A new hiring fraud hinges on a limited company, a passport and ‘Ade’

Over the last three years, our tech contractor recruitment agency has witnessed a concerning rise in fraudulent attempts to bypass the UK’s immigration regulations – attempts made by foreign ‘contractors’ trying their hand at the imposter candidate scam, writes Matt Collingwood, boss of IT recruiters VIQU.

These active immigration fraudsters rely on UK recruitment agencies being less than proactive

A decade ago, immigration fraud attempts were largely unheard of in our quite niche sector.

However, as 2025-26 fast approaches, I hear of immigration rule-breaches in the recruitment sector almost weekly, predominantly involving contractors attempting to (or actually securing) work through temporary IT jobs agencies.

Fraudsters who don’t appear to have the right to work or remain in the UK

In all cases I’m familiar with, the attempted fraud appears to have been made by individuals whose Right To Work in the UK, and potentially their right to remain in the UK, is questionable.

But unfortunately, the hiring sector appears to be either slow to respond or oblivious to these attempted frauds. Perhaps in some cases, staffing companies are simply eager to place contractors, and in their haste, a blind eye is turned to the fraudster and their criminal operation.

What nearly tricked us versus the benefits of controlled immigration

Before I reveal the latest attempted ruse which we nearly fell for, I should say I am a strong advocate for controlled immigration of skilled workers into the UK.

Throughout my tech staffing career, I have helped hundreds of end-clients fill challenging technology roles with talented IT job candidates from abroad.

We have successfully run programmes sourcing skilled .Net Developers from Vietnam, the Philippines, and South Africa, for example. And we worked collaboratively with candidates and clients (who held the sponsorship licenses) and the Home Office to facilitate those relocations.

At the time, these placements met a demand that the local market simply couldn’t fulfil and they constituted a win-win-win. They helped clients; the developer, and our agency. There was a fourth winner too -- UK Plc, which did rather nicely from the increased tax contributions.

In addition, in November 2021, as the UK IT sector was ramping up for what emerged to be its best year ever, I wrote about the necessity of including migrants as part of the solution to the UK's tech skills shortages.

The surge in illegal working – via a PSC – isn't being spoken about enough

Immigration is a sensitive topic, particularly during economic challenges when there is naturally a rise in out-of-work contractors.

However, today’s surge in illegal attempts to work unlawfully as an IT contractor isn’t being discussed enough, almost regardless of how many legitimate tech contractors are ‘on the bench.’

The Immigration Act requires employers to see original forms of ID for UK nationals and verify them against incoming employees.

While this has introduced some control, ‘contractors,’ i.e. individuals purportedly planning to work through their own personal service company (PSC), are appearing to bypass such scrutiny. And quite often.

Legal obligations, IDSPs, and IDVT software

Recruitment agencies in the UK are required to perform Right To Work checks of contractors, including PSC workers, in line with:

1. The Immigration, Asylum and Nationality Act 2006.
2. Regulation 19 (a) of The Conduct of Employment Agencies and Employment Businesses Regulations 2003.

The UK government has approved a number of certified digital Identity Service Providers (IDSPs) to carry out identity checks.

And since April 6th 2022, employers and recruitment agencies have been able to work with these IDSPs to use Identification Document Validation Technology (IDVT) software to carry out digital identity checks, on behalf of British and Irish citizens who hold valid passports (including Irish passport cards).

Despite these welcome new requirements, and the numerous IDVTs, many agencies still seemingly fail to perform these checks -- thoroughly, leading to a rise in fraudulent candidates.

How immigration rules are being flouted by the imposter candidate scam

Here’s how the imposter candidate scam is taking advantage of UK immigration rules:

1. A ‘contractor’ applies for off-payroll opportunities where a limited company is permitted (offering a competitive rate and an amazing CV). The contractor interacts with the agency via phone calls or video calls, but during the latter claims to have a “broken camera.”
2. Once the IT contractor secures an offer, they duly provide documentation, including PSC/limited company-related papers, insurance, UTR details from HMRC, and a UK passport as proof of ID. (N.B. An IDVT isn’t used).
3. The worker begins the assignment and performs satisfactorily.

Didn’t spot the scam? No, nor are you meant to.

The deception lies in the fact that the individual who shows up to do the work -- at stage three -- is not the same person whose UK ID was provided and approved.

How can this ruse happen?

Agencies often fail to verify the candidate’s identity by not meeting the worker in person or cross-checking their ID properly.

But it’s not just errant or slapdash agencies that this attempted immigration fraud and hiring fraud relies upon.

To succeed, this scam requires collaboration between a genuine director of a UK-registered limited company and the fraudulent worker (and we presume the mutual benefits from the tech gig would be shared profits.)

