Someone made an unauthorised change on the Companies Office record? Here is the order to fix it, and what it means for your loan

You open the Companies Register to check something routine and the record is wrong. A director you have never met, an address that is not yours, or your own name gone from the list. Nobody asked you.

It is a stomach-dropping moment, and the instinct is to ring everyone at once. Resist that. The order you do things in decides how fast the record is fixed and whether a lender or supplier is caught out. This guide gives that order, with a note on what it means if you have borrowed, or are about to.

What counts as an unauthorised change, and why does it matter for lending?

The company record is the public face of your business. It lists directors, shareholders and the registered office. When a lender, bank or supplier wants to confirm that you are who you say you are, this is the first place they look.

An unauthorised change usually means one of three things:

• A director has been added or removed without your agreement.
• The registered office or address for service has been swapped, so letters and notices go somewhere else.
• Shareholdings have been altered, which changes who appears to own the company.

Why would anyone bother? Because a changed record can make a stranger look like the person in charge. With that on the register, they can try to open accounts, order goods on trade terms or apply for finance in your company’s name. Redirecting your mail also hides the warning letters from you.

Sometimes it is not crime at all. A former partner or an over-keen adviser files a change they think they are entitled to make. The first steps are the same either way.

What do you do in the first hour?

Work down this list in order.

1. Capture the evidence

Take dated screenshots of the current record and, if you can see it, the filing history. Note the company number, what changed, and the date you noticed. You will quote these details to every party you contact.

2. Lock down what controls the record

Updating director details online needs a RealMe login, an online services account on the Companies Register, and authority to act for the company, according to the Companies Office’s help page. So the question is who, or what, has access to those.

• Change the password and turn on two-factor authentication on the email address that your Companies Office and RealMe accounts use. If the inbox is open, everything behind it is open.
• Check whether anyone else has authority on your company’s online account, such as an old accountant, a former employee or a formation agent.
• Read the mailbox for rules and forwards you did not create. If you find any, work through our business email compromise guide.

The Companies Office’s online services terms say it can disable an account that is being misused or has been compromised, and that account holders are responsible for actions taken through their account (terms and conditions). That is another reason to tell the Office quickly, not slowly.

3. Tell the Companies Office compliance team

We found no dedicated company-hijack form on the Companies Office site, so write to the compliance team at [email protected]. That is the address the Registrar’s own correction notices give for objections and queries.

Put this in one tidy email:

1. Company name and number.
2. What was changed, and the date it appeared.
3. That you did not authorise it, and how you know.
4. What you have done to secure the accounts.
5. A phone number that reaches you.

4. Understand what the Registrar can do

The Registrar has a power to correct the register under section 360A of the Companies Act 1993. When the Office plans to use it, it publishes a “notice of intention to correct the register”. Past notices include reversing a director cessation that was wrongly notified and removing incorrect shareholding details filed by someone else. They typically give at least 20 working days for objections, which go to the compliance address above (see an example notice).

Two things follow. A correction is a process, not an instant undo, and a person who made the change can object. So the cleaner your evidence, the easier it is.

A genuine director change is also not a free-for-all. Directors have 20 working days to update changes to a director’s name or address, and removing a director by shareholder vote needs a resolution. A filing with no real decision behind it is the kind a correction can address.

Who else do you need to tell, and in what order?

Right after the Companies Office, work outwards from the people who can lose money.

• Your bank. Ask the business bank team to note the account, flag any changes to signatories or contact details and check for new products. Ask them to verify any request touching the company by calling you.
• Lenders you already have. Phone the number you already hold, not one from an email. Tell them what happened and ask them to confirm any change of details by phone only.
• Your accountant and key suppliers. Anyone who might receive a letter or invoice with the wrong address on it.
• Police and the NCSC. Police take non-urgent reports on 105. If a hacked inbox or stolen login was part of it, report through the National Cyber Security Centre; Own Your Online’s business help page points the way.

Should you freeze your credit file?

The company itself does not have a credit freeze in the personal sense, but you do. If you are a director or guarantor, your own file is what a fraudster would reach for to make a borrowing look real. The Privacy Commissioner explains that an initial freeze lasts “10 working days”, and a request to any one of Centrix, Equifax or Experian is “treated as a request to all of them” (Office of the Privacy Commissioner). You can ask for your information to be released to a specific provider when you genuinely need to apply.

If you want the background on how credit checks fit into a business application, see credit checks explained.

What if you have a loan in progress?

Say so, early. A lender who finds a recent unexplained director or address change on its own will pause. A lender who hears it from you, with a plan, usually keeps going on the parts that do not move money.

Here is what to expect:

• Identity checks may be repeated. Each director and guarantor completes the online check themselves, and you may be asked for fresh ID. Our digital ID guide shows what appears on screen.
• Payout details get verified by phone. Do not accept this as a nuisance. It is the same protection that stops payment redirection.
• Settlement waits for a clean record. Expect the lender to want the correction made, or at least formally under way, before funds are released.

If a loan is on your mind while you sort this out, you can check your options with a 60-second enquiry in parallel. Enquiring does not touch your credit file.

A worked example

Take a small freight company with two directors. One morning the owner finds a third director on the register, plus a new registered office in another city. They screenshot both, change the password on the company’s main inbox, email the compliance team with the details and ring their bank.

They then phone the lender that was about to settle a working capital facility. The lender pauses settlement and asks for the Companies Office reply. The correction process takes its course, the owner keeps the lender informed, and the loan settles afterwards. Delay, not disaster, because the owner told the lender first.

This is an illustration only. Timeframes depend on the case and on the lender.

How do you check a lender or contact is genuine in the meantime?

Be wary of anyone who contacts you out of the blue about “your company’s” credit or filings, especially if they ask for an upfront fee. Check who they are using our lender checking routine, and see the red flags in our online loan scams guide.

If you want a second pair of eyes on whether your own online set-up is ready for a loan, the online ready score takes a couple of minutes.

How do you stop it happening again?

Prevention is mostly housekeeping:

• One login per person. Never share one account.
• Two-factor authentication on the main email and every account that can act for the company.
• Remove old access when someone leaves, including advisers and agents. Our access audit takes about 30 minutes.
• Look at your company record every few months. It is public and free to view. Put a reminder in your calendar.

Already borrowing, or about to? Let’s get started

If this happened to you, the last thing you need is a dull application. Once the record is fixed or on its way, it is worth finding out where you stand.

Our 60-second online enquiry asks for the basics. It does not involve a credit check when you first enquire, so asking will not touch your credit file. Your details are not sent to a pile of lenders. One team reads them, and a real person looks at your situation and calls you. If you have just been through a record problem, tell us in the form. It helps us match the right option first time, and so does accurate information on the form.

See if you qualify →