Guide
Warning signs of CIS fraud in your supply chain
How to identify red flags that could indicate CIS fraud in your supply chain. Covers missing UTRs, unusual payment patterns, phoenix company indicators, and labour-only invoice anomalies. Essential reading for contractors subject to fraud due diligence requirements.
HMRC can hold you liable for fraud in your supply chain if you knew or should have known about it. This means you could face penalties and unpaid tax recovery even if you were not directly involved in the fraud.
Recognising warning signs is your first line of defence. If you identify red flags and investigate appropriately, you demonstrate that you could not reasonably have known about any fraud. If you ignore warning signs, HMRC may determine you "should have known" and hold you responsible.
This guide explains what to look for and what to do when you spot potential problems.
Why this matters
The consequences of failing to spot fraud in your supply chain are severe:
- 30% penalty on the lost tax - applied to your business, directors, and connected persons
- Joint liability for unpaid CIS deductions and VAT throughout the fraudulent chain
- Immediate GPS cancellation with a minimum 5-year disqualification
- Reputational damage affecting relationships with other contractors and clients
Organised criminal groups use construction supply chains to extract tax that is never paid to HMRC. Even legitimate contractors at the top of a chain can be held responsible for what happens further down.
Red flags at a glance
The following snippet summarises the key warning signs HMRC has identified. Each of these should prompt further investigation before you make or receive payments.
Practical examples: what fraud looks like in practice
Understanding how these red flags appear in real situations helps you spot them in your own supply chain.
Example 1: The disappearing subcontractor
Scenario: A new labour-only subcontractor offers competitive rates for groundwork on your housing development. They provide a UTR that verifies successfully, but when you search Companies House, the company was only formed 3 months ago. The registered address is a residential property. After 6 months of work, the company stops responding and you discover they have been dissolved with unpaid tax.
Warning signs you should have spotted:
- Newly incorporated company with no trading history claiming significant turnover
- Registered address is a residential property, not business premises
- Labour-only invoices with no evidence of actual workforce on your site
- Prices below market rate (the subcontractor was not paying their taxes)
What you should have done: Visited the business premises, verified the workforce existed, checked director history for previous dissolved companies, and questioned the below-market pricing.
Example 2: The circular payment chain
Scenario: You pay a tier-1 subcontractor who subcontracts to a tier-2, who subcontracts to a tier-3. Each company is registered for CIS and verifies correctly. However, the tier-3 company never pays the CIS deductions to HMRC. HMRC investigates and finds the three companies share directors or connected persons, and money flowed back to the original payer.
Warning signs you should have spotted:
- Multiple layers of subcontracting for relatively simple work
- The same workforce appearing across different company names
- Rapid changes in which company invoices you for the same labour
- Shared addresses or directors across companies in the chain
What you should have done: Mapped your complete supply chain, asked direct questions about who employs the workers, and investigated when company names changed.
Example 3: The phoenix company
Scenario: A bricklaying subcontractor you have used for years suddenly changes company name. The directors are the same, the workers are the same, but invoices now come from "ABC Brickwork Ltd" instead of "XYZ Brickwork Ltd". When you check Companies House, XYZ Brickwork Ltd was dissolved with outstanding tax liabilities.
Warning signs you should have spotted:
- Directors have previously been involved with dissolved companies
- Pattern of companies lasting 12-18 months then disappearing
- History of Companies House late filing or strike-off notices
- Same people, same workforce, different company name
What you should have done: Checked director history before continuing the relationship, asked why the company changed, and verified the new company's compliance status.
How to investigate warning signs
When you spot a red flag, you must investigate before making payment. Simply noting the concern is not enough - you need to take action and document what you did.
Step 1: Pause the payment
Do not pay until your concerns are resolved. Once money leaves your account, recovering it from a fraudulent supplier is extremely difficult. Genuine subcontractors will understand reasonable payment delays for verification.
Step 2: Ask direct questions
Contact the subcontractor and ask specific questions about the concern:
- "Why has your company name changed from the one I originally contracted with?"
- "Can you explain why your registered address is a residential property?"
- "Your price is significantly below what other subcontractors quoted - can you explain how you achieve this?"
- "Can you provide references from other contractors you work with?"
Evasive or inconsistent answers are themselves a warning sign.
Step 3: Verify independently
Do not rely solely on information the subcontractor provides:
- Visit the business premises - Does it look like a functioning business?
- Search Companies House - Check filing history, director history, and accounts
- Check for director connections - Are the same people behind multiple companies?
- Verify insurance independently - Call the insurer directly to confirm the policy
- Contact references - Speak to other contractors who have used them
Step 4: Document everything
Keep a written record of:
- What warning sign you identified and when
- What questions you asked and the responses received
- What verification steps you took
- What decision you made and why
If HMRC later investigates, this documentation demonstrates you took the "knew or should have known" test seriously.
Step 5: Make a decision
Based on your investigation, decide whether to:
- Proceed with payment - If your concerns are fully resolved with evidence
- Proceed with enhanced monitoring - If partially resolved but you will watch for further issues
- Terminate the relationship - If concerns cannot be adequately explained
- Report to HMRC - If you believe fraud is occurring
When to report suspected fraud
You can report suspected CIS fraud to HMRC anonymously. Reporting protects you by demonstrating you took action when you identified concerns.
Consider reporting if:
- You have strong evidence of fraudulent activity, not just suspicion
- A subcontractor has disappeared owing you money or CIS deductions
- You discover a company in your supply chain has been dissolved with unpaid tax
- You identify circular payment patterns or phoenix company activity
HMRC will not tell you the outcome of any investigation, but reporting demonstrates you acted responsibly.
Building warning sign detection into your processes
Rather than treating fraud detection as a one-off exercise, build it into your standard onboarding and payment processes:
At onboarding
- Use a standard checklist covering all verification steps
- Flag any warning signs identified and document your investigation
- Require sign-off before adding new subcontractors to your approved list
- Set a review date to re-verify (at least annually)
At every payment
- Check invoices for round numbers, labour-only patterns, or missing detail
- Verify the payment account matches the registered business
- Question any request to pay a different entity or bank account
- Match invoiced labour to actual workers you have seen on site
Periodically
- Re-verify CIS status at least annually
- Check Companies House for any changes (new directors, address changes, filing delays)
- Review your full supply chain map and question any changes
- Share intelligence with other contractors about problematic suppliers
What happens if you ignore warning signs
If HMRC determines you "should have known" about fraud in your supply chain, the consequences are severe:
| Consequence | Impact |
|---|---|
| 30% penalty on lost tax | Applied to your business, plus directors and connected persons personally |
| Joint liability for unpaid tax | You could be required to pay the entire unpaid CIS and VAT from the fraudulent chain |
| GPS cancellation | Immediate cancellation with 5-year minimum before you can reapply |
| HMRC investigation | Time-consuming review of all your CIS records and relationships |
| Reputational damage | Other contractors may avoid working with you |
Ignorance is not a defence. If warning signs were present and you did not investigate, HMRC will argue you should have known.
Next steps
To protect your business from supply chain fraud liability:
- Review your current subcontractors - Check each one against the warning signs in this guide
- Implement due diligence processes - See our guide on protecting your business from CIS supply chain fraud
- Train your team - Ensure everyone involved in subcontractor management knows what to look for
- Document your processes - Create an audit trail showing you take fraud prevention seriously
- Seek professional advice - If you have concerns about existing subcontractor relationships