Clone Firms and Fake Broker Websites: How Scammers Copy a Real Licence, and How to Check

The short answer

A clone firm uses a real licence that belongs to someone else. So checking that a licence number exists is not enough. You must check that the website, email and phone number you are using are the ones the regulator lists for that licence.

Three-step test:

1. Find the firm on the regulator’s register by typing the regulator’s address yourself.
2. Compare contact details: website address, phone number, email domain. They must match exactly.
3. If anything is different, stop. Contact the real firm only through the details on the register.

If you have not checked a licence before, start with how to check a broker’s licence. This page goes deeper on the clone trick.

How the clone trick works

The UK regulator, the FCA, explains it like this. Clone firms are not authorised, but they try to convince you they are. According to the FCA, they often use the name and address of a genuine firm, or copy its firm reference number. They may also:

• copy the website of a real firm, with small changes such as a different phone number
• point you to the genuine firm’s website, but contact you using different details
• give you a genuine firm’s details with the wrong phone number
• use email addresses that look like the real firm’s, or free email providers

The FCA also says scammers may claim the register’s contact details are out of date. It calls this unlikely, because it updates its register and Firm Checker on average every 24 hours.

So when you search the register, you find a real, licensed company. Everything looks fine. The trap is that you are not talking to that company.

How clone sites get to you

Clones rarely wait for you to find them. Common routes:

• an advert or reel promising easy gold profits
• a “mentor” or “account manager” in a WhatsApp or Telegram group
• a phone call after you filled in an online form
• a search result that looks like the real firm’s site
• an email that says your account needs “verification”

The FCA notes that scammers may contact people after they search for investments and submit their details online.

The domain check, step by step

A domain is the main part of a web address, such as example.com. Clones use domains that look close to the real one.

Step 1: read the address bar slowly

Look for:

• an extra or missing letter: examplemarkets.com vs examp1emarkets.com (a number 1 instead of the letter l)
• an extra word: example-markets-global.com, example-markets-login.com
• a different ending: .com vs .co vs .net vs .org
• the real name used as a sub-part: examplemarkets.secure-login.com belongs to secure-login.com, not to examplemarkets.com

Read the part just before the first single /. The two words right before it (like secure-login.com) are the real owner.

Step 2: compare with the register

On the regulator’s register, find the website field for the firm. Some registers list every domain the firm uses. ASIC, for example, has said it publishes licensees’ website addresses on its Professional Registers Search and advises caution if a website is not listed there (ASIC).

If the register lists examplemarkets.co.uk and you are on examplemarkets-trade.com, assume it is a clone.

Step 3: check the domain’s age

A domain lookup tool, such as ICANN Lookup, shows the public registration data for a domain. That often includes the date it was created. A firm that says it has been regulated for years, but whose website was created a few weeks ago, needs a very good explanation.

This is a clue, not proof. Real firms also open new domains. But combined with any other mismatch, it is a strong warning.

Step 4: check the email domain

Real firms usually email from their own domain. Warning signs:

• a free email address (the FCA names providers such as Outlook and Gmail)
• an email domain that is different from the website on the register
• a reply-to address that changes to something else

Step 5: check the phone number

Call the number on the register, not the one in the email or on the website. Ask: “Do you have an account in my name? Is this person your employee? Is this your website?”

A worked example (fictional names)

You get a WhatsApp message from “Rahul from Example Gold Markets”. He sends a link to examplegoldmarkets-pro.com. The website shows “Licence no. 123456”.

Two real details and three mismatches. This is the classic clone pattern. Do not deposit. Call the number on the register and report it.

Other copies to watch for

• Fake apps. Download trading apps only from the official app store page linked from the firm’s register-listed website.
• Fake “verification” requests. An email asking you to “re-verify” your ID or log in through a link is a common trap. Read KYC explained for how real checks work.
• Fake regulator contact. Someone saying they are from the regulator and asking for fees or bank details is a scam. Regulators don’t charge you to release money.
• Fake “recovery” firms. After a loss, people offering to get your money back for an upfront fee are often the second scam. The FCA calls these recovery room scams.

If you think you found a clone

1. Stop. Don’t send money, documents or passwords.
2. Save evidence: screenshots, the web address, emails, chats, phone numbers.
3. Contact the real firm using only the register’s details.
4. Report the clone to the regulator. In the UK, the FCA says to report it by phone (0800 111 6768) or its contact form.
5. Check international alerts. IOSCO’s I-SCAN collects regulators’ warnings about unauthorised firms.
6. If you already paid, contact your bank or card issuer at once, and report it to the police or your national cybercrime service. In India, read lost money on an offshore app? What you can do.

Your 10-minute clone check

• ☐ I typed the regulator’s address myself and found the firm on its register
• ☐ The website I am using is listed on the register (exact spelling and ending)
• ☐ The emails come from the same domain, not free webmail
• ☐ The phone number matches the register
• ☐ I called the register’s number and they confirmed the person and the website
• ☐ The firm is not on the regulator’s warning list or I-SCAN
• ☐ Nobody asked me to pay into a personal account or crypto wallet

One “no” means stop. Then go back to the 15-point broker checklist.

Sources

• FCA: Clone firms and individuals (last updated 14 May 2025; read 5 November 2026) and FCA Warning List
• FCA: Recovery room scams
• ASIC: Use ASIC’s resources to help avoid scams
• IOSCO: I-SCAN
• ICANN: ICANN Lookup for domain registration data
• All firm names, numbers, domains and people in the example are fictional

Educational content only, not financial or legal advice. We never name, rank or recommend brokers.

Frequently asked questions