Is a company asking for my director ID or company registration number to verify a B2B transaction legitimate?
Requesting a company registration number is normal in B2B transactions, but asking for director personal details or internal login credentials is not.
Last reviewed: 1 August 2026
Explanation
Business-to-business fraud increasingly targets company directors and finance teams. In a legitimate procurement or invoicing context, it is normal to exchange company registration numbers and verify VAT numbers. However, fraudsters posing as suppliers, compliance services, or regulatory bodies ask for more: personal director identification numbers, Companies House authentication codes, or access to filing portals. With this information they can file false company changes, redirect dividends, or commit other registration fraud. A separate risk is a supplier requesting a 'vendor verification' email that contains a link to a fake payment portal where your banking credentials are captured. Always verify any B2B verification request through a channel you initiated — phone the contact at their known number, not one provided in the email.
Business identity fraud is attractive to criminals because a company's public filings do most of their reconnaissance for them: director names, registered addresses, and filing dates are openly searchable, letting an approach sound remarkably well informed. The defence is to treat credentials for filing portals with the same discipline as banking credentials — held by named individuals, never shared by email, and never entered on a page reached through a link. It is also worth setting up whatever change-alert service your company registry offers, so any filing made against your company generates an immediate notification you can act on before changes take effect commercially.
Common red flags
- Request for a Companies House or company portal authentication code
- Supplier or client requesting personal director credentials
- Verification request arrives by email with a link to a portal
- Request comes from a newly introduced contact or through a social media message
- Sense of urgency about completing verification to release a payment
What to do now
- Never share portal authentication codes or filing credentials
- Verify any request by calling the contact on a known number
- Check your company registration for unauthorised changes regularly
- Report suspected business identity fraud to your company registry
Frequently asked questions
Can someone change my company's registered details if they have my authentication code?
In some jurisdictions, yes — authentication codes can be used to file changes to company registration details. Guard them as carefully as a password.
How do I know the caller is really from my supplier's finance team?
You cannot know from the call itself — names and details are often researched in advance. Hang up and phone the supplier on the number you already hold on file before acting on any request.