A genuine company name and an FCA reference number do not prove that an investment website belongs to an authorised firm. The missing question is whether the person, website and payment instructions in front of you actually belong to that business.
Clone firms exploit that gap. They borrow a real firm’s identity, then replace the contact details or payment route with their own. To identify them, check the business and the approach separately. Do this before sending money, uploading identity documents or opening an account through a link someone has supplied.
What is a clone firm?
A clone firm is an impersonation of a genuine, authorised financial business. Fraudsters may copy its name, address and firm reference number, usually shortened to FRN. They may reproduce its website or direct you to the real website while communicating through a different email address or telephone number. These methods are covered in the FCA’s guidance on clone firms and individuals.
The distinction matters: finding the genuine business does not authenticate the person claiming to represent it. The real firm should not be confused with the impersonator.
Not every fake investment website copies an existing company. Some present an invented business instead. The practical test remains the same: establish who operates the service, whether its regulatory claims check out, and whether you can reach it through an independently verified route.
Do not judge the approach solely by how ambitious the promised return sounds. Even a modest offer needs an identity check. A sensible-looking interest rate cannot tell you who controls the receiving bank account.
Verify the business, then verify the contact
Start with an independent FCA check
Open the FCA’s services independently rather than following a link in an advertisement, message or brochure. Search for the business and compare its legal name, reference number and contact details. Check its permission for the service being offered, not just whether a matching name appears.
For the record fields, status descriptions and permissions checks, use our guide to checking a financial firm on the FCA Register. Keep the regulatory record open separately from the investment website so you can compare them without relying on memory.
Do not substitute a Companies House match for these checks. A company record does not establish who sent an email or who operates a website using that company’s name. Likewise, a screenshot of an FCA entry is something the sender supplied, not an independent verification.
Make a fresh contact through the verified route
Contact the genuine business using the details you obtained independently. Do not reply to the original email or ask the salesperson to transfer you to someone who can confirm their identity.
Ask the firm to verify the employee, the full website address, the offer and the proposed payment arrangements. A useful question is: “I have received this offer from someone using your company’s name. Can you confirm whether this person and this application process belong to you?”
Read out the complete email address rather than just the sender’s displayed name. Explain how you first encountered the offer and whether you have already supplied documents or money.
If the person contacting you says the official details are outdated, do not accept that explanation as a substitute for verification. Where contact information is missing or disputed, ask the FCA for help before proceeding.
Your stopping rule should be straightforward: no verified connection between the offer and the genuine business, no payment. You do not need to prove a criminal offence before deciding not to invest.
Inspect the website address, not just the design
Compare the full domain name with the address obtained through your independent check. Look for substituted letters, added words, unexpected endings and addresses that contain a familiar brand without matching its verified domain.
Words such as “secure”, “client” or “UK” are not evidence of ownership. Nor does a familiar company name somewhere in a long address establish that the company operates it. If you cannot confidently identify the destination, stop rather than experimenting with the link.
A polished design is weak evidence. Branding, live chat and professional content can appear on fraudulent websites. HTTPS and a browser’s connection security indicator mean that the connection is encrypted; they do not establish that the business is legitimate. The government’s guidance on identifying fake websites makes this distinction clear.
Apply the same comparison to email addresses. Expand the sender details and inspect the full address, not just a familiar name above the message. Treat unexplained differences between the sender, reply address and verified company domain as reasons to pause.
For an application portal on another domain, ask the independently contacted firm to confirm the exact address. Do not assume that a different domain proves fraud, but do not let the salesperson’s explanation settle the question either.
You should not need to upload a passport or make a deposit to establish who operates the service.
Use domain registration details as supporting evidence
The ICANN domain registration lookup tool provides publicly available registration information. Where dates are available, compare the domain’s creation date with claims about how long that website has operated. Some ownership details may not be publicly disclosed.
A recently registered address paired with a claim of decades of continuous operation deserves further investigation. It is a discrepancy to resolve, not a verdict by itself. A business may have launched a new website or changed its name.
Conversely, do not treat an old registration date as proof of present ownership or legitimacy. Domain research should help you frame questions for the genuine business. It should not replace the independent contact check, and an absence of public ownership information should not automatically be treated as evidence of fraud.
Check warnings without treating silence as approval
Search the FCA Warning List of unauthorised firms for the name being used. Read any matching notice carefully and compare the contact information, not just the headline. A clone warning concerns an impersonator and may distinguish its details from those of the genuine business.
