Companies House estimated that 6 to 7 million people would need to verify their identity by mid-November 2026. That is every company director and every person with significant control (PSC) in the UK, all needing to do one unfamiliar thing with an official deadline attached. It is exactly the moment a fraudster would choose, and Companies House’s own scam warnings page already shows fake emails telling people to “verify your identity”, including one demanding it be done within 24 hours.
The real check can be done free, you can start it yourself on GOV.UK without clicking anything in an email, and it never needs your documents by email. Knowing what the genuine process looks like is the quickest way to spot the fake one.
What the law requires, and when
Identity verification became a legal requirement on 18 November 2025. The rules give existing directors a 12-month transition period beginning on that date, so the window runs out in mid-November 2026. It is not one national deadline, though. Each company has its own date.
Existing directors verify at the same time as the company files its next confirmation statement during the transition period. GOV.UK puts it plainly: “You will need to provide your Companies House personal code as part of your company’s next confirmation statement.” If you are a director of several companies, you do this for each one.
New directors appointed since 18 November 2025 provide the code when they are appointed.
People with significant control have a 14-day window. For a PSC who is not also a director, that is the first 14 days of their birth month, spread across the year from December 2025 to November 2026.
It matters because acting as a director without verifying is an offence. The Companies Act 2006 now says “an individual must not act as a director of a company unless the individual’s identity is verified”, and the company can be liable too. Companies House’s published approach to non-compliance lists prosecution, referral to the Insolvency Service and financial penalties, and says it “may pursue enforcement action without further notice”.
Plenty of people have not done it yet. Companies House’s own figures for 30 June 2026 show 55% of director appointments and 42% of PSC appointments verified. Those count appointments rather than people, but the gap is large either way.
What the real process looks like
There are two ways to verify, and both are on GOV.UK.
GOV.UK One Login is free. It works through an app or a browser, or at a Post Office if the service directs you there. It asks for photo ID such as a passport or UK driving licence.
An authorised corporate service provider (ACSP), such as an accountant or a formation agent, can verify you instead. They must be supervised for anti-money laundering, and they may charge a fee.
Either way you end up with an 11-character personal code. You give that code when the company files, or to whoever files for you, such as your accountant. You do not verify again unless Companies House tells you to, and its guidance is plain about documents: “Do not post or email your identity documents to us.”
What the fake emails look like
Companies House keeps a page of real scam examples, last updated on 16 July 2026. Several are built around identity verification:
- an email from a Gmail account pretending to be Companies House and telling you to verify your identity
- an email copying the style of Companies House’s own messages to registered email addresses, telling you to “verify your identity now”
- an email carrying the HMRC logo, saying Companies House needs to verify your identity
- an email asking you to verify within 24 hours using a one-time “reference number”
The tactics it lists are the familiar ones: pressure to act quickly, demands for payment, and pressure to open an attachment or a link, or to hand over an authentication code. The page also lists sender addresses that are known to be fake, such as @companies-house-gov.uk, @companieshouses.co.uk and @companiesshouse.com. Real Companies House emails come from an address ending in .gov.uk, and Companies House says it will never call you to ask for passwords, bank details, authentication codes or details of directors.
How to stay out of trouble
The safest habit is the simplest one. Never verify from a link in an email. Go to GOV.UK yourself, search for “verify your identity for Companies House”, and start there. A genuine reminder loses nothing if you ignore its link, and a fake one gets nowhere.
If you use an agent, check it. Companies House publishes a list of ACSPs and a list of ceased and suspended ones, and an agent on the second list cannot act for you. Once you are verified through an ACSP, the public register shows the name of the provider that did it, so you can confirm it was the one you chose.
Where to report a fake
Suspicious emails: forward them to report@phishing.gov.uk, the national reporting address, and to Companies House at phishing@companieshouse.gov.uk.
Calls, letters or anything you are unsure about: Companies House’s contact centre is on 0303 1234 500.
If you have lost money or been hacked and you are in England or Wales, contact Report Fraud, the police service for reporting fraud and cybercrime.
What to do this week
Check your own date. The register shows identity verification due dates for directors and PSCs.
Verify through GOV.UK directly, or through an agent you already know, and keep your personal code somewhere safe.
Tell the other directors and PSCs in your company how the real process works, so a convincing email does not catch them out.
Forward anything suspicious to report@phishing.gov.uk rather than replying to it.
Frequently asked questions
When is the Companies House identity verification deadline?
There is no single national date. Existing directors must verify when the company files its next confirmation statement during the 12-month transition period that began on 18 November 2025. People with significant control have a 14-day window, which for those who are not directors falls in their birth month. The register shows each person’s due date.
Does Companies House email you to verify your identity?
Companies House does email registered email addresses about identity verification, which is exactly why fake versions work. Do not verify from a link in an email. Go to GOV.UK yourself and start from the official “verify your identity for Companies House” guidance.
Is Companies House identity verification free?
Yes, through GOV.UK One Login, including the Post Office route. An authorised corporate service provider, such as an accountant, may charge a fee for doing it for you.
What happens if a director does not verify their identity?
Acting as a director without verified identity is an offence under section 167M of the Companies Act 2006, and the company can be liable too. Companies House says it may prosecute, refer people to the Insolvency Service, issue financial penalties and annotate the register.
How do I report a fake Companies House email?
Forward it to report@phishing.gov.uk and to phishing@companieshouse.gov.uk. If you have lost money or been hacked and you are in England or Wales, contact Report Fraud.
Flux Dynamics is a fractional CTO who builds. If your company’s systems and accounts have grown up without anyone owning them, tell us what you run and we will help you put a name against each one.