UK Sponsor Licence Holders Warned Of Phishing Scams

The Home Office has recently issued a communication to sponsors' Key Contacts and Authorising Officers, warning of phishing scams that could compromise Sponsorship Management System (SMS) account security. All sponsors should take action to check for unauthorised activity on their SMS account.

What do the phishing emails say?

According to the communication sent to sponsors on 28 October 2025, the Home Office has become aware of more SMS phishing email scams, with the emails purporting to be from the Home Office. They are often sent to shared mailboxes found on organisation websites, but they could also be sent to your personal work email address. There have also been reports of mailboxes receiving lots of spam mail, in an attempt to mask Certificate of Sponsorship (CoS) payment receipts.

The scam emails vary in content, but some mention a warning of compliance action or account suspension if you fail to log in. Others advise you to log in to update your SMS account details. If you click on the unauthorised link, you'll be asked to provide your SMS User ID and password, which risks the scammer being granted access to your SMS account.

Scammers want to gain access to your account mainly to apply for and assign CoS fraudulently.

What to do if you've received an email with a link to a fake SMS login page

The Home Office has confirmed it will only ever send communications relating to your sponsor licence to email addresses provided for your nominated key personnel.

If you've received a phishing email and have entered your login details, you must follow the 4 steps below.

Step 1

Securely access your SMS account through the gov.uk website. To do this:

• Search for 'www.gov.uk' on your internet browser;
• Select the 'Welcome to.Gov.UK' link;
• Search for 'UK visa sponsorship management system';
• Select the 'UK visa sponsorship management system' link;
• Select 'Start Now' from the page presented; and
• Log into your SMS account.

Step 2

Select 'Change Password' to change your password.

Step 3

Take urgent action to secure your SMS account (see 'Urgently review your SMS account (all sponsors)' below).

Step 4

Report any suspicious activity on your SMS account (see 'Report suspicious activity on your SMS account' below).

Urgently review your SMS account (all sponsors)

Even if you haven't received a phishing email, the Home Office requires you to take the following urgent actions to ensure that there has been no unauthorised activity on your SMS account:

• Log in to SMS by following Step 1 above;
• Select 'Manage Level 1 and 2 Users' to check that your details are correct and that your email addresses and/or telephone numbers haven't been amended;
• Select 'Licence Summary' to check that your Authorising Officer and Key Contact details are still correct;
• Select 'Request changes to licence details' and then 'View recently and outstanding change requests' to check for any recently submitted change requests;
• Select 'Request renewal of annual CoS/CAS allocations' to check for any recently submitted CoS/CAS allocation renewal requests;
• Select 'Request CoS/CAS allocation increase' to check for recently submitted CoS/CAS allocation increase requests;
• If you have a Skilled Worker licence, select 'Workers' and then 'Defined CoS' to check for any recently submitted, granted or withdrawn requests for defined CoS; and
• For all other work routes, select 'Workers' and then 'View CoS' and do a search for any recently assigned CoS;
• Withdraw any submitted requests or suspicious CoS which have been assigned, where this function is available; and
• Select 'Change password' to change your password, if you haven't done so already.

The Home Office recommends that your Level 1 users access the SMS account at least once a month to do the checks set out above. For more guidance, you can access the SMS user manuals here.

Report suspicious activity on your SMS account

Any suspicious activity or concerns about your SMS account should be reported to the Home Office immediately so steps can be taken to secure your data and account. If you are a work route sponsor, you should email businesshelpdesk@homeoffice.gov.uk. If you are a student route sponsor, the email address is studyengagementteam@homeoffice.gov.uk.

You should provide the Home Office with the following details:

• Your organisation name and sponsor licence number;
• The names of any users who may have had their account compromised;
• Copies of correspondence received (e.g. the phishing e-mail) and action taken relating to this (e.g. whether links have been clicked and/or user details provided) including the date this action happened;
• Confirmation whether the affected users can still access their SMS account and whether they have taken action to change their password; and
• Details of any suspicious activity on the SMS account and any action taken in relation to this activity e.g. withdrawing requests or CoS assigned without authorisation.

How to keep your SMS account secure

It is important to be alert to online scams. The Home Office's advice to minimise the risk to your SMS account is as follows:

• Don't click on any links in suspicious emails;
• Never share your SMS login details (username and password) with anyone;
• Change your SMS password regularly using a strong, long password;
• Use different passwords if you have access to multiple SMS accounts;
• Deactivate Level 1 and Level 2 users who leave or change roles within your organisation;
• Keep your contact details up to date;
• Always have one or more active Level 1 user;
• If your SMS account may have been compromised, change your password immediately and ask other Level 1 and Level 2 users to change theirs; and
• Report visa and immigration scams to Action Fraud using the link here: Avoid and report internet scams and phishing: Report visa and immigration scams – GOV.UK .

For more guidance to protect your organisation from cyber threats and improve its security, click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.