One can assume if individuals are willing to breach immigration laws, they are likely evading tax regulations as well.

And who knows, maybe all the skills and experience on their CVs aren’t worth the paper they are printed on either!

No 'exit checks' don’t help

Unfortunately, the system seems wide open. In fact, as it stands, the UK doesn’t control its border for people leaving the UK.

So it’s very easy for someone in the UK to set up a PSC, invite five ‘friends’ to the UK on a holiday visa, and for those five to use one UK passport and the ‘PSC’ to work. Further problematically, the government’s immigration enforcement agency, Border Force, wouldn’t ever know whether these five individuals had returned home following their holiday, as nobody passes through an immigration ‘exit’ channel.

Share Code and Right To Work verification

The Home Office is currently offering an online platform which provides a “share code” to verify some workers’ immigration status.

Employers or agencies can use this code to check non-UK workers’ rights to work via the share code portal. Crucially, the process includes verifying a worker’s photo, and the dates during which they are allowed to work.

The easy fix

All workers in the UK, regardless of nationality or employment type, should be required to undergo the “share code” verification process.

I further recommend that all recruitment agencies should meet prospective workers in person to match the applicant to their original passport photo (or do an IDVT), ahead of the agency providing the share code to clients, thereby ensuring that the individual turning up to work at the client-site matches the documents previously provided in relation to the role.

How ‘skilled worker visa’ exploitation has evolved

Launched in 2008, the Tier 2 Visa scheme, which became the Skilled Worker Visa, allows companies with sponsorship licenses to recruit workers from outside the UK if local hiring efforts do not succeed.

The visa has helped many companies meet growth demands.

However, I have firsthand experience of the tier 2/skilled worker visa being abused. I’ve seen some companies act as intermediaries, hiring workers on visas and placing them in third-party contract roles, which violates Home Office guidelines.

The Home Office makes clear that this placement is unlawful:

“It also means an applicant must not be either: hired to a third party who is not the sponsor to fill a position with that party, whether temporary or permanent (for example, an agency worker filling a vacancy with a third-party).”

Hopefully, we’re past the tier 2 fraud peak, and maybe IR35 reform had a silver lining

These intermediaries recruited from overseas and brought the workers to the UK on Skilled Worker Visas. These new employees would then seek contract work from agencies using a CV. In my experience, there was a period from 2010 to roughly 2020 where pretty much every job advertised received at least one or two contractors on a Skilled Worker visa attempting to secure a contract through these means.

However, post-April 6th 2021, the changes to the IR35 off-payroll working regulations and the shift to umbrella companies have reduced such practices (N.B. an umbrella company cannot hire them without requiring sponsorship).

Based on my recent experiences and conversations with peers in my industry, I suspect this has now evolved into the scam above -- individuals exploiting the system by using one limited company/PSC and one UK passport, for multiple workers on multiple contract assignments.

Meet 'Ade,' the imposter candidate scammer trying to bypass UK immigration rules

Here’s an example of how the imposter candidate scam is trying to bypass UK immigration rules.

We directly placed a contractor -- we’ll call her 'Ade' -- with our client on the south coast.

She made herself available to us for calls.

She was placed and uploaded her ID, a UK passport, to our IDVT.

However, Ade ignored our requests to meet face-to-face online so we could verify her identity by further comparing her face to the ID. This was the first red flag.

Ade visited the client’s offices to collect hardware (relevant to the role) and have her photo taken for a site “security pass.” When we raised our concerns with the client, we requested to see the photo, and, lo and behold, the face on the UK passport and the face on the site security pass were completely different. We were staring at two completely different people!

Perhaps intentionally, the two shared the same ethnicity and the same gender. But all other identifying features were different, even extending to age -- indeed, we estimate some 10 years younger!

Almost needless to say, the offer was withdrawn, and the matter was reported to the Home Office.

Final thoughts

My conclusion – both to this article and to this disconcerting rise in hiring fraud, is that every individual should provide a share code, even where a PSC supplies a substitute worker (in which case the agency should hold the certificate, and share the image with the client to confirm that very person is providing the services).

I acknowledge that contractors operate as their own PSCs, and jump through a lot of hoops already so may find the introduction of a share code irritating. But given the attempts of Ade and others to use false identification, it’s clear there is a growing problem.

Those who convince a UK PSC to help them but presumably don’t themselves have the right to work in the UK lawfully, are depriving bonafide UK contractors of legitimate opportunities. It’s time something was done to stop this underhanded and unlawful attempt to frustrate, interrupt and undermine the UK’s flexible labour market.