If an email has arrived from the "Home Office Compliance Unit" or the "Sponsor Licence Management Team", start here. Neither phrase appears anywhere in the operative text of the sponsor guidance that governs your licence. What version 08/26 of Parts 1 and 3 does name is a Business Helpdesk, a Sponsor Compliance Team, compliance officers, and UKVI caseworkers. So the unit in that signature block is an unfamiliar one, which is worth noticing and proves nothing by itself. A fake can copy a real team name, and a real team can be one you have never dealt with. Three other checks do the actual work.
Doing those checks inside the first minute rather than the first afternoon matters because of one sentence in Part 1. Paragraph L4.15: "You are responsible for anything done by anyone you have set up as an SMS User, including people from outside your organisation." If somebody assigns Certificates of Sponsorship (CoS) from your Sponsorship Management System (SMS) account, the breach sits on your licence, not theirs.
What the guidance actually names
Borderless Immigration ran a literal search of Parts 1 and 3 at version 08/26 for the unit names sponsors are seeing in their inboxes. Two teams are named. The Business Helpdesk appears in both Parts as the route for guidance and general queries. The Sponsor Compliance Team appears in Part 3 at C3.7 and C3.10, and it is a real compliance contact, used for things like telling the Home Office you have stopped trading. Alongside those, the guidance refers to compliance officers at C7.14 to C7.19 and to a UKVI caseworker at C2.13.
"Compliance Unit", "Sponsor Licence Management Team" and "Sponsor Licensing Unit" appear in none of that text. One caveat, because this is the kind of claim worth stating precisely: the search covered Part 3 from C1.1 to C10.19 and Part 1 as far as the cooling-off table, which is the body of the guidance rather than every annex. So the honest position is that an unfamiliar unit name is a reason to check, not evidence of anything. There is a genuine Home Office team with "Compliance" in its name, and that is exactly why the name cannot be your test.
Three checks before anyone clicks
The Home Office does not send you a link to log in
The Business Helpdesk guide for employers and sponsors, updated on 14 August 2026, is unambiguous: "The Home Office will never contact you to ask you for, or to verify your SMS user ID or password. We will never provide you with a link or password with which to log into SMS."
That sentence disposes of the whole pattern. The emails in circulation tell a sponsor there is a message waiting in SMS, or that compliance action is coming, then offer a convenient link to log in and deal with it. The link is the tell, however well the rest of the email is written.
Read what the sentence actually covers, though. It is about being asked for your credentials, or being handed a way in. It is not a promise that no genuine Home Office email will ever mention a password, so make the link the test rather than the word. Genuine notice arrives somewhere else, because paragraph C1.2 of Part 3 says "We will let you know of any change through the sponsorship management system (SMS) message board." The message board is the destination, and the only safe way to reach it is to go to SMS yourself.
Genuine licence correspondence goes to a named person
Paragraph L4.81 of Part 1 requires that "All email addresses you provide for each of your Key Personnel must be secure, personal to, and only accessible by, the named individual." The rule runs the other way too: the Business Helpdesk guide states that queries "must be from the Authorising Officer, Key Contact, Level 1 User or representative named on the sponsor licence."
The Home Office deals with named individuals at named addresses, in both directions. An email about your licence that arrived at a shared HR inbox, addressed to nobody in particular, is out of step with the way your own contact details are held. This is the fastest of the three checks and the one most often skipped, because compliance mail gets forwarded two or three times internally before anybody thinks to look at who received it first.
The sender address, and the trap in checking it
The Home Office's fraud guidance, updated on 16 October 2025, says that "Official Home Office email addresses are always in this format: name.surname@homeoffice.gov.uk". Worth knowing, with a caveat that page does not offer: the Business Helpdesk's own published address is BusinessHelpdesk@homeoffice.gov.uk, which is not in that format at all. Functional mailboxes exist, so treat the format as a signal rather than a test, or you will reject genuine mail from the one team the guidance actually names.
The domain is the harder thing to fake and the displayed address is the easier one. The same guidance warns that "Sometimes the email address you see on the screen of a fake website or email is in that format, but when you click on it, it creates an email that will be sent to a different address." Check the real address rather than the friendly name, and remember that official government websites always end in .gov.uk.
What a compromised SMS account costs a licence
Part 3 sets out what the Home Office can do when a compliance failure surfaces, whether it comes to light through a records request or a compliance visit: reduce your CoS allocation, downgrade you to a B-rating, suspend the licence, revoke it, and cancel your workers' permission (C7.5). A breach it treats as minor and correctable brings a B-rating with a time-limited action plan (C7.25). Action plans run for a fixed period of three months (C8.17). C8.14 gives you 10 working days to deal with the fee and three ways to go: pay it and stay licensed, decline and surrender the licence if you are not sponsoring anybody, or ignore it and be revoked. The figure is not in the guidance, which points to the published fee table, where a sponsor action plan currently costs £1,579. While the B-rating stands you cannot assign a CoS to a new worker, although you can still assign one to a worker you were already sponsoring who needs to extend (C8.15).
