Stranger on the Register: When Someone Appoints Themselves a Director of Your Company

The letter that starts it

It usually arrives without warning. A confirmation statement you never signed. A change of registered office to an address you have never seen. A bank telephoning to query a mandate amendment. Occasionally there is no letter at all, only a supplier asking why your company has stopped paying its invoices — because the invoices were never yours in the first place.

The register at Companies House is not a private filing cabinet. It is a public assertion, and third parties are entitled to rely on it. That is precisely what makes it attractive to fraudsters, and precisely why a false entry is more than an administrative nuisance. In our experience, the businesses that recover fastest are those that treat the discovery as an incident with a clock on it rather than a paperwork error to be sorted out eventually.

How a company record is hijacked

The mechanics are rarely sophisticated. Filing a change is inexpensive, and until the identity verification regime took effect, verification of the person filing was limited. The common patterns we see include:

• Bogus appointments (AP01). A stranger is recorded as a director, often alongside a request to change the registered office to an address connected to them. Once appointed, they can amend bank mandates, order goods on credit, and file accounts.
• Fraudulent termination of a genuine director. A resignation is filed without authority, removing your ability to act — or, conversely, a resignation is filed to make it appear that a director walked away from liabilities.
• Registered office hijacking. Your company's address is changed, correspondence is intercepted, and the real business discovers nothing until HMRC or a creditor comes calling.
• Person with significant control manipulation. The PSC register is amended to show a fictitious controlling party, which can be used to support a fraudulent financing application or a false warranty in a sale.
• Sham incorporations. The mirror image of the above: a company is incorporated using your name, date of birth and home address, and then trades bad debts into the market under a name similar to yours.

The first seventy-two hours

Speed matters, but so does evidence. Before anything is corrected, take a full record of what the register currently shows: download the filing history, the confirmation statements, the officer and PSC pages, and the incorporation documents. Note the dates and times. If there is correspondence from Companies House, keep the envelopes. Screenshots have their place, but the dated download is more useful.

Then work through three fronts in parallel.

1. Tell Companies House, in writing

Use the registrar's fraud and error reporting route and, separately, submit a rectification application. The registrar now holds broader powers to query, reject and remove information, but those powers are exercised on evidence. A clear chronology, a signed statement from the genuine directors, and documentary proof of your identity will do more than a strongly worded email.

2. Preserve your commercial position

Notify your bank immediately and ask for the mandate to be frozen pending verification. Where a fraudulent director has borrowed or ordered goods, of course, the company may still find itself bound — apparent authority is a formidable thing. Contact your insurers, your accountants and, if you use them, your credit reference agencies. Consider placing a notice on your own website and writing to key counterparties, because a trading partner who acts on the false record may later argue they were entitled to do so.

3. Report the fraud to the police and Action Fraud

A crime reference number is not a magic key, but it is often required by banks, insurers and the registrar, and it may be necessary if the matter later reaches court.

Challenging the register properly

The informal route is a rectification application to Companies House, using the registrar's dedicated forms for correcting or removing officer particulars. These work well where the fraud is clear and uncontested. Where the registrar declines, or where a third party has acquired rights in reliance on the record, the route is an application to the court to rectify the register under the Companies Act 2006. A court order carries weight with banks, lenders and the registrar in a way that correspondence does not.

It is also worth asking whether your details should be suppressed. Directors at serious risk of harm can apply to have their residential address, and in some circumstances their day-to-day name, protected from the public register. The application is not automatic and the test is not generous, but it is considerably easier to obtain before the information has been scraped and republished.

Personal liability does not pause while you sort it out

A hijacked directorship is not merely reputational. Statutory duties attach to the office, and filings made by a fraudster can trigger consequences that land on the genuine board: penalty notices, a strike-off action, VAT and PAYE liabilities, and, in the worst cases, allegations of wrongful trading. Confirming the position quickly, documenting that you were not in control of the filings, and communicating with HMRC and creditors instead of ignoring them will do most of the work of defending your position later.

Nor should you simply resign and hope the problem goes away. A resignation that leaves the fraudulent appointee in sole control is precisely the outcome the fraudster wants.

Identity verification: the deterrent now in force

Identity verification became mandatory for new directors on incorporation in November 2025, and the transition continues through 2026 as existing directors verify in line with their company's confirmation statement cycle. Verification is carried out directly through the registrar or via an authorised corporate service provider, and the resulting verified status is intended to make it markedly harder for a name to be placed on a register without a real person behind it.

Two practical points follow. First, if you have not yet verified, do so promptly; an unverified director will eventually find filings blocked, and blocked filings mean penalties and potential strike-off. Second, ask your accountants whether they are acting as an authorised provider and who within your organisation controls that relationship. The verification regime is only as strong as the discipline around the credentials it depends on.

A short governance checklist

Register for Companies House email alerts on every company you are connected with — the alert arrives before the post does. Review the register quarterly, not annually. Keep filing authentication codes with a named individual rather than a shared inbox. And if a filing appears that you did not authorise, act that week, not that quarter. The register will not correct itself, and every month that passes lends the false entry a little more credibility.