Most broker scams that reach us would have failed a twenty-minute check before any money moved. The pattern repeats across cases: the victim verified the brand — a familiar name, a professional site, a real licence number — but never verified the entity actually asking for the deposit. Those are different things, and the gap between them is where almost every clone and boiler-room operation lives.
This guide is the procedure we use ourselves, condensed to what a reader can execute in about twenty minutes with nothing but a browser. It will not catch every fraud — a firm can be genuinely licensed and still treat clients badly — but it reliably filters the most common scam classes: clone firms, typosquat sites, and unlicensed offshore desks with invented credentials. Register URLs and list names below were checked and current as verified in July 2026.
The 20-minute check, step by step
Run the steps in order. Stop and walk away at the first hard failure — there is no deposit worth completing the checklist for.
- Find the exact legal entity name and licence number the broker claims, usually in the site footer or the terms and conditions. About two minutes.
- Look that number up on the regulator’s own register, typing the register address yourself rather than following any link the broker gave you. About five minutes.
- Compare the website domain and phone number shown on the register entry with the domain and number actually soliciting you. About three minutes. This single comparison defeats most clone firms.
- Search the firm name and the domain on the regulator warning lists. About five minutes.
- Score the approach against the red flags ranked later in this article. About five minutes.
A pass does not guarantee safety; it means the firm has cleared the checks that most frauds cannot. A single hard failure — a licence number that does not resolve, a domain mismatch, a warning-list hit — is sufficient reason not to deposit, whatever explanation you are offered.
Why the brand name proves nothing
The counterintuitive core of broker fraud is that the credentials shown to you are often real — they just belong to someone else. The UK Financial Conduct Authority calls these clone firms: operations that copy the name, registered address and firm reference number of a genuinely authorised company, then solicit deposits through their own website and phone numbers. When a victim checks the licence number, it resolves to a legitimate firm, and the check appears to pass.
That is why verifying a broker is not a lookup — it is a comparison. The question is never “does this licence number exist” but “does the entity on the register match the entity in front of me”. The table below shows what a clone can and cannot copy.
| Detail | Can a clone copy it? | Implication |
|---|---|---|
| Company name and logo | Yes, trivially | Never treat the brand as evidence |
| Licence or reference number | Yes — they quote the real firm’s number | The number resolving proves only that a real firm exists somewhere |
| Registered address | Yes, copied from public filings | An address on a website verifies nothing |
| Staff names and profiles | Yes, scraped from LinkedIn | A named “senior analyst” is not evidence |
| The domain listed on the register entry | No — the regulator publishes it, not the firm’s website | This is the comparison that catches clones |
| The phone number listed on the register entry | No | Call the register’s number to confirm any relationship |
The two rows a clone cannot fake are the ones published by the regulator itself. Everything the fraudster controls — their site, their emails, their documents — can display whatever they choose. Everything the regulator controls cannot.
Verify the licence on the regulator’s own register
Every serious regulator maintains a free public register. These four cover the jurisdictions most retail brokers claim, and all four were live and searchable as verified in July 2026.
| Regulator | Register | What to search | What the entry shows |
|---|---|---|---|
| FCA (United Kingdom) | Financial Services Register | Firm name or firm reference number (FRN) | Authorisation status, permitted activities, listed website and phone, and any clone warnings attached to the firm |
| CySEC (Cyprus) | Regulated entities search | Firm name or licence number under Investment Firms | Licence status and history; CySEC also publishes a list of approved domains for each investment firm |
| ASIC (Australia) | Professional registers search | Company name or AFS licence number | Whether the AFS licence exists, its status and the licensed entity’s exact name |
| NFA (United States) | BASIC | Firm name or NFA ID | CFTC registration, NFA membership status, and regulatory and disciplinary history |
Three rules make the lookup meaningful. First, reach the register by typing its address or searching for the regulator by name — never through a link supplied by the person or site soliciting you, because clone operations sometimes link to counterfeit register pages. Second, search by licence number rather than by name where possible; scam names are chosen to sit one character away from real ones. Third, read the entry itself: an FCA record states what activities the firm is actually permitted to perform, and “authorised” for insurance mediation does not permit holding your trading deposits.
