Every director of a UK company now has a legal deadline attached to their own identity, and most have never heard of it. Companies House began phasing in mandatory identity verification on 18 November 2025, and by the time most existing directors notice, the scammers already have. We have spent the last fortnight helping clients tell a genuine Companies House requirement apart from a very convincing fake one, and the two problems, the deadline and the fraud riding on its back, are really the same story.

A new legal requirement, not a suggestion

Under the Economic Crime and Corporate Transparency Act, every director and every person with significant control (PSC) of a UK company has to verify their identity with Companies House, either through GOV.UK One Login or via an authorised corporate service provider such as an accountant. This is not paperwork you can leave in a drawer. Acting as a director while unverified is a criminal offence, non-compliance can bring fines, and persistent failure risks the company being struck off the register.

The rollout itself is confirmed and already live. Companies House set out the timeline well in advance: anyone appointed as a director from 18 November 2025 has to verify before the appointment goes through, and existing directors have to provide their Companies House personal code the next time their company files a confirmation statement dated after 5 March 2026. The transition period closes on 17 November 2026. For a company with a March or April confirmation statement date, that deadline is a lot closer than it looks from September.

The deadline that catches people out

We built our own client list to see how it splits, and it is not the sole traders and freelancers who are exposed here, it is the small limited companies with two or three directors who assume someone else is handling it. A confirmation statement gets rejected outright if the personal codes are missing, which stalls other filings behind it. We are telling every client with a director role to check their confirmation statement date this week rather than waiting for a reminder that may not come in time.

Scammers moved faster than the guidance

Here is the uncomfortable part. Companies House has had to issue its own warning about scam emails exploiting the very requirement it just introduced. The emails claim a director or PSC must “verify their identity now”, copy the wording of a genuine Companies House notice almost exactly, and push recipients toward a link that harvests passport details and financial information rather than verifying anything. A lot of them are sent from ordinary Gmail addresses, which is the giveaway: every genuine Companies House email and every genuine verification link sits on a gov.uk domain, and Companies House will never ask you to hand over identity documents by email.

The stolen data does not stop at one scam. Passport scans and financial details lifted this way get sold on and reused for invoice fraud, banking scams and further phishing campaigns against the same business, months after the original email is forgotten.

AI has made the fake side of this worse

The reason this particular scam wave is worth naming rather than filing under “usual phishing” is what is happening to identity fraud generally. Shufti’s Identity Fraud Index Report 2026 projects deepfake-powered identity fraud to surge nearly 495% during 2026, and inside that figure, AI-generated fake documents, forged passports and driving licences that pass a casual glance, are the fastest-growing single category, projected up close to 3,900% year on year and now accounting for more than 80% of AI-enabled fraud attempts the firm sees. That is the same identity-document fraud that both feeds convincing phishing emails and, at the other end, tries to slip fake documents past the verification systems meant to stop it.

We are not saying AI verification systems are broken, GOV.UK One Login’s own checks are built to catch exactly this. We are saying the fraud attempts pointed at the system, and at the directors who have to use it, are being generated faster and more convincingly than at any point before, and a small business without a system for checking “is this real” is the easiest target in that queue.

What we are telling clients to do this week

None of the fixes here cost anything beyond ten minutes of attention. Check your company’s next confirmation statement date on the Companies House register now, not when a letter arrives. Verify through GOV.UK One Login directly, by typing the address in yourself, never through a link in an email. Treat any message that creates urgency around “verify now or face penalties” as suspicious by default, because the genuine deadline has been public since November 2025 and nobody at Companies House needs you to act in the next ten minutes. If a scam email does land, forward it to Companies House’s own reporting address and delete it, and tell every co-director to do the same, since these campaigns are typically sent to everyone on a company’s officer list at once.

The wider point holds for any business watching AI reshape its risks rather than just its opportunities. A genuine, dated, criminal-offence-backed compliance deadline and a fraud campaign impersonating that exact deadline are now arriving in the same inbox, worded almost identically, and the only reliable way to tell them apart is knowing the real process cold before the fake one shows up.