Risk warning: CFDs are complex instruments and come with a high risk of losing money rapidly due to leverage. You should consider whether you understand how CFDs work and whether you can afford to take the high risk of losing your money. 18+ only.

Clone broker check: how to tell a fake copy from the licensed firm

A clone broker copies a licensed firm's name, licence number and branding, then swaps in its own website, phone, email or bank account. So the check isn't "does this licence exist?" but "do the domain, contact details and payee match the register entry exactly?" Any mismatch: stop and contact the regulator.

This guide builds on our step-by-step licence check, which covers finding a firm on each regulator's register. Here we cover the next step: proving you're dealing with the firm on the register, not a copy. General information, not advice. Sources last checked 2 Nov 2026.

What gets copied, and what can't be

The UK's FCA uses the term clone firm for someone pretending to be from a firm it authorises. It says clones often use the genuine firm's name and address or copy its firm reference number, and may:

What a clone can't change is the register. Everything it needs to receive your money (a website, a phone line, a bank account) is the part that differs.

Why a real licence number isn't enough

Licence numbers are public by design, so they're the first thing a clone copies. A quick lookup of a copied number returns a genuine, active firm, which is exactly what the clone wants you to see. The useful question is narrower: is the site in front of you, and the account you're paying, listed under that licence?

The 5-step clone check

1. Find the legal entity in the client agreement

Take the full company name, regulator and licence number from the client agreement or terms, not from an advert, chat message or banner. If no agreement names a legal entity, you can't run the check, and that's an answer in itself.

2. Open the register yourself

Type the regulator's address into your browser; never use a register link the broker sends. Even regulators get copied: on 23 Oct 2026 CySEC published a warning about a fake website impersonating CySEC, and the FCA tells visitors to check its own register address for small changes. For the EU, ESMA explains how to use its register and links each country's own.

3. Match the domain, character by character

Many registers list the firm's websites. Cyprus goes further: CySEC's List of Approved Domains pairs each licensed investment firm with the domains it may use, and a separate List of Non Approved Domains names sites that CySEC says are not owned or operated by any CySEC-authorised firm (last updated 2 Oct 2026).

Comparing the two lists shows how small the difference can be. The approved list gives A. Eternity Capital Management Ltd the domain a-eternitycapital.ltd.cy. The non-approved list includes a-eternitycapital.ltd, dated 08/01/2025: the same name with the country ending removed. If the domain you're using isn't the one on the register, treat it as a different business.

4. Match phone, email and address

Compare every contact detail you've been given with the register entry. Then call or email using the details from the register, not the ones from the website or the person who contacted you, and ask the firm to confirm the website and account are theirs. The FCA notes its register is updated on average every 24 hours, so "the register is out of date" is a warning sign, not an explanation.

5. Check who receives your deposit

The payee name on the bank transfer or card payment should be the licensed entity, or a payment provider the agreement names. A private individual, an unrelated company or an account in a country the firm has no link to is a mismatch. ASIC's Moneysmart tells investors to also check for suspicious bank account details.

Search impersonation warnings

Regulators publish clone warnings, but no list is complete, so treat a hit as a stop sign and a miss as nothing.

Red flags clones tend to share

Already paid a possible clone?

Stop sending money, including any "tax", "release" or "verification" fee before a withdrawal. Contact your bank or card provider straight away, then report the website and payment details to the regulator whose firm was copied and to your local police. Expect follow-up offers to get your money back: the FCA warns that recovery rooms target people who have already lost money, ask for upfront fees and are sometimes run by the same people as the original operation.

Before you trade at all

Passing a clone check only tells you who you're dealing with. CFDs carry a high risk of losing money rapidly due to leverage; read our risk warning and work out what a position could cost first with the pip value calculator and position size calculator. See our methodology.

We're an affiliate of one broker; that never changes the register facts we publish. See how we make money.

FAQ

What is a clone firm?

An unauthorised operator pretending to be a genuine authorised firm, usually by copying its name, address and licence or reference number while using its own website, phone, email or bank details.

The licence number is real. Can the broker still be fake?

Yes. Clones copy real numbers because anyone can look them up. What matters is whether the website, contact details and payee match the register entry for that licence.

How do I know if a broker website is fake?

Compare its domain exactly with the one on the regulator's register, watch for extra letters, hyphens or a different ending, check lists of non-approved domains such as CySEC's, and search the domain on IOSCO I-SCAN.

Is there a list of fake brokers?

Regulators publish warning lists: IOSCO I-SCAN, CySEC's warnings and non-approved domains, ASIC's investor alert list and the AMF blacklist (searchable on our alerts page). None is complete, so a name missing from them proves nothing.