The Full List of Clone Firm Warning Signs | ICAR

A clone firm is a scam that uses a real, regulated company’s actual name, firm reference number, and branding to convince investors they’re dealing with a legitimate business and the UK’s FCA has reported over £78 million in losses tied to this specific tactic. This guide brings together every warning sign worth checking, organized by category, plus the single verification habit that catches nearly all of them. (This is a companion piece to our Hub article, Fake Trading Platforms & Forex/CFD Scams, and our Pillar guide, Investment Scams — The Complete Guide.)

Website and Domain Warning Signs

• A domain that’s a near-identical variation of a genuine firm’s real URL: an extra letter, a hyphen, a different top-level domain (.net instead of .com)
• A domain registered very recently, despite the firm claiming years of operating history
• A URL that gets truncated on mobile, making a subtly altered domain harder to spot, always expand the address bar and read the full domain before entering any credentials
• Website content, testimonials, or “as featured in” logos copied directly from the genuine firm’s real site

Contact Information Warning Signs

• A phone number, email domain, or postal address that doesn’t match what’s listed on the regulator’s own register, even if everything else looks identical
• An email address using a free provider (Gmail, Outlook) rather than the firm’s own domain, despite claiming to be a large regulated institution
• Contact details that work initially but become unreachable once you’ve invested, numbers that go straight to voicemail or ring out entirely

Sales Conversation Warning Signs

• Unsolicited contact: a cold call or message you didn’t initiate, even if it references a genuine, well-known firm’s name
• Pressure to act quickly, framed around a limited-time rate, bonus, or exclusive opportunity
• A caller who directs you to a specific “verification” link rather than encouraging you to search independently
• Reluctance or evasiveness when asked direct questions about regulatory status, fees, or what happens in a losing month

Documentation Warning Signs

• A firm reference number (FRN) that matches a real firm, but a service or product being offered that firm doesn’t actually provide
• Account statements or trading confirmations with formatting inconsistencies compared to the genuine firm’s known documentation style
• An offer to send scanned “proof” of authorisation rather than directing you to check independently on the regulator’s public register

Payment Warning Signs

• A request to pay into an account under a different name than the firm you believe you’re dealing with
• Pressure to use cryptocurrency or an unconventional payment method rather than a standard bank transfer or card payment
• Any request for an additional payment (a “tax,” “compliance fee,” or “unlock fee”) before a withdrawal can be processed

The One Habit That Catches Nearly All of These

The FCA’s own guidance is consistent and specific on this point: always use the contact details shown on its Financial Services Register and Firm Checker tool, never the ones a firm or caller gives you directly. Navigate to the regulator’s site by typing the address yourself, search the firm’s name, and compare every detail (phone number, email domain, physical address) against what’s officially listed. A single mismatch on any of these points is enough reason to stop and independently verify before proceeding, regardless of how convincing everything else appears.

This habit alone addresses the large majority of warning signs above, because nearly every category ultimately traces back to the same underlying gap: a detail that looks right on the surface but doesn’t match the regulator’s own record. Making independent verification (not verification through a link or number the firm supplies) a non-negotiable step before any deposit closes off most of this list at once.

A Real Case: What This Actually Looks Like

The FCA has publicly shared the account of a victim it identified as Janet, a finance officer from Chester who lost £40,000 to a clone investment firm. By her own account, she considered herself financially savvy and confident she could spot a scam, three-quarters of investors in the FCA’s own research say the same about themselves. After searching online for high-return bonds, she received a call the next day about a student accommodation investment. She found what appeared to be legitimate details about the company online, and everything seemed genuine, so she invested and invested again over the following months. It was only when she couldn’t reach the numbers she’d been given, which had gone dead, that she realized what had happened.

What makes this case worth including isn’t anything unusual about it, it’s how ordinary the process was. Nothing about the initial contact or the company details looked obviously fraudulent, which is exactly the point of a well-executed clone firm operation, and exactly why independent verification against the regulator’s own register matters more than trusting how convincing an approach feels in the moment.

The 2026 Evolution: AI Platforms and Phishing-as-a-Service

The FCA’s most recent Warning List updates continue to flag two accelerating trends worth knowing about specifically. First, clone operations increasingly pair a stolen identity with AI-generated “trading platforms”, realistic dashboards, profit displays, and fabricated trading histories generated to look indistinguishable from genuine account activity, sometimes even allowing a small initial withdrawal to build trust before larger deposits are requested. Second, security researchers have documented the rise of “Phishing-as-a-Service” toolkits — pre-built clone-website packages that let operators with minimal technical skill quickly stand up a convincing fake broker site, which helps explain why the volume of clone firm reports keeps climbing rather than leveling off.

What To Do If You Suspect a Clone Firm

1. Stop all further contact and do not send any additional funds.
2. Independently verify the firm through the regulator’s own Register or Firm Checker tool, navigated to directly rather than via any link provided to you.
3. If you already sent funds by card, contact your card issuer about a chargeback as soon as possible.
4. Report the suspected clone firm to the FCA (or your national regulator) directly, including every contact detail you were given.
5. If meaningful funds are involved, a professional case assessment can help trace where they went and support your dispute or report with documentation.

About ICAR:  International Cyber Asset Recovery (ICAR) is a UK-based forensic investigation and asset recovery firm operating across the UK, US, Canada, Australia, Singapore, and Hong Kong. ICAR works alongside official fraud reporting  providing blockchain tracing, OSINT investigation, and exchange cooperation services that complement law enforcement and bank fraud processes. Free initial case assessments, complete case form or contact support via WhatsApp  

Frequently Asked Questions

Is there any legal recourse if I lose money to a clone firm?

Clone firm victims typically don’t have access to the compensation schemes available to customers of genuinely authorised firms, since the clone was never actually regulated, which makes prevention, and a fast chargeback or reporting response, especially important.

Why is checking on mobile specifically riskier?

Mobile browsers often truncate long URLs in the address bar, making a subtly altered domain (an extra letter or hyphen) much easier to miss than it would be on a full desktop display. Make a habit of expanding the address bar to read the complete domain.

Why would a scammer use a real firm reference number instead of making one up?

Because a fabricated number would fail a basic register check instantly, while a genuine, borrowed number passes that same check, the fraud relies on you stopping at “is this number real” rather than confirming it’s connected to the entity you’re actually dealing with.

Are AI-generated fake trading platforms harder to spot than older scam websites?

Often yes — current AI-generated dashboards, profit displays, and trading histories can look highly convincing, which is exactly why independent regulatory verification matters more than visual impressions of legitimacy.

What should I do immediately if I think I’ve found a clone firm’s website?

Don’t interact further with the site, report it directly to the regulator whose identity was cloned, since that report helps the FCA (or equivalent) get it added to public warning resources faster, protecting the next potential victim.

Related Reading

→ Parent Hub: Fake Trading Platforms & Forex/CFD Scams

→ Pillar guide: Investment Scams — The Complete Guide