It was in June, when she went to get a credit check for a mortgage, that the 20-year-old employee at Japanese beauty brand Shiseido realised something had gone badly wrong.
“My credit rating was trashed. Someone had taken out car finance, a business loan and an overdraft, all in my name, with my details,” says the employee, who has asked to remain anonymous because she still works at the brand. “I’d apparently founded a chocolate company in the Midlands.”
She was one of dozens of Shiseido’s UK employees whose personal details had been stolen and then posted on the dark web, where such data – including names, national insurance numbers, dates of birth, and home addresses – can be bought for as little as £10 a batch. Their personal information was used to create fake directorships at 346 fraudulent companies, which were incorporated via the UK registry, Companies House, in March, April and May this year. The companies themselves were fraudulently registered at the addresses of empty shops. These were combined with the real home addresses of Shiseido employees, as falsely appointed directors, in online applications for business loans and other credit.
The total scale of the fraud is not clear, but experts believe it is likely to amount to millions of pounds. Shiseido did not respond to a request for comment from the Observer.
Big banks are getting increasingly frustrated with what they see as lax controls at Companies House, and are pushing hard for reform. UK-registered companies have played a role in a string of scandals, from payroll fraud among NHS suppliers to the Danske Bank affair, in which money was smuggled out of Russia and into Europe in what is believed to be one of the biggest money-laundering efforts in history.
The government has acknowledged the scale of the problem. A drive to clean up Britain’s business register forms a key part of its economic crime and corporate transparency bill. The legislation is at committee stage in parliament, which means it can still be tweaked before becoming law.
“In recent years, the Companies House framework has been manipulated, particularly with the use of anonymous or fraudulent shell companies and partnerships,” Suella Braverman, the home secretary, told MPs in October. “That gives criminals a veneer of legitimacy to help them to commit crimes, ranging from grand corruption and money laundering to fraud and identity theft. We will reform the role of Companies House and improve the transparency of UK companies.”
While the current version of the bill grants Companies House more power to demand identity checks, experts at the biggest high street banks feel it falls short in two key areas.
First, they think the fee charged for incorporations should be increased. Companies House charges just £12. That fee is how the registry funds its activities. In the last financial year, the registry’s 1,178 staff processed 750,000 incorporations – almost 3,000 for every working day of the year. Companies House cannot increase the fee without approval from parliament. Banks want to see provision for an increase in the bill.
“We think £50 to £100 is a perfectly reasonable amount. We do not see any appreciable impact on UK competitiveness,” Nick van Benschoten, a director at the banking lobby group UK Finance, told MPs last month.
Only a few countries charge as little as the UK to incorporate a company: they include Benin and Kazakhstan. By contrast, the average cost to register a company across Europe is about €300 (£257).
A higher fee would also slow the volume of businesses registering in the UK and make it easier to police the flow.
Second, say the banks, the bill should give the agency fresh powers: the ability to kickstart its own investigations into suspect activity. At present, it only makes checks on existing companies if it receives external reports of identity abuse or other illicit practices. It is a reactive register. “Companies House needs to become a proactive gatekeeper, and the bill gives it those objectives and some powers. The problem is that it does not go far enough,” said Van Benschoten.
Today’s mess can be attributed, at least in part, to well-intentioned reforms brought in by the Liberal Democrat politician Vince Cable in 2011, when he was business secretary. The introduction of low fees and the possibility of 24-hour incorporation have had a dramatic effect: in the financial year to April 2022, there were 635,368 more incorporations than in the year to April 1987, according to official figures.
Of the 4.9 million companies that were registered with Companies House as of March this year, experts believe that as much as 20% of the data related to them may be false.
“It has been an article of faith for an extended period of time in the UK that cheap and fast is good,” said a source who oversees financial crime at one of the high street banks.
He said that without a change of mindset by ministers, the promised reforms in the bill would fail: “It’s as though you’re spending a lot of money buying a nice new house but not that extra little bit making sure that it’s watertight. Work out what it costs to run an effective, accurate register, and work out a fee on that basis.”
Paul Monaghan, chief executive of the Fair Tax Foundation, said: “The UK created the first business ownership register in the world, but in such a rubbish way that it is open to fraud. You can’t even begin to identify and track down the tax dodgers.”
Graham Barrow, an expert in financial crime and self-described “obsessive”, has spent many hours tracing some of the more ludicrous examples of fakery. “A Chinese bloke started a food company and has listed his occupation as an MP,” Barrow said, scrolling through some of the latest batch of his favourite oddities on the register. He makes a point of tracking some addresses that he believes are “farms”, as he calls them, for fake companies. “By 9am today, 34 companies were registered at one address in central London,” Barrow said. “Yesterday it was 252.”
