Clone Broker Scams: How Fraudsters Impersonate Regulated Firms

The most dangerous fake brokers do not invent a company. They copy a real, licensed one — name, licence number, company address, sometimes the entire website — and wait for you to verify it. Every check most traders know how to run comes back clean, which is the whole design.

How the clone is built

The fraudster registers a domain a character or two away from the genuine one, or the same brand on a different extension. The site is copied wholesale. The regulator's reference number is taken straight from the real firm's register entry, so a trader who searches that number finds a legitimate authorised business and relaxes.

Contact is usually not made through the site. It comes first — a call, a message, an advert, a group chat — and the link arrives afterwards, once you are already interested.

The detail that always differs

The clone cannot use the real firm's bank account, phone number or email domain. Those are the things it must change, and they are the things the register records.

So the check that defeats a clone is not the licence number. It is the contact details. Open the regulator's register entry for the firm and compare the website address, telephone number and email domain against whatever you have been given. A mismatch on any of them means you are not talking to the firm on the register, no matter how well the number matches. Our regulator database points to the official registers where those details are published.

Warning signs before you get that far

• You were contacted first. Regulated brokers in most major jurisdictions do not cold-call strangers about trading accounts.
• The domain is nearly right. An extra letter, a hyphen, a swapped extension, "-uk" or "-global" appended to a familiar name.
• Payment goes somewhere unrelated. A personal account, a crypto wallet, or a company with no stated link to the broker.
• Documents look fine but the email domain is free. A firm holding client money does not run its onboarding from a Gmail address.
• Pressure to move quickly. A closing window, a limited allocation, a price that will not last.

Why it survives verification

Traders are taught to check the licence number, so criminals give them a licence number that checks out. The lesson is not that verification is useless — it is that verifying a number alone was never enough. This is the same reason our red flags guide tells you to match the company details, not just the licence.

Regulators publish clone warnings naming specific impersonations as they are reported, and those lists are worth searching before you deposit. We collect the ones we find on our scam alerts page.

If you have already deposited

Stop sending money immediately, including any "release fee", "tax" or "final margin" you are told is required to withdraw. Contact your bank or card provider the same day and ask about a chargeback or recall — speed matters more than anything else here. Report the domain to the regulator whose licence was copied, and to the police in your country.

Then tell the real firm. It cannot recover your money, but it can get the clone warning published faster for everyone behind you.

Bottom line: check the phone number, email domain and website on the regulator's register — not the licence number, which the clone already has.