The absence of a warning does not clear a firm. The FCA states that an unlisted business may still be unauthorised or a scam, including where it has changed its name or has not yet come to the regulator’s attention.
Keep the checks separate. A warning search asks whether a problem has already been identified. A regulatory check asks about the genuine firm’s status and permissions. An independent callback asks whether your offer actually came from that firm.
Passing one check does not answer the other two. In particular, “there are no warnings about us” is not a substitute for confirming the website and contact details.
Separate supporting documents from proof of identity
A useful way to assess convincing material is to ask what it actually proves. Avoid counting several documents from the same sender as several independent checks.
| Material presented | What still needs checking |
|---|---|
| A genuine firm reference number | Whether the sender represents the firm attached to that number. |
| A brochure bearing a familiar logo | Whether the genuine firm issued that brochure and offers that investment. |
| A Companies House record | Whether the website and contact belong to the company shown. |
| Positive reviews of the business | Whether those reviews concern the exact service and website you are considering. |
| A named employee with a professional profile | Whether that employee sent the message and is handling your application. |
For reviews, distinguish between the reputation of the real company and the identity of your contact. Reviews of a genuine firm cannot authenticate an email sent by someone else. A link to an employee’s profile leaves the same gap.
Pay attention to attempts to interrupt your checks. A deadline should not decide whether you verify a recipient. Requests to avoid the main switchboard, keep the offer secret or ignore discrepancies deserve a pause. Our guide to investment scam warning signs covers the broader sales tactics; here, the immediate question is whether the claimed identity survives independent checking.
Verify the payment destination separately
Before transferring money, ask the independently contacted business to confirm the beneficiary name and payment instructions. Treat any late change of account details as a reason to repeat that check, even if earlier correspondence appeared consistent.
If the recipient is a different company, ask why and verify the relationship through the genuine firm. Do not accept an unexplained personal account or unrelated business account because the salesperson calls it a processing arrangement.
Confirmation of Payee checks the recipient’s account name against the details entered when setting up a payment. It can return a match, close match or no match. Its scope is the account-name check, so a matching result should not be treated as approval of the investment itself.
Do not override a mismatch at someone else’s instruction. Ask your bank about the result, and resolve the discrepancy through the firm’s verified contact route before sending anything.
Nor should you send a small amount simply to test whether an unidentified business is genuine. That exposes money without answering the identity question. Receiving an acknowledgement, seeing a balance on a screen or getting a payment back does not establish who operates the service.
The payment check belongs at the end of verification, not in place of it.
A worked example: the correct number, the wrong sender
Consider this hypothetical case. An investor receives a bond brochure bearing the name and reference number of an authorised investment firm. The firm exists, its address matches the brochure, and its public website looks professional.
The salesperson says applications use a separate “private client” portal. Their email address contains the firm’s name followed by another word. They also say the main office cannot answer questions about this allocation.
At this point, the investor has verified that a business exists. They have not verified that the offer belongs to it.
The next step is to contact the genuine firm using independently obtained details and ask it to confirm the portal, employee and bond offer. If it denies the connection, the matching reference number becomes evidence of copied identity rather than reassurance.
If the firm cannot confirm the details immediately, the investor should leave the application on hold. There is no need to choose between accusing someone of fraud and sending money. Waiting for verification is a valid decision.
What to do when the details do not match
Stop the application and do not send further money or identity documents. Preserve the messages, full website address, brochure, payment instructions and any transaction references you already have. Do not revisit a suspicious site just to collect more evidence.
If you have paid or suspect access to your bank account, contact your bank or payment provider immediately through a verified route. Report Fraud’s reporting guidance directs victims in England, Wales and Northern Ireland to its service, and those in Scotland to Police Scotland on 101. Suspicious websites can also be reported to the National Cyber Security Centre.
Notify the genuine business that its identity may have been copied, and report the suspected clone to the FCA. Describe the mismatch precisely: the domain, email address, telephone number, person or beneficiary that could not be verified. Avoid describing the genuine company itself as fraudulent solely because someone impersonated it.
For the next steps after a payment or disclosure, use our guide to responding to an investment scam.
The governing principle is simple: verify the connection, not just the company name. Until the genuine firm confirms that the offer and payment route belong to it, leave your money where it is.