Umbrella company cloning: how to spot and stop the contractor sector’s big new fraud

It is a sad fact of life that where there is any sizable and legitimate quantity of money transfer, there is a criminal element that will try and divert that money into their own unscrupulous hands.

Banks and their customers around the world have been suffering variations of these attempts for years and now the global, criminal element has woken up to the fact that the temporary labour market in the UK appears to host many a lucrative transaction too, suddenly making recruitment agencies, contractor candidates, and umbrella companies new targets for fraud, writes Phil Pluck, chief executive of the Freelancer & Contractor Service Association.

The two big swindles of today

One quite-well established way of miscreants trying to extract money in the contractor sector is to try and ‘clone’ legitimate recruitment firms, in the hope that contractors will think they are dealing with the legitimate agencies. Similarly, fraudsters try to impersonate legitimate umbrella companies in order to persuade agencies to hand over large sums of payroll. So we have one scam which seeks to victimise the contractor, and another which creates victims out of the agency and umbrella. Regardless of which scam, the contractor is put at risk in both.

The legal term for ‘cloning’ is ‘passing off.’ This is the term for when someone deliberately passes off their goods or services as those belonging to another party. It might be done to damage the reputation of a company but in the contractor sector right now, the motive is usually to divert large sums of wages into fraudulent bank accounts.

So, how is this cloning fraud perpetuated?

Diligent contractors will often contact an umbrella company before signing up with the company to ask for a ‘compliance pack,’ which can serve to give the contractor an assurance that the umbrella’s bank account details are genuine and verifiable. The effect is that the contractor then knows where their wages are coming from. Some contractors do further ‘due diligence’ on a prospective umbrella company, such as asking for the current VAT registration certificate.

This is all good practice by contractors. But problematically, it is now the modus operandi of the fraudster who is passing themselves off as a contractor!

The fraudster next creates multiple clones of legitimate umbrella companies. Passing off as just one (clone) umbrella minimises the chances of fraudulent success. These multiple clone umbrellas are all registered with Companies House, so they start to gain legitimacy in the eyes of the unwary.

Lies, assurance and the targeted middle-grade

The fraudster’s final act is to contact numerous recruitment agencies -- whose PSLs are openly available to view, and then inform them that their preferred umbrella company has changed its banking details, because of any one of the following (spurious) reasons:

• A criminal hack has been attempted on its current bank account (yes contractors, the irony is not lost on me with this example!).
• A change in directors/ownership has taken place, hence the need for new accounts.
• The bank has offered a more secure portal account, so the details are new.

The fraudster then goes onto assure the agency through VAT registration documents, Companies House numbers, and details of current banking arrangements. The avenue for a sophisticated theft is now totally open.

Interestingly, the fraudsters will often target middle-grade employees of contractor recruitment agencies, perhaps knowing that senior directors will be on top of whatever transfer protocols are in place, and thus smell a rat.

This fraud is achieving results for fraudsters RIGHT NOW. In fact, the Financial Conduct Authority has reported a 29% growth in such scams in 2020, amounting to £78million in investment swindles alone.

How do you spot a clone?

It is important for contractors and recruitment agencies to be able to spot a clone. There are a number of characteristics to look out for:

• Lack of any other presence

Cloners need to keep below the radar while creating just enough legitimacy to convince agencies. They also need to get in quickly, steal the money and run. So that means any one of the following five, or all, or a combination of:

1. No website.

2. No presence on social media (including ‘no results’ on the likes of the Contractor UK Forum).

3. No heritage on Companies House. Clones are typically very infant with no accounts.

4. The same old names. It is often the same directors who set up multiple clone companies in a very short space of time, often from the same address which is often just an address of a residential property, and often multiple occupancy.

5. The directors are often based outside the UK. Currently, the trend is towards a handful of individuals who are based in India.

Fraud-prevention actions to take (includes SPOC)  

Recruitment and umbrella companies should always have a financial transfer protocol which is adhered to rigidly.

This should include a Single Point of Contact (SPOC) within both partner companies for any changes to banking and transfer arrangements.

Passwords between the SPOC should be agreed and retained within a small group of senior individuals, so that any form of impersonation is countered. This should be in verbal form and not stored electronically or in paper form.

Also, only deal with the exact company name. Any variation (by which I mean ANY), even by one letter or word, needs to be questioned.

Finally, if there is any suggestion of cloning immediately alert the companies involved (not the clone but the bonafide business) and cascade this warning to all staff.

In addition, if you are suspicious, please run a quick check on Companies House of the suspect company AND check its directors. Are they the directors listed in the legitimate company? The directors of the cloning company should be checked by clicking on their name. The chances are that they will be directors of several companies that look very similar to legitimate companies, but they will generally have the same address.

Again, do they have accounts lodged? Do they have a website? Is there a contact number?  Are they members of an established trade body such as the FCSA or Professional Passport? Oh, and don’t take their word for it! Check on the website of the relevant trade association and contact the association if in doubt.

Only as strong as...

Very finally, be vigilant. Cloning or passing off does succeed in diverting hard-earned contractor wages if just one person drops their guard. If contractors, agencies, and umbrella firms remain hype-vigilant we can stop this worryingly maturing trend in our sector.