RSS feedsMost of the incidents of identity fraud that grab the headlines relate to personal identity theft, but businesses are also vulnerable and should not neglect the challenges and dangers of this kind of fraud.
If your client's business identity is stolen or misused, it can result in the loss of company assets, damage to personal and corporate reputation and credit worthiness, as well as an erosion of customer confidence.
Bank accounts can be emptied by fraudsters who have appointed themselves as directors of your company, and criminals can trade under the company name or use it to buy goods and services on credit, and your client can end up liable. The cost and complexity associated with solving the resulting problems can be substantial.
According to the Metropolitan Police, corporate identity fraud costs British businesses more than £50m a year and the problem is growing. This is not surprising when you consider how easy it is to submit forms to Companies House to change the registered address of a business, or change the company secretary and director.
The forms can be downloaded, and the information the fraudster needs to complete them can often be found online almost as quickly and easily. The names of permitted signatories - including a company director, secretary or administrator - are frequently listed on company websites, and if they aren't available there, they are all too easy to obtain via other means.
Recognise the dangers
The first step is to make sure staff are aware of the dangers of social engineering and scams such as phishing and spoofing. Social engineers use telephone calls or personal encounters to extract information; phishing involves sending false emails to a wide audience, often asking the recipients to reveal personal or company information. When the messages are designed to look as if they come from a recognised source, such as a bank, this is also called spoofing.
Once the information needed to complete the forms has been obtained, it is all too easy to file the changes with Companies House, because it does not check any of the details for validity. In an ideal world, the potential for such abuse could be minimised by writing to the old and new addresses to confirm the notification of changes, or by using digital signatures to validate the authority of those who wish to make changes.
Three-step protection
Companies House suggests the following three-step process to minimising risk. First, conducting your business with Companies House electronically is not only safer, it's also less expensive - it costs £30 to file an annual return by post, and only £15 to do it online. By signing up for Proof, a free Companies House service, registered businesses receive a personal identification number that must then be used when changing any details online. Another Companies House service, Monitor, sends users an email alert whenever there are changes to the details they have listed at Companies House. It's not free, but £50 per year per company is a small price to pay for peace of mind.
Alternatively, a company can outsource the process; some credit referencing agencies provide a service, as do specialist suppliers. For example, if your client purchases a subscription to ProtectMyCompany.co.uk, the entire process will be handled for them. They will be notified when any documents are filed at Companies House relating to their business, and if any accounts, annual returns or changes to the share capital take place and they will receive an email notification on the filing along with an electronic copy of the document filed.
Additional precautions include securing sensitive documents with limited staff access, shredding business documents before disposal, using a well thought out document disposal policy, and securing electronic communications with a firewall and software to protect systems against spyware and viruses.
The Companies Act places a legal duty of care on all company directors, and if they're not properly informed, corporate identity theft could be the least of their problems.
Who's you?
Companies should exercise caution when deciding whether or not to extend credit to new customers. Credit referencing agency Equifax has compiled the following check list to help businesses minimise the risk of selling to an impersonator:
• Identify business partners and directors
• Confirm fax and telephone numbers
• Don't accept handwritten order forms or faxes
• Confirm the trading address of customers and suppliers
• Ask for original headed company paper
• Don't assume information provided is correct - always double check and follow up references
• Are they who they say they are?
• Ask customers to provide trade or bank references
• Are all references independent?
• Check for any connections to previous companies with similar or identical names
• Did they answer your call with a business name?
Lesley Meall is a freelance journalist
For more information go to www.identity-theft.org.uk