The domain comparison that catches clones
Register entries list the firm’s official website and contact details. Compare them character by character with whoever is soliciting you. If the register says the firm operates example-broker.com and you were contacted from example-broker.io, examplebroker-ltd.com or a subdomain of anything else, treat the approach as a clone regardless of how well every other detail matches. CySEC’s approved-domains list exists precisely because this mismatch is the fraud’s weak point. When in doubt, call the phone number shown on the register entry — not the number you were given — and ask whether the person contacting you works there. Genuine firms answer that question routinely, because clones of their brand damage them too.
Search the warning lists
Registers tell you who is licensed. Warning lists tell you who regulators have already caught soliciting without authorisation, and they are the fastest way to confirm a suspicion.
- The FCA Warning List names unauthorised firms and clone operations targeting UK consumers, searchable by firm name or website. Clone warnings usually name the counterfeit domain, which is why searching the domain, not just the name, matters.
- IOSCO’s I-SCAN portal (the International Securities and Commodities Alerts Network) aggregates alerts submitted by securities regulators worldwide into one searchable database. It is the best single place to check a firm that claims a licence in a country whose register you cannot read.
- Provincial and state regulators often flag boiler rooms earliest. The British Columbia Securities Commission’s Investment Caution List names unregistered firms soliciting local residents, and comparable lists exist across Canadian provinces and US states. A small regulator’s alert about “a firm targeting our residents” frequently describes an operation targeting everyone.
Interpret the results asymmetrically. A hit on any warning list is close to conclusive — regulators publish these entries deliberately and specifically. A clean search, by contrast, is weak evidence of safety: alerts are submitted voluntarily, lists lag behind new operations by weeks or months, and scam sites rotate domains faster than regulators can catalogue them. Absence from a warning list should never override a failed register check.
Red flags, ranked by strength of signal
Not all warning signs carry equal weight. The table ranks the classic ones by how reliably they indicate fraud, based on the patterns that recur across regulator alerts and the cases we have reviewed.
| Signal | Strength | Why it matters |
|---|---|---|
| A fee, tax or “release charge” invented at withdrawal time | Near-certain | Legitimate brokers disclose withdrawal costs before you fund. A charge that appears only when you try to leave is the extraction phase of the scam itself — paying it produces another fee, not your money |
| An “account manager” offers to trade for you or requests remote access to your device | Near-certain | Discretionary trading requires separate authorisation almost no retail broker holds, and no legitimate firm asks for AnyDesk or TeamViewer access |
| Guaranteed, fixed or “risk-free” returns | Near-certain | Market returns cannot be guaranteed by anyone. A firm promising them is describing a product that does not exist |
| Pressure to fund via cryptocurrency, gift cards or transfers to a personal account | Strong | These rails are chosen because they are irreversible and hard to trace. Regulated brokers accept cards and bank transfers to corporate accounts in their own name |
| Unsolicited contact — cold call, WhatsApp, Telegram, or a “wrong number” or dating-app conversation that turns to investing | Strong | Regulated firms rarely cold-contact strangers; romance-to-investment pipelines are a documented fraud category |
| Deposit bonuses tied to countdown timers or “today only” pricing | Moderate | Urgency exists to prevent exactly the checks in this article. Some licensed offshore brokers also use bonuses, so it is corroborating rather than conclusive |
| A domain registered within the past year for a firm claiming decades of history | Moderate | A WHOIS lookup takes one minute; a 2010-founded brand on a domain created recently deserves an explanation, though rebrands do legitimately happen |
One near-certain flag is enough to stop, alone and unexplained. The moderate flags compound: any two of them together justify treating the firm as unverified until the register checks say otherwise.
What a clone operation looks like in practice
A composite drawn from real regulator warnings shows how the pieces fit together. A trader searches for a well-known broker and clicks an ad, or is messaged directly on WhatsApp. The site looks right: same logo, same colour scheme, pages copied wholesale from the genuine firm. The footer quotes the real firm’s licence number and registered address. The domain, however, is not the real one — it is a typosquat, perhaps the brand name with a hyphen inserted, a different top-level domain, or “official” or “global” appended.
