Screenshot of the Stripe homepage: stripe Products Solutions Developers Resources Pricing

Stripe Billing named a Leader in the Gartner® Magic Quadrant™ >

Financial
infrastructure
to grow your

Issue 001
Abstraction Ma[illegible]
£19 per mo[illegible]
Pay
Or pay with [illegible]
Email

Stripe has now blocked the Company Registry fraud – but why did it facilitate it?

11 September 2024

6 Comments

We reported on Monday that, if you incorporate a UK company, you are likely to receive an official-looking letter from “Company Registry” charging you £45. It’s a scam, and a large and well-organised one.

We’ll be naming and shaming the legitimate businesses who are facilitating the scam. The first was Tide, who signed up the scammers as an affiliate and paid them referral fees.

Today it’s Stripe, the payment company, who processed all of the victims’ payments to Company Registry. But, to their credit, Stripe have responded quickly to our report, and blocked the scammers from their systems.

The scam

If you incorporate a UK company, you are likely to receive a letter like this from “Company Registry” (company-registry.org):

Letter from Company Registry dated 15 August 2024 requesting company details confirmation and payment: COMPANY REGISTRY

Date: 15/08/2024
Ref #: [redacted]
Status: Pending / Unclaimed

[redacted]

Dear [redacted]

Action Requested: Confirm Your Company Details & Activate Secure Vault

Congratulations on the incorporation of your new limited company - [redacted] LTD. These are the next steps to ensure your company records are secure and organised.

Your Company Registry account is currently in 'Pending / Unclaimed' status. Please follow the steps below to activate your account. Organise your company documents in one secure place. Access official resources, documents, filing history and member discounts to grow your business. Never miss an HMRC filing date. We advise completing your activation as soon as possible to ensure your company vault is claimed.

IMPORTANT! FOLLOW THE ACCOUNT ACTIVATION INSTRUCTIONS BELOW TO CLAIM YOUR ACCOUNT.

Company Name: [redacted]
Date of incorporation: 2024-08-14

Step 1: Please visit www.company-registry.org/activate-account and enter your reference number (located at the top of this letter).

Step 2: Activate your account and confirm company details.

Step 3: Payment - Complete payment and activate your secure company dashboard.

Subtotal Activation Fee | £115.00
COVID-19 New Business Relief Deduction | (£68.00)
Total Activation Fees | £47.00

[UPDATE - ACCOUNT PROCESSING IS NOW INSTANT AND YOU'LL BE GRANTED IMMEDIATE ACCESS - PLEASE COMPLETE ACTIVATION TODAY]

To activate your account visit www.company-registry.org/activate-account and follow the instructions above - your account will be activated instantly. There were 810,316 company incorporations in 2020/21. This is an increase of 21.8% when compared with 2019 to 2020. 2020 to 2021 saw the highest number of incorporations on record. Secure & organise your business now.

It looks like an official document – an invoice for a service that has already been purchased (“Pending”, “Complete activation”, “These are the next steps”, “IMPORTANT!”).

The reference to a “COVID 19 New Business Relief Deduction” again gives the impression this is an official letter.

It isn’t. It’s a scam. More about that in Monday’s report.

The link to Stripe

If you “activate your account” with Company Registry, you’re presented with this payment page:

Payment page from the Company Registry website charging £47: COMPANY REGISTRY
100% Secure Payment Gateway

Company Record Found
Claim & Register Account
Pay Fee & Activate

Complete Payment (Ref [redacted])

[redacted] Incorporated on 14/08/2024
Confirm Limited Company Details Confirmed
Encrypted Storage Vault - Keep your company documents safe Included
24/7 Access to Company Incorporation Documents (.pdf format) Included
Annual return deadlines (Never miss a HMRC filing date) Included

Subtotal £115.00
COVID-19 New Business Relief Discount -£68.00
TOTAL DUE TODAY £47.00

Name on card
Address line 1
1234 1234 1234 1234
Address line 2
MM / YY
CVC
Post code
United Kingdom

By clicking 'Complete Account Activation' you agree to our Terms of Service & Privacy Policy and the continuous vault service. The COVID-19 new business relief applies to newly incorporated limited companies. This charge will show on your bank account statement as company-registry.org

COMPLETE ACCOUNT ACTIVATION

Norton SECURED
SECURE SSL ENCRYPTION

The code for the page shows that Stripe processes the payments:

HTML source code inspected in developer tools showing Stripe integration scripts and an iframe for company-registry.org: <div class="cdk-live-announcer-element cdk-visually-hidden" aria-atomic="true" aria-live="polite" id="cdk-live-announcer-0"></div>
<script type="text/javascript" async defer src="https://js.stripe.com/v3/"></script> == $0
▶<iframe name="__privateStripeController7221" frameborder="0" allowtransparency="true" scrolling="no" role="presentation" allow="payment *" src="https://js.stripe.com/v3
mpany-registry.org%2Fpayment&controllerId=__privateStripeController7221" aria-hidden="true" tabindex="-1" style="border: none !important; margin: 0px !important; paddin
h: 100% !important; overflow: hidden !important; display: block !important; visibility: hidden !important; position: fixed !important; height: 1px !important; pointer-e
nt;">⋯</iframe>

Stripe is an “Authorised Electronic Money Institution” regulated by the Financial Conduct Authority (FCA). Needless to say, they shouldn’t be proceeding payments for a fraudster.

