Private companies that sell Covid-19 tests to holidaymakers have been told to “get on the right side of the law” by the competition regulator, after widespread allegations of poor service triggered a government crackdown.

Days after the health secretary, Sajid Javid, said “cowboy” PCR test firms could be removed from the government’s list of approved providers, the Competition and Markets Authority issued a separate warning.

It said rogue companies could face enforcement action from the CMA itself or from National Trading Standards if they are found to be breaking consumer law by misleading customers or treating them unfairly.

It follows multiple allegations that private providers, who are thought to have made GBP500m since the return of international leisure travel in mid-May, failed to deliver tests, send results and process refunds.

In an open letter to PCR test firms, many of which sprang up this year, the CMA’s general counsel, Sarah Cardell, said: “PCR test providers should be in no doubt that they need to get on the right side of the law. If they don’t, they risk enforcement action.

“This warning goes hand in hand with action taken by government this week and is the latest step in our work to tackle rip-off prices and bad service. We continue to work closely with [the Department of Health and Social Care] in reviewing this market and will be providing further advice to DHSC on action that can be taken.”

The letter highlights practices including:

Advertising test prices that do not include additional charges.

Advertising cheap tests that are not available or only in small quantities.

Failing to deliver tests or provide results on time, or at all.

Refusing to provide refunds when consumers are let down.

The Guardian has documented allegations about poor service at several PCR test firms.

A Tory donor who founded Conservative Friends of NHS, and his son, faced questions about two private companies they run offering PCR tests for travellers after being hit with complaints.

Last week, a Covid testing company co-owned by a former Labour justice minister and a Labour councillor was accused of failing to deliver kits and test results and not refunding customers, forcing them to fall back on the NHS.

The company denied the allegations, made by several customers.

Dozens of companies offering PCR tests were set up earlier this year after the government set out a regime under which millions of travellers arriving in England are required to take the tests but must buy them from private companies.

The move sparked a feeding frenzy by firms trying to win a slice of the market, with some even adding punctuation marks to their trading names in an effort to appear at the top of a list of providers published in alphabetical order.

But the process has been dogged by successive revelations about the system.

Reports of poor service have stoked concern that the NHS has ended up footing the bill when private providers do not deliver and customers are forced to call the 119 Covid helpline to acquire tests free of charge.

A Guardian investigation found firms may be skewing the market by not charging VAT sales tax.

The DHSC launched a review of pricing practices by PCR test companies earlier this month. On Monday, the department said 82 providers – 18% of those displayed on the government’s website of approved providers – had been given a two-strike warning for displaying lower prices than are available at the point of checkout.

Rory Boland, the travel editor of consumer group Which?, said: “This intervention from the regulator is positive news, however this laundry list of problems has left travellers struggling for months to choose a trustworthy, reliable test provider and having to pay the financial penalty when things go wrong.

“The government must act swiftly to remove test providers misleading customers from its site, while the CMA must be prepared to take tough action against any firms flouting the rules.”