Scam watch: the fake Home Office sponsor licence PDF is back, and how it makes money

The fake UK Visas and Immigration email aimed at sponsor licence holders is still doing the rounds. The subject line is the same: "Urgent: Please review attached PDF: Sponsor Licence Recent Changes to Review". One copy was sent at 2am on a Sunday in late October. The same email came back on a Monday morning in early November, with a new website hidden behind the PDF.

It is a scam. The Home Office and UK Visas and Immigration did not send it and are not involved. This guide explains how it works, how the criminals behind it turn one stolen login into money, and how to protect your business.

What the email looks like

The email is short and looks official. The tell-tale signs:

• The sender name says "UK Visas and Immigration Home Office", but the address behind it is on a throwaway .com domain with no link to the government.
• The "reply to" address is made to look like a homeoffice.gov.uk address. It is only there to make a quick glance look right.
• It opens with "Dear Sponsor" and gives no licence number and no named contact.
• It says the "important updates" are "in the attached PDF" and warns that "timely action is required to avoid any impact on your licence".
• It is signed "Home Office Compliance Unit", with a footer naming the Sponsorship Management System (SMS) and the real Home Office address.

There are no links in the email itself. The attachment is called "sponsor_upgrade_guidelines.pdf". Inside, there is almost nothing: a heading, one line of text and a large "Download PDF" button. That button points to an unrelated website, and the website changes from one copy to the next.

How the scam works

1. The criminals pick their targets. The Home Office publishes a register of licensed sponsors on GOV.UK, so finding businesses that hold a licence is easy.
2. They send the email in bulk from a server they control. Because the email has no links, filters that scan messages for bad links have nothing to catch.
3. The PDF carries the link instead. Security researchers at Forcepoint have described the same trick: an email with no links, a PDF attachment, and a link inside the PDF that leads to a fake sign-in page.
4. The button leads off to another website. Home Office warnings describe fake pages made to look like the SMS sign-in screen. Whatever user ID and password are typed into a page like that go straight to the criminals.
5. A new website behind the button in each wave keeps the scam going when an old one is blocked.

How the scammers make money

The prize is access to the sponsor's SMS account. The Home Office has warned that criminals use stolen SMS access to apply for and assign Certificates of Sponsorship (and, for education providers, Confirmations of Acceptance for Studies). Those documents are what a person overseas needs to apply for a UK work or study visa.

A Certificate of Sponsorship is supposed to be free. People desperate to work in the UK will still pay a lot for one. A BBC investigation in 2024 found that one agent allegedly sold 141 visa documents for about £1.2 million, with students paying up to £17,000 each. Most of those documents were worthless and 86 were rejected by the Home Office as invalid. The agent denies wrongdoing.

That is the money trail. The criminals do not need to take money from the business they target. They take its login, create real-looking sponsorship records in its name, and sell them to job seekers abroad. The buyers lose their money. The business is left to explain records it never made, and its sponsor licence can be put at risk.

How to spot it

• The sender address does not end in gov.uk. Check the address, not just the name.
• The Home Office says it will never send you a link to log in to SMS. A "Download PDF" button that opens a website is the same thing.
• It arrives at a general company inbox. The Home Office only sends sponsor licence emails to the addresses held for your named key personnel.
• Urgency plus a threat to your licence, with no case details.

How to protect your business

• Tell everyone who reads your general inbox, HR staff included, what this email looks like.
• Never open attachments in unexpected "government" emails. Delete them or forward them for checking.
• Only reach SMS by going to GOV.UK yourself and searching for the Sponsorship Management System.
• Keep your list of Level 1 and Level 2 users short and up to date. Remove anyone who has left.
• Check your SMS account regularly for Certificates of Sponsorship you did not assign.
• Forward suspicious emails to the National Cyber Security Centre at [email protected]. It is free, and the NCSC says it acts on every report.

If you clicked, replied or paid

1. If you typed your SMS details into any page, go to GOV.UK yourself, sign in to SMS and change your password straight away.
2. Check for anything you did not do, such as new or assigned Certificates of Sponsorship.
3. Report it to the Home Office. Work route sponsors use the business helpdesk ([email protected]) and student route sponsors use the study engagement team ([email protected]). Give your organisation name and sponsor licence number.
4. If you opened the PDF or the website on a work computer, run a full security scan and change the passwords used on that computer.
5. If you think a crime has happened or you have lost money, report it to Report Fraud at reportfraud.police.uk. It replaced Action Fraud in December 2025 and covers England, Wales and Northern Ireland. In Scotland, report it to Police Scotland. If money left your account, call your bank using the number on the back of your card.

A real Home Office message about your licence will never need a mystery PDF, a "Download" button or a link to log in. When in doubt, go to GOV.UK yourself.