Six SRA alerts show how copied credentials support false instructions
Six SRA alerts dated 7–9 October cover false corporate, recovery and legal communications. A linked register explains the patterns and a separate late catch-up.
The brief
Our check of the SRA archive found six distinct alerts dated 6–12 October, all published between 7 and 9 October. They include false corporate transaction messages, recovery offers and purported legal correspondence. The individual source links and dates appear below; this is a count of published warnings, not victims or losses.
We also add a separately labelled alert dated 5 October that was absent from our previous weekly coverage. Our practical conclusion is to verify the particular instruction through a trusted route, even when a message contains genuine professional details. A copied name or registration number can identify the person being impersonated without establishing who sent the message or who authorised the requested action.
The full record
The six entries below were checked individually against the SRA’s original warnings. The regulator’s scam-alert archive supplied the publication dates. We count each distinct alert URL once and keep the earlier catch-up outside this week’s total.
The six alerts
9 October — Francesco Camilotti and Kingsley Wood. The warning describes bogus WhatsApp profiles and communications about supposedly confidential corporate transactions. The genuine firm and solicitor confirmed no connection. Read the SRA warning.
9 October — Wafi London and Mohammed Naser. A cloned website and documents offered recovery of lost funds and sought upfront payments and purported court fees. The genuine firm and solicitor confirmed no connection. Read the SRA warning.
9 October — Ashtons Legal. The warning concerns a website and messages offering recovery of lost investments while misusing genuine professional details. The genuine firm confirmed no connection. Read the SRA warning.
8 October — Owen White Catlin. A purported lease letter sent to an energy company misused the firm’s identity and a solicitor’s signature. The warning separates the bogus correspondence from the genuine firm. Read the SRA warning.
8 October — Purported Grosvenor Solicitors inheritance email. An email offered help with an alleged inheritance. The SRA does not regulate the named sender or purported firm; genuine Grosvenor Law confirmed no connection. Read the SRA warning.
7 October — Ahmed Makky. Emails misused the genuine solicitor’s name, SRA number and status. He confirmed that he had not sent or authorised the emails. Read the SRA warning.
Catch-up: one alert dated 5 October
A purported inheritance email used a lookalike sender domain and genuine details in its signature. The genuine firm and solicitor confirmed no connection. The Michael Davison warning is dated 5 October. We verified it in the live archive during this run after the web reader failed. We have not established when it first became visible. It is additional coverage, not a seventh alert within the 6–12 October period.
Our analysis: check the requested act
The practical question is not just whether a named professional exists. Ask whether that professional sent this message and is authorised to request this particular action. For a confidential transaction, verify the matter and instruction with a contact established independently of the incoming message. A request for secrecy should not remove that step.
For a recovery offer, separate the person’s claimed credentials from the proposed service, the authority to act and the basis for any requested payment. For a lease or supplier change, verify the change with the known counterparty before altering a record. These are different workflows, even when the impersonation technique looks similar.
Keep the verification attached to the decision
Record which instruction was checked, the trusted route used, who confirmed it and whether any question remained unresolved. If a later message changes the payee, destination or scope, assess that change explicitly. An earlier check should not automatically authorise a different instruction.
These are proposed operational practices, not evidence that any product would have prevented the reported events. The genuine people and firms whose identities were misused should not be treated as perpetrators.
We checked the live SRA archive and six individual alerts dated 7–9 October during the 12 October run. The reporting window is 6–12 October, through the time of checking; later entries may change the total. A separate 5 October warning is included as catch-up and excluded from six. We count warning URLs, not incidents, perpetrators, messages, victims or financial losses. First-appearance times are unknown. The proposed operational practices have not been tested as benchmarks.