A genuine financial firm can be impersonated by an unrelated website using its name and licence details. Verifying the licence number is only one part of authenticating the service.
How the identity gap works
The FCA’s clone-firm guidance explains that impostors can use details of authorised organisations. The real firm’s existence does not establish a relationship with the website, app or person making the offer.
A clone can mix correct company information with a different domain, phone number or payment destination. A partially correct identity is therefore not enough.
Match contact details as well as names
Navigate independently to the genuine regulator’s service. Compare the legal entity, identifier, domain and available contact details with the offer in front of you.
If an apparent change in website or email is claimed, contact the genuine institution using a previously verified channel. Do not let the suspicious site authenticate itself through its own support chat.
A side-by-side evidence sheet
| Field | Official record | Offer being checked |
|---|---|---|
| Company name | Exact legal spelling | Exact claimed spelling |
| Identifier | Current reference | Number displayed |
| Domain | Genuine listed or confirmed route | Actual destination |
| Contact | Independently obtained details | Caller or message details |
A mismatch is a question requiring resolution, not something to dismiss because the logo looks correct.
Be careful with register links
A seller can send a link to a genuine record that belongs to somebody else. It can also send a copied page imitating a regulator. DFSA has published a warning about a cloned public-register page.
Check the address independently and retain the exact source. A screenshot of a search result is less useful than a verifiable genuine record with a date.
Payment identity provides another check
If a purported company asks for payment to an unrelated individual or an unexplained destination, preserve that instruction and seek clarification through genuine channels.
Do not make a small ‘test deposit’ simply to establish identity. A successful initial payment or small withdrawal would not prove the operator is the licensed company it claims to be.
Document and report a suspected clone
Keep domains, messages, payment requests and the genuine record being copied. Report the suspected impersonation to the relevant institution or authority using its own site.
Describe the mismatch precisely. The real firm should not be accused of operating the unrelated site without evidence. Identity verification protects against both financial loss and incorrect allegations.
A licence match and an identity match are separate findings
A register search may show that a named firm has a current record. The next question is whether the website or person contacting you is connected to that firm. A third question is whether the permission covers the particular service and customer arrangement. Keep all three findings separate in your research notes.
The FCA’s consumer guidance recommends checking the firm, relevant product or service permission and contact details through its genuine Firm Checker. That is a UK verification example. A reference to the FCA is not evidence that an offshore fixed-outcome platform is authorised, and an entry for a different service cannot be transferred automatically to binary options.
A fictional example: authentic number, unrelated offer
Imagine a website claims to be “Example Research Limited” and displays the reference number of a real financial firm. The number leads to an authentic regulator record. However, the account agreement names a different company, the email domain differs and payment instructions identify an unexplained recipient.
The authentic number resolves only the existence of the registered firm. It does not resolve the three mismatches. Save the exact agreement wording and destination details, then ask the genuine firm through independently obtained contact information whether the specific website and offer are its own. Until clarified, describe the relationship as unverified rather than assuming a shared logo proves ownership.
Use an independent confirmation question
A useful enquiry is specific: “Does your organisation operate this exact domain, employ this representative and offer this contract through the company named in these terms?” Asking only “Are you regulated?” can produce a true but irrelevant answer from a genuine company.
Do not let the disputed website supply both the claim and the sole verification channel. If it says the regulator’s contact record is outdated, resolve that through the regulator’s genuine contact route. The claim that official information is old is not evidence that the replacement number belongs to the firm.
What different identity clues can establish
| Clue | Potential value | Important limit |
|---|---|---|
| Exact legal name | Connects documents to a stated entity | Can be copied into an unrelated page |
| Licence identifier | Locates a regulator record | Does not authenticate the person displaying it |
| Company certificate | May identify an incorporated company | Does not establish financial-service permission |
| Contact confirmation | Can resolve a specific website or representative | Must come through a genuinely independent channel |
| Payment instruction | Shows where funds are requested | Needs an explained relationship to the contract party |
These clues should form a consistent chain. More documents do not automatically strengthen the chain if every document came from the same unverified salesperson.
Copied registers and misleading links
The DFSA’s 11 February 2025 warning concerned a cloned public register. It explained that genuine links embedded in a fake page did not authenticate the page itself, and advised navigating from the genuine DFSA website. This is a documented impersonation example, not a finding about an unnamed broker in this guide.
Record the actual hostname, not only the text printed on a button. In the reserved illustration register.example.attacker.invalid, the familiar word “register” does not establish a regulator’s ownership. Do not enter credentials into a disputed site to investigate further. Independently opening the genuine authority is a stronger check than exploring an uncertain verification link.
Frequently asked questions
Does absence from a warning list mean a site is genuine?
No. A negative warning search does not positively link an offer to the authorised firm. Document identity, contact and service permission separately.
Can a genuine business have more than one domain?
Yes, but establish the relationship through an independent reliable channel. Multiple-domain use is not by itself proof of fraud or authenticity.
Should I pay a small amount to test the claim?
A payment tests a transaction route, not the claimed licence relationship. Do not treat it as identity verification. See our payment research hub for separating payment records from permission evidence.
What if I already supplied documents or a password?
Secure exposed access through genuine services and use their official incident processes. Preserve the timeline and avoid sending further secrets to a person promising instant recovery. Our account-security research explains the evidence and access checks.
Sources and research scope
Public-source review: 25 October 2026. Examples are illustrative. Documentary research does not represent funded-account testing. Rules must be checked against the current product, entity and customer location.
Related research
Regulatory verification hub · Research methodology · Calculation tools
Risk: Fixed-outcome contracts can lose the entire stake. No chart pattern, calculator or demo result guarantees future returns.