An “account manager” makes contact quickly and stays warm and attentive. The first deposit requested is small, often a few hundred dollars. The dashboard then shows steady profits — numbers typed into a database, connected to no market. Many operations approve one small early withdrawal, because nothing builds false confidence like getting money out once. Then comes the pressure to scale up: a “VIP tier”, a leveraged “signal”, a limited window. When the victim finally requests a large withdrawal, the invented obstacles begin — a tax on profits, a liquidity fee, an anti-money-laundering deposit — each payable in advance, each followed by another. The operation ends when the victim stops paying, and the same data is then sold on to recovery-scam operators.
Every stage of that script fails the twenty-minute check. The domain does not match the register entry. The unsolicited contact, the manager trading on the victim’s behalf, and the withdrawal-time fees are the three strongest flags in the table above. The scam works not because it is sophisticated but because the checks were never run.
If you have already deposited
Speed matters more than anything else in this section. Stop all contact with the firm first — every additional conversation is an attempt to extract a further payment, and no fee you pay will release your funds.
- Card payments: contact your card issuer and request a chargeback for services not rendered. Visa and Mastercard dispute windows typically run around 120 days from the transaction or from when you reasonably discovered the problem, so a deposit made months ago may still be recoverable — but the window closes, and waiting helps only the scammer.
- Bank transfers: ask your bank to attempt a recall immediately. Recalls succeed most often within the first hours and days, before funds are layered onward; they depend on the receiving bank’s cooperation and are far from guaranteed.
- Cryptocurrency: transfers are effectively irreversible. Report anyway, with transaction hashes and wallet addresses — exchanges do freeze destination accounts when law enforcement moves quickly, though recovery rates are low and no outcome should be assumed.
- Report it: file with the financial regulator in your country (the FCA has an online reporting form in the UK), your national fraud service (Action Fraud in the UK, the FBI’s IC3 in the US, your provincial securities commission in Canada), and the platform where contact began. Reports rarely recover individual funds, but they drive the warning-list entries that protect the next person.
Expect a second wave. Victims are contacted — sometimes within days — by “recovery agents”, “chargeback specialists” or fake law firms claiming they can retrieve the lost funds for an upfront fee or a percentage paid in advance. This is a follow-on scam, frequently run by the same operators or by buyers of the victim list, and it works because desperation lowers the same defences the first scam did. No legitimate recovery process charges advance fees, claims a government affiliation it cannot prove, or contacts you unsolicited. The only parties who can actually reverse a payment are your card issuer, your bank and law enforcement.
Frequently asked questions
Is a valid licence number enough proof that a broker is legitimate?
No. Clone firms deliberately quote the genuine licence numbers of authorised companies, so the number resolving on a register proves only that a real firm exists — not that you are talking to it. The proof is in the comparison: the domain and phone number on the register entry must match the ones soliciting you.
The broker is registered offshore. Does that count as regulation?
Usually not in any sense that protects you. In several offshore jurisdictions, forex brokers hold only a basic company registration with no conduct supervision, no capital requirements and no compensation scheme. For deposit-protection purposes, treat a firm whose only credential is an offshore registration as unregulated, and size any deposit accordingly.
The firm is not on any warning list. Does that mean it is safe?
No — it means only that no regulator has catalogued it yet. Warning lists are reactive and incomplete by nature; new scam domains appear faster than alerts are published. A clean warning-list search carries little weight next to a failed register check, while a single warning-list hit is close to conclusive.
Can I rely on review sites and user ratings instead?
Not on their own. Scam operations seed positive reviews at scale, and genuine complaints are diluted or disputed. User ratings are most useful for one specific pattern — clusters of withdrawal complaints against an otherwise polished firm. Licence verification against the primary registers, not sentiment, is the anchor; it is also the first thing we examine in how we rate brokers.
My account shows profits but I cannot withdraw. What is happening?
In the typical fraud, those profits never existed — the dashboard is an interface to a database, not to a market. The fee, tax or margin call standing between you and a withdrawal is the mechanism of the scam, and paying it produces another obstacle rather than a payout. Stop paying, preserve screenshots and records, and move to the reporting steps above.
Who should I contact first if I sent money yesterday?
Your bank or card issuer, immediately — recall and chargeback odds decay by the day, and for wire transfers by the hour. File reports with your regulator and national fraud service the same day, and do not engage with anyone who contacts you afterwards offering to recover the funds for a fee.
Reader reviews
Traded with this broker? Tell others what actually happened.