In total, 3,854 companies were registered in the UK yesterday, he added, many of which he thinks are clearly fake: “I don’t think that is very assertive regulation.”
“Every week thousands of people’s lives are affected by this. ‘ASDA Limited’ [not in fact the supermarket] registered to one woman’s home address and she was getting kilos of letters each day,” he said.
And it’s not just too much mail. People apply for overdrafts and loans, damaging the credit history of individuals by misusing their details. There’s also international damage for the UK, Barrow said: “It makes us a laughing stock.”
Bankers agree. “There have been press reports of the US and German authorities seeing Companies House as a concern. That is a problem,” Van Benschoten told MPs. “We think Companies House is an opportunity for the government to reinforce the UK’s international reputation and our future prosperity, but we must not forget the current opportunity cost of this damage to confidence. That is not just consumers; it includes business.”
Shiseido is not alone in suffering from this kind of hybrid fraud, involving bricks-and-mortar shopfronts and gigabytes of apparently stolen data.
Conduent, a major US-listed business services company, recently discovered that the identities of its employees had been used to set up a shoe store in Romford, east London, and ice-cream parlours in Westcliff-on-Sea in Essex. The fraud involved 142 fake firms on Companies House.
An employee at Conduent believes their details were stolen in a cyber-attack. While the situation was stressful, the employee said the company had been supportive and offered a swift response: “I found out because they rang me, and they laid out clearly what they were going to do, and how it would be managed.”
Staff were offered free credit monitoring and other support.
Sean Collins, vice-president for communications at Conduent, told the Observer his company took the safety of its employee information seriously.
“Conduent became aware that a number of current and former Conduent UK employees had been appointed, without their knowledge, as directors of companies with Companies House,” he said in a statement. “We do not know how the underlying personal data was obtained and we continue to actively monitor our environment to ensure appropriate security and resiliency.”
One reason why Conduent was able to act fast, insiders point out, was that the open nature of the UK’s register meant it was easier to spot what had happened. Many registers across Europe are steadily going private after years of campaigning by organisations to make the ownership of companies more transparent.
But last month saw a major setback in the battle to fight fraud and money laundering by cleaning up company registries. A ruling by the court of justice of the European Union (CJEU) on 22 November undid, in one fell swoop, years of campaigning by tax and anti-corruption groups to make the ownership of companies more transparent.
It found that one of the key provisions of the 2018 EU anti-money-laundering directive, which ordered member states to make the identity of company owners public on their corporate registries, was invalid.
The CJEU ruled that public access to such information was a “serious interference with the fundamental rights to respect for private life and to the protection of personal data”.
Following the judgment, several jurisdictions known for facilitating tax avoidance and money laundering, including Luxembourg, Cyprus, Ireland and Malta, have already restricted access to ownership information on their registers.
But EU officials are not giving up yet.
The Romanian MEP Ramona Strugariu told tax experts at a conference in Athens last week that she believed that there would be a majority in the European parliament pushing for journalists and civil society to get access to registers – because, she said, it was these groups that had helped uncover major corruption scandals.
Here at #CSABOT beneficial ownership conference@RamonaStrugariu makes a legitimate point. Countries have taken years to comply with EU anti-money laundering legislation (some still don't). Now that a Court ruling strikes down 1 provision, it takes them less than 24h to comply. pic.twitter.com/S3FR4wTs8C
— Johan Bernardo Langerock (@JohanLangerock) November 30, 2022
Some countries have kept their registers open, including Latvia, Denmark and Estonia. Keeping the UK register of who owns what company open – even if the information is often incorrect – could be a “positive benefit of Brexit”, said Monaghan. And Companies House is free to access and easy to search through, unlike many European registries.
Although there are concerns about whether the UK reforms will be effective without more resources and greater enforcement powers, that transparency is a strength. “I’d take the free-to-access rubbish any day,” said Barrow. “The register itself is a primary source of evidence of suspicious activity.”
A government spokesperson said: “The UK already has some of the strongest controls in the world to combat money laundering, but we are continuing to upgrade our governance to crack down on criminals.
“Our new economic crime and corporate transparency bill will bear down on the use of thousands of UK companies and other corporate structures as vehicles for facilitating international money laundering, fraud, corruption, terrorist financing and illegal arms movements.”
