Protect your sponsor licence: Beware of phishing scams targeting the SMS

What are these phishing scams?

Phishing scams involve fraudulent emails designed to trick you into revealing your SMS login credentials. These emails often appear to be from the Home Office and may include:

• Warnings about compliance action or suspension of your SMS account unless you log in
• Requests to log into SMS to update your account details or reconcile duplicate Certificates of Sponsorship (CoS)
• Links to fake SMS login pages that mimic the official Gov.uk website, where your username and password may be captured.

The emails are often sent to shared mailboxes (e.g., info@yourorganisation.com) or even personal work email addresses. In some cases, organisations have also reported receiving large volumes of spam emails, which can be used to hide unauthorised CoS payment receipts. 

How to stay safe

The Home Office has issued the following guidance to help protect your SMS account:

Be cautious of suspicious emails: do not click on links in emails claiming to be from the Home Office unless you are certain of their authenticity. The Home Office will only send communications to the registered email addresses for your Key Personnel (Authorising Officer, Key Contact, Level 1 and Level 2 users).

Always access the SMS securely: always log in to your SMS account through the official Gov.uk website by searching for ‘www.gov.uk’ in your internet browser and navigating to the ‘UK visa sponsorship management system’ page from there.

Regularly review your SMS account: monitor your SMS account regularly to identify any suspicious activity. The Home Office recommends that a Level 1 User logs in at least once a month to:

1. Check and update the contact details for Level 1 and Level 2 users, checking in particular that no unauthorised users have been added, or changes made to existing users' email addresses or telephone numbers.
2. Deactivate any Level 1 or Level 2 users who have left or changed roles in your organisation.
3. Review recent and outstanding change requests, CoS allocation requests and assignments, and other licence activity for any unauthorised or unexpected actions.

Report suspicious activity: if you suspect your SMS account has been compromised:

• Immediately change your password and advise other Level 1 and Level 2 users to do the same
• Report the issue to the Home Office, providing details of the phishing email, any suspicious activity, and actions taken

Further guidance on how to securely access your SMS account and conduct regular checks is available in the SMS user manual. 

How we can help

Our specialist Immigration team are experts in advising sponsors on the operation of their sponsor licences and understand how vital it is to maintain the security of your sponsor licence and ensure compliance with immigration laws. If you’re concerned about the security of your SMS account or want to ensure your licence is compliant and secure, we can assist you.

Our team can:

• Conduct a detailed review of your sponsor licence and SMS account to identify any vulnerabilities or unauthorised activity
• Offer a sponsor licence management and maintenance retainer under which we will carry out regular reviews of your sponsor licence and SMS, report to your licence's Authorising Officer on all activity on the licence (highlighting any concerns) and provide updates on recent and forthcoming changes affecting you as a sponsor
• Assist with reporting any suspected phishing incidents to the Home Office.

By taking proactive steps now, you can protect your organisation from the potentially serious consequences of a compromised sponsor licence. 

If you’d like to discuss your sponsor licence or any other immigration matter, please contact Tom Brett Young.