Per worker, that is one start date gone. Across a sponsored workforce of 50 or more, it is a quarter of hiring and the pipeline behind it standing still. Two action plans in a rolling four-year period plus a third qualifying failure means revocation (C8.22 to C8.24), and a breach the Home Office treats as serious skips the action plan entirely, going to suspension with a view to revocation or to revocation with no suspension first (C7.26). There is no right of appeal against a revocation decision, and the cooling-off period before you can reapply is at least 12 months, rising to 24 for a repeat (C10.3).
To check your own records against what the Home Office asks for, our Home Office Audit Checklist covers the documents and the reporting trail a compliance check tests.
Why more of these are arriving this month
Legitimate email about SMS accounts is unusually busy at the moment, which is exactly the cover a fake one needs. From 9 September 2026 no new Level 2 Users can be appointed, and every existing Level 2 User has to be converted to a Level 1 User, where they are eligible, or have their account deactivated by 8 March 2027 (L4.58 and L4.59). Staff supplied by an employment business cannot be converted at all (L4.65), so for some sponsors that is a handover rather than a form. Dormant accounts now carry a consequence of their own: where the Home Office identifies inactive SMS Users it contacts the Authorising Officer and the inactive Level 1 User directly (L4.73), and a licence left with no active Level 1 User is suspended, with 28 days to nominate one before revocation normally follows (L4.78).
So a sponsor receiving an email this month about their SMS users or their account being at risk has every reason to believe it. That is the point. The three checks work regardless of how plausible the pretext is, which is why they are worth turning into a habit rather than a judgement call each time.
If somebody has already clicked
Order matters, and securing the account comes before working out what happened. Report it to the Home Office first: the Business Helpdesk guide asks sponsors to report a suspicious email, a suspicious call, or a suspected account compromise "as soon as possible so that action can be taken to secure your account", at BusinessHelpdesk@homeoffice.gov.uk. Change the SMS password by going to SMS directly rather than through anything in the email. Forward the email itself to report@phishing.gov.uk, which the National Cyber Security Centre investigates. If money has moved or systems have been breached, report the fraud at reportfraud.police.uk or on 0300 123 2040 in England and Wales, or to Police Scotland in Scotland.
Then read the account. The Authorising Officer is responsible for the activities of all SMS Users and, in Part 1's words, "you must have a system in place to check these activities", with a recommendation to review assigned CoS at least monthly (L4.35 and L4.37). Any CoS assigned that nobody in your organisation can account for should go to the Home Office in the same message as the compromise, not a later one.
Turning that into standing process takes one route and three habits. The route is a single internal destination for anything claiming to come from the Home Office, so the person who owns compliance sees the original rather than the third forward. The habits are checking who an email was addressed to before reading what it says, deactivating leavers' SMS accounts on their last day, and running the monthly CoS review, which is the only thing that turns an unauthorised assignment into something you find yourself rather than something a compliance officer finds for you.
Automate Home Office Audits with Borderless
The Borderless platform provides a centralized system for all sponsorships, automating reminders for key tasks and ensuring best practices across your organization, simplifying audit preparation and ongoing compliance.
Common questions
Will the Home Office ever email me about my sponsor licence?
Yes. Decision letters on a downgrade, a suspension or a revocation are sent by Royal Mail Signed For delivery or by email (C8.10 and C9.18), licence decisions go to the Authorising Officer's mailbox (L9.2), and the Home Office contacts Authorising Officers directly about inactive SMS Users (L4.73). What it will not do is send you a link or a password to log into SMS.
Is an email from the "Home Office Compliance Unit" a scam?
The name proves nothing either way. It does not appear in the operative text of Part 1 or Part 3 at version 08/26, but the guidance does name a Sponsor Compliance Team as a genuine contact, so the word "compliance" in a sender name is not itself suspicious. Judge the email on the link, the recipient, and the sender domain instead.
Can the Home Office revoke my licence because of a phishing attack?
The attack is not the breach. What lands on the licence is what was done with the account, because you are responsible for anything done by an SMS User (L4.15). Reporting a compromise quickly, and being able to show what was assigned and when, is what separates a contained incident from a compliance failure.
Keeping the record straight
Sponsor licence compliance is mostly a records problem wearing a legal costume, and this is a good example. The difference between a contained incident and a revocation is whether somebody can say, on the day, exactly who had access and what they did with it. Borderless keeps that record current for every sponsored worker, alongside the wider sponsor licence duties it sits inside.
If you would like a look at your own position, book a 20-minute compliance review. There is just too much at stake to find out during a compliance check.
Sources: Business helpdesk: guide for employers and sponsors (GOV.UK, page updated 14 August 2026); Fraud, tricks and scams: guidance (GOV.UK, updated 16 October 2025); Avoid and report internet scams and phishing (GOV.UK, updated 2 September 2026); Workers and Temporary Workers: guidance for sponsors, Part 1: apply for a licence and Part 3: sponsor duties and compliance, both version 08/26, valid from 28 August 2026, pages updated 3 September and 2 September 2026; Home Office immigration and nationality fees, 8 April 2026. Paragraph references checked against the 08/26 text on 15 September 2026.
