Brand Impersonation Evidence: Staffology by IRIS

Lookalike domains are impersonating Staffology by IRIS

This is a public evidence page from Scam Detective’s published research. The real Staffology by IRIS operates at iris.co.uk. The 1 domain below impersonates it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

Lookalike domains found

Critical

Overall risk level

Independent corroborating sources

October 18, 2026

Case verified

Confirmed lookalike domains

Critical riskPhishing campaign — cloned payroll-onboarding flow

Rotating phishing domains impersonating Staffology onboarding

Registration profileRotating burner registrations — phishing pages are replaced as fast as they are reported, so the campaign, not any single domain, is the finding

First seen2026, in the active NI-number phishing wave

Evidence

An active phishing wave is impersonating Staffology payroll onboarding — pages cloned from the real onboarding flow, served from lookalike domains.
Harvests National Insurance numbers and payroll/bank details at the exact moment a new employee expects to hand them over — onboarding is the one step where victims are primed to comply.
The real Staffology is IRIS Software Group’s payroll product, served from iris.co.uk — onboarding never runs on a separate lookalike domain.
NI numbers and bank details entered on a cloned onboarding page go straight to the operators and are reused for identity fraud and account takeover.

Red flags in this impersonation

01Onboarding arrives by link, not through the product — real Staffology onboarding happens inside the payroll product at iris.co.uk, never on a separate domain a link drops you onto.

02A page asking for your National Insurance number and bank details together is the single highest-value harvest in UK employment fraud — verify the domain before typing either.

03Type the domain yourself — if an email or text about payroll onboarding links anywhere other than iris.co.uk, it is the phishing wave.

04Urgency framing (“complete onboarding today or your first pay is delayed”) is pressure applied to exactly the data the operators want.

05Report UK payroll-onboarding phishing to your employer and to Action Fraud — the NI number is permanent; a stolen one outlives the phishing page by years.

Who corroborates this evidence

Brand-domain mismatch

Staffology is IRIS Software Group’s payroll product, operated from iris.co.uk — its onboarding flow never runs on a third-party or lookalike domain.

Payroll-onboarding phishing pattern

Harvesting NI numbers and bank details through a cloned onboarding page matches the documented employment-onboarding phishing pattern — the moment victims are most primed to hand over exactly the data being asked for.

Scam Detective monitoring of the active wave

Our monitoring tracks the active impersonation wave: rotating phishing domains presenting the Staffology onboarding flow, replaced as fast as they are reported.

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free Staffology by IRIS impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.

Found a store claiming to be Staffology by IRIS?

Paste the URL for a free instant risk score & verdict — a 0–100 score, a plain-English verdict (safe / suspicious / likely scam), and the red flag count, in seconds. Unlock the full report — all 5 red flags with evidence and a 3-step action plan — free with your email, or $0.50 one-time.

No subscription. Instant results — before you hand over a card number.