that the mortgage has been discharged. This doesn’t need to be a very sophisticated fraud. You could probably sign the form “xxx” and Companies House would accept it. There is an excellent guide to MR04 here, from law firm Stevens & Bolton LLP.
• The fraudsters then steal Amalgamated Widgets’ identity. Perhaps the fraudsters have hacked Amalgamated Widgets’ email system; perhaps they intercept the post; perhaps they just use social engineering; perhaps all of the above and/or something else. But this is a fairly sophisticated fraud.
• The fraudsters now pretend to be Amalgamated Widgets and apply for a new £1m secured loan from FriendlyBank. FriendlyBank sees the repaid MegaBank loan and thinks it’s perfectly rational that the company would be looking for a new loan to replace it.
• The fraudsters would probably need to fool a law firm into acting for them (because FriendlyBank would be suspicious if Amalgamated Widgets Ltd didn’t have a law firm acting for it). Or maybe the fraudsters have their own corrupted or fake law firm. Either way, this again requires quite a sophisticated fraud.
• Once the loan is granted, the fraudsters arrange for FriendlyBank to deposit the £1m loan in an account controlled by the fraudsters. Given that the fraudsters impersonated Amalgamated Widgets to apply for the loan, it’s not going to be too much of a challenge for them to set up an account in its name.
• The fraudsters then take the money and disappear.
• FriendlyBank has lost the £1m – its security will be void and it will have to try to track down the cash. Fraud unravels everything – so Amalgamated Widgets probably won’t be liable to FriendlyBank, and MegaBank’s original security will still probably be good.

Who is to blame?

There may well have been failings by Amalgamated Widgets (e.g. if its email got hacked), FriendlyBank (if it could have spotted the fraud), and any lawyers acting for the fraudsters (they’re either bent, or had an AML disaster). Maybe a corporate services provided got hacked and that gave access to hundreds of companies’ Companies House login details?

Probably everybody will sue everybody else. But the original sin was Companies House not requiring any proof of identity of the person submitting the MR04. That was the easiest bit of the fraud, without which nothing else would have been possible.

The Sky article suggests that perhaps Companies House was hacked. I very much doubt that was necessary. When you can register as a director in the name of Adolf Tooth Fairy Hitler, then filing an MR04 in the name of someone else isn’t terribly challenging. I expect, rather than file 190 paper forms (which would be tedious), the fraudsters created a Companies House account and then automated the process.

We are back to Companies House being a “giant fraud robot” – an incredibly efficient system which will accept anything that’s filed with it without verification. I say “potentially” because it looks like the banks did Companies House’s job for it, and spotted the problem – hopefully before the fraud had claimed any victims. But of course it’s possible that there are many similar frauds going on under the surface.

The question is whether the planned Companies House reforms will improve matters. I’m afraid I’m sceptical. Identity requirements for people making filings should in principle be a straightforward change, but on its own is insufficient – Companies House needs systems and people who can proactively identify suspicious transactions The banks took decades to build their current KYC systems. They’re very sophisticated, and far from perfect – but make financial malfeasance far more difficult than it was in the past. It’s very ambitious to think that Companies House can build something comparable within a few months.

For the moment, it would be wise for companies to regularly check the Companies House website for any suspicious changes.¹I expect the banks do that already, and that’s how the fraud was caught.

---

Thanks to Matthew Letts, I and T for their insight into how the fraud may operate.

• 1
  I expect the banks do that already, and that’s how the fraud was caught.