On Monday 9 December last year, 4,127 new businesses were registered at Companies House by 4:30pm. We know that because Graham Barrow, Co-Director of anti-financial crime podcast The Dark Money Files, proved it in a live demonstration at Chartered Accountants’ Hall.

Using a blend of his own software, some judicious Googling and a bit of detective-like tracing through Companies House internal links, Barrow showed how important it is to sceptically interrogate the agency’s data. Accepting it at face value, he warned, is what those who are abusing the system for fraudulent purposes will count on most users to do.

Addressing attendees at a special ICAEW event to mark International Anti-Corruption Day, Barrow noted that if you extrapolate 9 December’s tally of registrations to around 20,000 a week, that comes to one million a year. Indeed, in 2023, the total number of incorporations registered at Companies House was around 800,000.

“What’s really interesting is that about half of those companies will be struck off the register without ever logging another action,” Barrow said. “Now, some of those will be economic failures – they just didn’t work out. But not as many as half of all registrations. We should worry about that. Because a substantial proportion were set up never to do any real, commercial business in the first place.”

Detecting a pattern

With the aid of his digital tools, Barrow was able to rank the companies registered on 9 December by risk, cross-referencing them with 168 red flags.

One that caught his attention, particularly for how its name chimed with a well-known brand, was ‘ITV Pakistan Limited’, registered to an address in Bromley and described as an advertising agency and provider of representation services. According to its incorporation document, the company launched with £50m of capital under one person with significant control: a Chinese national residing in Miami, Florida. Let’s call him ‘Mr X’.

Clicking on Mr X’s given name, Barrow found that he was also listed at Companies House as Director of the equally spuriously named ‘Warner Music Group’, registered to the very same Bromley address as ITV Pakistan. The nature of the business was described vaguely as “Activities of other membership organisations not elsewhere classified”. ‘Warner’ was incorporated on 5 December and also claimed to be capitalised at £50m.

Changing tack slightly, Barrow ran a Google search on Mr X’s address. The search revealed that his stated residence was also home to two other business owners with records at Companies House. The first was a US national, a director of a London firm registered on 13 November and capitalised at £5m. The second was a Filipino citizen with a company registered on 9 December, and – like both of Mr X’s – apparently capitalised at £50m.

“Are you detecting a pattern, here?” Barrow asked attendees. “Simply put, we’re looking at very recent incorporations of four different UK companies, by three people of different nationalities located at the same address.”

Backtracking a little with another search, Barrow discovered that Mr X was also listed as Director of a cryptocurrency firm, registered at Companies House on 21 December 2023. Rather suspiciously, on the incorporation document for that business, Mr X had stated his nationality as American.

Then came the grim punchline: Barrow uncovered a social media post about Mr X’s crypto firm by someone whose father had lost $330,000 while dealing with it. According to the post, Mr X had informed the victim that he needed to pay that sum to release $9m that he thought he had made on a crypto product.

Referring again to Mr X’s given name, Barrow said: “I’m willing to bet that this individual is either fictitious, or a stolen identity.”

‘Burner companies’

In Barrow’s assessment, while Companies House reform is currently in progress, one lingering issue is that the agency is still very reactive. As such, it is required to register a company for anyone who completes its application form.

“Last year, I worked with two businesses whose HR databases had been hacked,” Barrow said. “The cyber attackers then used the details of people who were working, or had worked, at those companies to make registrations at Companies House. They had names, addresses, dates of birth, National Insurance numbers – everything they needed for their bogus companies to apply for credit and pass Equifax or Experian credit checks. 

“The first thing the victims knew of it was when they started seeing checks on their credit scores. Or worse, when debt collectors knocked at the door.” At least 1,500 businesses were registered at Companies House with those stolen credentials. 

Barrow explained that he and a co-investigator had spotted the fake companies because the fraudsters were registering them to empty shops and had become sloppy. In some cases, they had registered multiple companies to the same high street on the same day. 

Another clue was that many of the employees whose identities were stolen were very young. In one West Country high street, four businesses were registered on the same day to directors who were all under 20. As businesses in that street were each paying around £250,000 per year in rent and rates, it was highly unlikely that the directors would be so young.

Barrow pointed out that Companies House has a measure called Administrative Power of Removals, which it can deploy within a week of companies forming to weed out suspicious registrations. However, he stressed, once a fraudster has done their homework, a week can be a long time.

“I call them ‘burner companies,’” he said. “Just like a burner phone, you only need them for one day. I’ve genuinely seen a company form, open a business bank account and max out its automatic, £8,000 overdraft in a matter of hours. But Companies House and all the banks use straight-through processing for those actions, with no human involvement.”

As such, Barrow concluded, for Companies House data users: “It’s not just about viewing that information. It’s about organising, sorting and interrogating it.”