Scam watch: the fake Home Office email aimed at sponsor licence holders

A scam email claiming to come from UK Visas and Immigration is doing the rounds among UK businesses. The subject line reads "Urgent: Please review attached PDF: Sponsor Licence Recent Changes to Review". Copies seen in late October arrived overnight at a weekend, and the same email came back a week later.

It is a scam. It is aimed at UK employers who hold a sponsor licence, and it plays on one fear: losing that licence. Here is how it works and how to protect your business.

What the email looks like

The email is short. It addresses the reader as "Dear Sponsor", says there are important updates about licence compliance in the attached PDF, and warns that quick action is needed to avoid any impact on the licence. It is signed by a "Home Office Compliance Unit" and has an official-looking footer that mentions the Sponsorship Management System (SMS) and the Home Office's real London address.

Attached is a PDF with a name about "sponsor upgrade guidelines". Do not open it. Some email systems hold this email back because the sender fails an email authentication check, but others let it through, so don't rely on your filters to catch it.

What it is after

The Home Office has warned licensed sponsors several times since 2025, most recently in March 2026, that phishing emails are being sent to them. The usual aim is to get you to "log in to SMS" on a fake page, so the criminals collect your user ID and password. A PDF attachment is a common way to carry that link past email filters that scan for bad links in the message itself. Attachments can also be used to deliver harmful software, so opening one on a work computer is a risk in its own right.

Why does an SMS login matter so much? With access to your account, criminals can apply for and assign Certificates of Sponsorship in your name. That is valuable to people who sell fake job offers and visas, and it leaves your business facing the compliance questions, which can put your licence at risk.

How the people behind it likely operate

• They know who to target. The Home Office publishes a register of licensed sponsors on GOV.UK. It is easy to match those company names to the general contact addresses on their websites, which is likely how general company inboxes are reached.
• They send in bulk from servers they control. The email comes from a domain that has nothing to do with the Home Office, sent by the server's administrator account. That is typical of a server set up quickly for spam, or one that has been taken over.
• They dress up the details. The "reply to" address is made to look like a real Home Office address, so a quick glance looks right even though the real sender is somewhere else.
• They pick quiet times and try again. Sending overnight at the weekend, then repeating a week later, gives the email more chances to be seen by someone in a hurry.

The red flags

• The sender's address does not end in gov.uk.
• "Dear Sponsor", with no licence number and no named key contact.
• Urgency plus a threat to your licence.
• An attachment to "review" instead of a message inside SMS.
• It arrives at a general inbox. The Home Office says it only sends sponsor licence emails to the addresses you gave for your named key personnel, and that it will never send you a link to log in to SMS.

How to protect yourself

• Never open attachments in unexpected "government" emails. Check the full sender address, not just the name.
• Only reach SMS by going to GOV.UK yourself and searching for the sponsorship management system.
• Never share your SMS user ID or password, and regularly review your Level 1 and Level 2 users. Remove anyone who has left.
• Tell everyone who reads your general inbox about this email.
• Forward suspicious emails to the National Cyber Security Centre at [email protected]. It is free, and they act on every report.

If you already opened it or signed in

1. Go to GOV.UK yourself, sign in to SMS and change your password straight away.
2. Check for anything you did not do, such as Certificates of Sponsorship you did not assign, and report suspicious activity to the Home Office business helpdesk ([email protected]).
3. If you opened the PDF, run a full security scan on that computer, change the passwords used on it and turn on 2-step sign-in wherever you can.
4. If you think a crime has happened or you have lost money, report it at reportfraud.police.uk (England, Wales and Northern Ireland) or to Police Scotland.

A real Home Office message about your licence will never need a mystery PDF, a midnight deadline or a link to log in. When in doubt, go to GOV.UK yourself.