UK Visas and Immigration alert: phishing attempts targeting SMS accounts

UK Visas and Immigration (UKVI) has issued an urgent notice to all holders of sponsor licences in the UK advising of yet another phishing scam that is in circulation.

The phishing attempt purports to be from the Home Office, uses sophisticated terminology, and cites compliance action, suspension or revocation notices, with a warning to immediately login to the sponsorship management system (SMS). 

The emails provide a link which takes user(s) to a screen that mimics the SMS log in portal. They are then asked to provide their login credentials, which may then be captured to gain access to their SMS account, primarily used to apply for and assign certificates of sponsorship (CoS).

The emails are often sent to generic mailboxes listed on websites e.g. info@sponsororg.com but may also be sent to personal work email address(s). There have also been recent reports of mailboxes receiving high volumes of spam emails in order to mask CoS payment receipts.

I think I might have entered my login details via a phishing link – what do I do?

The Home Office will only ever send email communications relating to your sponsor licence to the email address(s) provided for your nominated key personnel. 

If you have received a phishing email, clicked an unauthorised link, and entered your user details, you must log into the SMS account and follow the steps set out in the ‘how to securely access your SMS account’ section, then select ‘change password’ to change your password. 

After you have done this, you must follow the steps set out in the ‘urgent actions to secure your SMS account’ section, followed by the steps in the ‘if you find a suspicious activity on your SMS account’ section.

Urgent actions to secure your SMS account

If you have not received a phishing email, it is still advised that you take the following urgent actions to ensure that there is no unauthorised activity on your SMS account:

• Log in to SMS by following the steps in the ‘How to securely access to your SMS account’.
• Select ‘Manage Level 1 and 2 users’ to check that your details are correct and that no amendments have been made to your email address and/or telephone number.
• Select ‘Licence Summary’ to check that the details of your authorising officer and the key contact on your licence are correct.
• Select ‘Request changes to licence details’ and then ‘View recent and outstanding change requests’ to check for recently submitted change requests.
• Select ‘Request renewal of annual CoS/CAS allocations’ to check for recently submitted CoS/CAS allocation renewal requests.
• Select ‘Request CoS/CAS allocation increase’ to check for recently submitted CoS/CAS allocation increase requests.
• If you are licensed in the Skilled Worker route, select ‘Workers’ and then ‘Defined CoS’ to check for recently submitted, granted or withdrawn requests for defined CoS.
• For all other work routes, select ‘Workers’ and then ‘View CoS’ and conduct a search for recently assigned CoS.
• If you find requests that have been submitted or CoS that have been assigned that appear suspicious, you must withdraw them where that function is available.
• Select ‘Change password’ to change your password.
  
  

If you find suspicious activity on your SMS account

If you have received an email or telephone call that doesn’t seem genuine, or you have concerns that your SMS account has been compromised, you must report it to the Home Office as soon as possible so that actions can be taken to secure your account.

You must provide the Home Office with the following details: 

• Your organisation name and sponsor licence number.
• The user(s) who may have had their account compromised.
• Copies of correspondence received (e.g. the phishing email) and action taken relating to this (e.g. whether links have been clicked and/or user(s) details provided) including the date this action happened.
• Confirmation of whether the user(s) can still access their SMS account and whether they have taken any action to change their password.
• Details of any suspicious activity on the SMS account and any action taken in relation to this activity e.g. withdrawing requests or CoS assigned without authorisation. 

These details must be sent to one of the email addresses below with the subject header ‘SMS Account Compromise':

• businesshelpdesk@homeoffice.gov.uk – if you’re an employer
• studyengagementteam@homeoffice.gov.uk – if you are an educator

If your SMS account has been compromised, the Home Office will take steps to secure your data. This includes:

• Deactivating the user(s) affected and providing advice on how to re-activate their accounts.
• Cancelling CoS issued without authority.
• Identifying and taking appropriate actions for any visa applications associated with CoS.

If you have any concerns about your SMS account, please contact our immigration team. 

Related News, Insights & Events