Clone firms: when the licence is real and the website is not
A clone firm is a fake broker that borrows the identity of a real licensed one: the same company name, the same registration number, often a copied website on a slightly different address. The licence it quotes is genuine, which is why checking the licence alone passes. What fails is everything that moves money, because the deposit details and the contact channels belong to the clone, not to the licensed firm.
A clone firm is a fake broker wearing a real one’s paperwork. It uses the licensed firm’s company name, its registration number and often a pixel copy of its website, hosted at a slightly different address, so that a reader who looks the firm up finds a genuine record and concludes the site is genuine too.
That conclusion is the whole product. Nothing about the record is forged. The fraud sits in the gap between an authentic licence and an unauthentic website.
Why borrowing an identity beats inventing one
An invented broker has a short life. The name returns nothing in a public register, the reader stops, the fraud ends before a deposit. So the problem to solve, from the clone’s side, is not how to look impressive. It is how to survive a search.
Reusing a licensed identity solves it completely. The reader types the name, finds the firm, sees a live authorisation, and feels the reassurance of having verified something. The check was real. It simply answered a different question than the reader thought.
This is worth sitting with, because it explains the shape of every clone you will meet. A clone’s effort goes into being findable, not into being plausible. Verifiable name, verifiable number, verifiable register entry, all pointing at a company that exists and has no idea the site exists. The one thing the clone cannot do is make the licensed firm’s own bank account receive the money. So the identity is copied and the payment destination is substituted, and that substitution is the only place the fraud has to touch.
What the clone cannot copy
A register entry is published by the regulator, not by the firm, and it carries more than a status flag. It carries the firm’s own declared website, phone number, email and office address. A clone can put whatever it likes on its own site. It cannot edit the regulator’s record of the firm it is imitating.
That asymmetry is the entire defence. Four fields resist copying:
| Detail | Controlled by | Can a clone change it |
|---|---|---|
| Company name and registration number | the register | no, and it does not want to |
| Website address in the register | the register | no |
| Phone and email in the register | the register | no |
| Bank account receiving deposits | the licensed firm | no |
The first row is why the licence check passes. The other three are why the clone is detectable at all: each one is a field the reader can read from a source the clone does not control, and a single mismatch is conclusive.
What this costs the person who deposits
Not the trading. The deposit.
Suppose, with figures this article is inventing, that you open an account and fund it with $3,000. The platform shows a balance of $3,000. It shows prices, a spread, an open position, a running profit of $340. None of that needs a market behind it, because the numbers on the screen are written by the same people who took the transfer. The screen is a document, not a venue.
Now suppose a withdrawal requires a verification fee of 2% of the balance, a figure this example also makes up. On $3,340 that is $66.80, and a request for $66.80 against a $3,340 balance reads as trivially reasonable. That is the function of the number: it is set small relative to what the screen claims you hold. Pay it and the balance remains unwithdrawable, because there is nothing to withdraw. The real position is $3,066.80 gone, and the $340 never existed.
The protections people assume are standing behind this are attached to the licensed firm. Segregated client money is segregation of the licensed firm’s client money. A compensation scheme covers failure of the licensed firm. The money transferred to a clone never entered that firm’s systems, so neither mechanism is engaged. See what is segregated client money for how that ring-fencing actually attaches.
The mistake is checking in the wrong direction
Almost everyone who loses money to a clone did check. The error is a reversal of direction.
The common sequence is: read the website, take the registration number printed on it, look that number up, see it is valid, proceed. Every step passes. The sequence is still worthless, because it starts from the thing under the fraudster’s control and ends at the thing that is authentic. Information copied onto a clone site will always agree with the register, since it was copied from the register.
The sequence that works runs the other way:
- Start from the register, not from the site. Search the firm name there directly.
- Read the website address, phone number and email out of the register entry.
- Open the site using the register’s address, typed by hand, not a link from a message or an advert.
- Compare that site against the one that contacted you. A different domain, a different suffix, an extra word, a swapped letter: that difference is the fraud, and it is the only difference there needs to be.
- Confirm deposits go to a bank account in the licensed firm’s own name. A personal account, an unrelated processor, or a wallet address sent privately is inconsistent with a licensed firm’s published banking, whatever explanation accompanies it.
Three habits follow from this, and they are cheap.
Treat the domain as the identity. A brand name is not an identity, because names are free to type. The domain and the payment destination are the identity, and both are checkable before any money moves.
Treat inbound contact as unverified by default. A clone’s reach depends on arriving at you: an advert, a message, a call, a social post. Arriving at the firm yourself, from the register, removes the attack entirely.
Treat urgency as diagnostic. A closing allocation, an expiring bonus, a price about to move is pressure applied to the one step that defeats the fraud, which is the side by side comparison of the register’s details against the site in front of you. The pressure is not incidental to the scheme. It is aimed at exactly the check that would end it.
The pre-trade checklist puts the identity checks ahead of the account-opening step, which is the order that matters. For what an authorisation does and does not cover once the firm is genuinely the one you are dealing with, see what does a regulated broker actually mean.
The short version
A clone firm proves it is licensed and never proves it is the licensed firm. Those are different claims, and the first one is free. Verify the firm, then verify that the site in front of you is that firm, then verify the money is going to that firm. In that order.
Education only, not financial advice, and trading carries a risk of loss.
Key facts
- A clone reuses a real firm's name and registration number, so the registration record it points to is authentic and verifiable.
- The clone cannot take over the licensed firm's own published contact details or its bank account, so those are the fields that diverge.
- The deception lives in the domain name and the payment instructions, usually a near-miss spelling or a different suffix on an otherwise identical site.
- Compensation and client money protection attach to the licensed firm, not to anyone quoting its number, so a clone deposit sits outside both.
- The check has an order: find the firm in the register first, then read the contact details out of the register, then compare them against the site that contacted you.
- A request to pay a personal account, a payment processor in an unrelated name, or a wallet address sent by message is inconsistent with a licensed firm's own published banking.
Frequently asked
If the registration number checks out, what is left to verify?
The number proves a licensed firm exists. It does not prove the website you are reading belongs to that firm. The remaining work is matching identity: take the website address, phone number and email from the regulator's own record of the firm, then confirm the site contacting you uses those exact details. Direction matters, because details copied onto a clone site will always match themselves.
Why would a clone bother imitating a licensed firm instead of inventing one?
Because a verifiable record does more persuading than any sales pitch. An invented firm fails the first search. A cloned one survives it, and the search feels like the end of due diligence rather than the start. The licence is borrowed precisely because the reader will go and check it.
Can a withdrawal from a clone be reversed?
Usually the money has left the normal recovery window by the time the problem is visible. Clones favour payment rails that settle quickly and reverse poorly, and the account receiving the deposit is not the licensed firm's account, so the licensed firm has nothing to return. This is why the checking happens before the first deposit rather than after a refusal.
Does a secure connection or a professional looking site mean anything here?
No. A certificate attests to the connection, not to who owns the business behind it, and any site can obtain one. Design quality is equally uninformative when the design was copied wholesale from the firm being impersonated.
Risk warning: trading is high risk and most retail accounts lose money. Education only, not financial advice.