SignElite

Identity thieves are ‘trading up’ from personal to corporate fraud, as they clone the identities of entire businesses.

The study commissioned by life assistance company CPP shows that identity theft has affected almost 100,000 small businesses (1), costing them an average of £13,500 each – £1.3bn across the country – enough to cripple some businesses.

One in five SMEs (22 per cent) admit they may be vulnerable to corporate identity theft due to lax procedures and protocol – but this figure could soar as criminals catch-on to a loophole with Companies House data processing.

Fraudsters’ ‘modus operandi’ typically involves changing company directors’ details or the company’s registered office address, by submitting false documents to Companies House through amendments to the company records via a simple submission of a paper form.

Under current systems, Companies House does not verify paper document validity. There are no checks if impostors try to register as new company directors or change a business address. And legitimate business directors are not notified if new company documents are filed, so they may never be made aware of fraudulent claims.

The majority of SME company directors (87 per cent) are not aware of these loopholes, which could put them at risk of corporate identity fraud.

Only one in 10 (14 per cent) is taking advantage of the PROOF scheme offered by Companies House, which offers secure electronic filing of documents to protect them against potential fraud.

And SMEs are also exposed to risk through their own data handling. Nearly half (47 per cent) say that their current employees have access to sensitive company data, almost two-thirds (61 per cent) admit they don’t encrypt company data, and a further fifth (22 per cent) allow employees to take sensitive documents out of the office.

While over a third (34 per cent) of SMEs confess that they don’t understand what corporate ID theft is – they need to as the reality is real. Victims of corporate fraud have experienced fraudsters applying for corporate credit/debit cards, spending money on credit, ordering goods without authorisation and even being able to withdraw funds direct from corporate accounts.

And the impact is severe – with victims reporting their company credit rating being affected as a result, damage to their company reputation and losing customers.

Michael Lynch, fraud expert at CPP said: “Our report demonstrates that corporate identity fraud is a real concern for businesses. It’s key that organisations ensure that they have secure methods of storing sensitive information to avoid falling victim to this growing problem.

“The current loopholes in the Companies House system make it worryingly easy for impostors to steal company information, and forge its identity, which can have huge financial impacts. We urge SMEs to take advantage of the safe online systems in place, to protect their business and for many SMEs, their livelihood.”

Key statistics

• Almost 100,000 UK small businesses have fallen victim to corporate identity theft
• Corporate identity theft costs businesses an average of £13,500 each
• 22 per cent of SMEs admit they may be vulnerable to corporate identity theft
• 87 per cent of SME directors are not aware of loopholes in the Companies House system which could put them at risk of corporate identity fraud
• Only 14 per cent of SMEs are taking advantage of the PROOF scheme offered by Companies House
• 47 per cent of SME directors say that their current employees have access to sensitive company data
• 61 per cent of SMEs admit they don’t encrypt company data
• 22 per cent of SMEs allow employees to take sensitive documents out of the office
• 34 per cent of SMEs confess that they don’t understand what corporate ID theft is

Advice for companies

• Check with Companies House that the details stored for your company are accurate
• Enrol for the PROOF WebFiling scheme and sign up to the alert system which will warn you of any changes to company details
• If you receive a call claiming to be from Companies House try to obtain a phone number and contact Companies House immediately. NB. Companies House personnel never contact companies by telephone asking them for their security codes so should businesses
• Do not rely on Companies House records alone in determining whether to lend goods or services on credit – Companies House is merely a public register and not a credit reference agency
• Limit the access to company sensitive information to key employees
• Make sure all company sensitive information is securely destroyed before disposal
• Ensure that all company sensitive documents are password protected or encrypted
• Ensure that no company staff can take sensitive documents out of the office in printed format or on unencrypted USB sticks
• Ensure all hard copies of sensitive company information are stored in locked cabinets in locked premises

The above is for information and guidance only and should not be relied on for individual circumstances and professional advice must always be sought specific to your individual circumstances and requirements. Finally any and all comments referred to anywhere on this site is for the United Kingdom (UK) market only. Visit www.realidentity.co.uk for more information