FCA rules require electronic money institutions to have effective procedures to prevent them being used to facilitate financial crime. That includes customer due diligence and ongoing monitoring. Most financial institutions have very sophisticated “know your client” (KYC) and anti-money laundering (AML) systems for this purpose.

But in this case, sophisticated systems weren’t required, merely one look at Trust Pilot or a Google search:

We understand Stripe was Company Registry’s payment processor from when the scam started around October 2021. At that point there wouldn’t have been obvious signs that Company Registry was a scam. But in April 2023, Companies House published a warning about Company Registry which was widely circulated. The obvious conclusion: Stripe doesn’t update its KYC/AML checks on its clients effectively enough, and/or frequently enough.

Stripe’s response to our report

We have been regularly checking Company Registry’s website – at some point in the last week, its payment processing system failed. Attempts to make payment result in an error.

We infer that Stripe stopped processing payments for Company Registry, either as a result of our reports, or as a result of earlier tweets. That breaks the Company Registry scam, at least for now – which is excellent news.

We reached out to Stripe for comment: they said that (understandably) they are unable to comment on individual users/clients.

The good and bad news

The bad news is obvious: Stripe didn’t spot obvious signs that their client was fraudulent, and processed payments that furthered their criminal enterprise.

But there is some good news:

  • We expect Stripe will be making a “suspicious activity report” to the regulator. That should include the details of the people behind Company Registry (which Stripe should have obtained during its KYC process). This information should assist law enforcement with pursuing those responsible.
  • Stripe now knows that all the payments made to Company Registry are suspicious – it should reverse them, and refund the victims of the scam.

We’ll also be asking the FCA to investigate Stripe’s KYC/AML processes.

We assume Company Registry will try to change their payment provider. It would be extremely disappointing if any regulated institution were to accept Company Registry as a client – but watch this space.


Footnotes

  1. See paragraph 3.80 et seq of the relevant FCA guidance). ↩︎

  2. And historically also very fallible ↩︎

  3. I know these systems well, because I used to advise some of the world’s largest financial institutions on how to make sure these systems didn’t facilitate tax evasion. Stripe were not a client, but if I was advising them now I’d say there is a risk they could be criminally liable if – as seems plausible – Company Registry has committed tax evasion. ↩︎

  4. The handful of positive reviews are all from users in the US, where Company Registry doesn’t conduct business. ↩︎

  5. Unsurprisingly, a Google search (“open source research”) is usually one of the first steps a KYC/AML team takes when onboarding clients or counterparties. ↩︎

  6. This Google search, as with others we refer to in our reports, was conducted via a UK VPN using Chrome in “incognito” mode, so it should be representative of the results for a general UK user, and not customised for Tax Policy Associates. ↩︎

  7. Company Registry’s API fails to receive a response from Stripe, and fails with a 500 error. ↩︎

6 responses to “Stripe has now blocked the Company Registry fraud – but why did it facilitate it?”

  1. MK avatar

    If Companies House knew about this 3 years ago, why didn’t they approach these and Tide first?

    Frankly in this case, it shouldn’t be up to you to get this done.

    Incompetence or worse from those who run Companies House.

    It is them who should be named and shamed or least justify their complete inaction.

  2. David Barritt avatar

    Is ACCO another scam I subscribe but the only contact I have is when they pressure me into renewing

    1. Louise avatar

      If you’re not getting any value from the subscription, why do you keep paying it? There seems to be a lot of organisations with ‘ACCO’ in the name, hard to tell which one you are referring to (but I suspect not the cancer charity?)

  3. Robert Hancock avatar

    Well done Dan. Why and how do so many of these scummy scams succeed when they shouldn’t if companies like Stripe do their jobs correctly?

  4. Rodney Ballard avatar

    I also had an issue with Stripe in regard to a payment they processed for an entity which was “selling” financial products in England but had no FCA approval. I reported to the FCA who will keep a copy on their file as well as to Stripe given this was a breach of their own requirements as well as the FCA regulations. Same response, they will investigate but cannot disclose any customer details. Pointless reporting to Fraud UK but I did send the response from Stripe to FCA who acknowledged. I also copied all my correspondence to my credit card issuer through whom I paid the fraudster and although they have refunded, it is worthwhile copying in all parties to provide a track record and history. The more reports that go in to regulators, they will be forced to investigate further and to “stamp out” these dishonest payments and tactics to clean up the payments system which is overdue and subject to abuse.

  5. E Hart avatar

    Hello, I received one of these letters, however it was from Companies House, rather than Company Registry. It looked like a scam so I ignored it.

Leave a Reply

Your email address will not be published. Required fields are marked *