Clone firms: fraudsters posing as authorised companies

A clone firm is a copy of a genuine, authorised firm. Fraudsters pretend to work for a real company that holds a licence from the Financial Conduct Authority (FCA), borrowing its name, its address and even its FCA reference number, so that every check you think to run appears to pass¹. The FCA describes the tactic plainly: "A clone firm is a copy of a genuine, authorised firm"¹. The money you send does not go to the authorised firm at all. It goes to the criminal.

The scam works because checking that a firm exists is not the same as checking you are talking to that firm. A clone operation will hand you a reference number that really is on the register, a website that mirrors the real one, and documents that look identical to the genuine firm's. The single step that defeats it is comparing the contact details you were given with the ones the FCA holds, and then reaching the firm only through the register's details². Everything on this page flows from that one habit.

Clone firms are one form of the wider impersonation scam, where a criminal convinces you to make a payment or hand over personal or financial details while claiming to be a trusted organisation or someone you know³. Banks, HMRC and broadband providers are common targets of impersonation too⁴, and the same trick appears outside financial services, with fraudsters building fake websites that impersonate genuine solicitors and conveyancing firms during the house buying process⁵.

What a clone firm is and how the scam works

The FCA's definition is short: a clone firm is a copy of a genuine, authorised firm, and fraudsters pretend to work for an authorised firm in order to con you¹. The clone might use the real firm's exact name, or a near miss: an extra word, a different city, a plural where the real firm uses a singular. It will quote the real firm's FCA reference number, because that number is public and easy to copy. Some clones go further and build a website that mirrors the genuine firm's page almost line for line, with the same logos, the same regulatory disclosures and the same photographs.

The reason the scam succeeds is that most people's instinct, quite reasonably, is to check the firm exists. A victim who has been cold called about an investment searches the name, finds it on the register, sees the reference number matches, and concludes the caller is genuine. Every one of those steps was correct. What was missing was the final comparison: the phone number, email address and website the caller used, set against the phone number, email address and website the FCA holds for the real firm. The FCA's own guidance on pension scams makes this the rule: "Always use the contact details on the Register, not the details the firm gives you"¹⁰.

The consequences of paying a clone are severe and largely unrecoverable through the usual routes. Money given to a clone site or an unauthorised firm is not protected by the Financial Services Compensation Scheme (FSCS) or the Financial Ombudsman Service⁹. The FCA puts the same point in general terms: if you use a firm that is registered but not authorised, you are unlikely to have FSCS protection if the firm goes out of business, or access to the ombudsman if you want to complain¹. Some victims do recover money from their bank, and signatory firms of the old reimbursement code repaid 53% of the amount lost to impersonation fraud, where the criminal purported to be from the police or the victim's bank¹¹, but recovery is never guaranteed. The dedicated pages on authorised push payment reimbursement and what to do straight away cover that ground.

Clone firms copy real names, reference numbers and websites

Take Five, the national fraud awareness campaign, confirms the mechanics: criminals can clone genuine firms, create fake websites and use convincing documents¹². The documents deserve their own mention, because they are often what closes the sale. A clone will send out "factsheets", account statements, certificates of deposit or terms and conditions that borrow the real firm's branding, so the victim holds physical or on-screen evidence that looks official.

The copying extends beyond the firm's own materials. Scammers can clone telephone numbers of the organisations they want to impersonate, so the number that appears on your caller display can be the genuine firm's real number while the call comes from somewhere else entirely¹³. This defeats the common advice to check the number online: the number matches because it was stolen, not because the caller is real. The safe response to any unexpected call is to hang up and contact the organisation using details you find independently, a habit covered in how to check your bank is really contacting you.

Fake websites are not unique to finance. Fraudsters create fake websites impersonating legitimate solicitors or firms in property transactions, aiming to steal money or personal information during the house buying process⁵. The same pattern appears in copycat sites that charge for government services that should be free or much cheaper¹⁴. The common thread is that a website proves nothing on its own: it is the one artefact a fraudster has complete control over.

How fraudsters make first contact

Impersonation scams can begin through a phone call, text, email, or even on social media³. The first contact is designed to pass a quick plausibility test: a professional tone, a reason for calling that references something real (a market movement, a new government scheme, your own surname), and a route to "verification" that leads back to the fraudster's own materials.

Investment scams share a set of warning signs whatever the channel. Take Five lists them: being contacted unexpectedly, being promised high returns with little risk, being pressured to act quickly, being asked to keep the offer secret, or being told to transfer money before you have had time to check the firm independently¹². Which? adds the underlying rule: if a firm is carrying out regulated activities without authorisation, that is a major red flag and it is likely to be fraudulent¹⁵. MoneyHelper states the first sign most bluntly: legitimate firms will not contact you out of the blue about an investment opportunity¹⁶.

Cold calls offering to boost your wealth, whether by phone, email or text, are a warning sign in themselves¹⁵. The pattern is well established: investment and pension scams usually involve unsolicited phone calls asking you to hand over money for an investment or product that does not exist, or to move money out of a pension¹⁷. The FCA's register search page carries its own caution: "Careful: if you have been contacted unexpectedly about an opportunity, it's likely to be high risk or a scam"⁶.

Two follow-on risks are worth naming. First, criminals return to previous victims: computer software service fraud scammers contact people they have already defrauded, requesting payment for a fake malware protection service or a new subscription fee¹⁸. Second, victims of investment fraud are targeted again by recovery fraud, where criminals promise to retrieve lost money for a fee¹². The Pensions Regulator notes the same pairing, with cloned firms and recovery fraud both preying on people who have already lost money¹⁹. The page on recovery room scams covers the second approach in full.

Checking a firm on the Financial Services Register

The Financial Services Register is the official public record for all firms and individuals involved in regulated activities. It holds the FCA's full regulatory record, including historic fines, a firm's right to approve financial promotions and its ability to handle client money¹. You can search it by name or reference number, and narrow the results by adding a location such as a postcode or town⁶. Searches need two or more characters⁶. The register is at register.fca.org.uk, and one further piece of advice matters: access it directly by typing the address yourself, and do not click through from other sites⁹.

A numbered check looks like this:

1. Go to register.fca.org.uk yourself, never via a link in an email, text or advert⁹.
2. Search by the firm's name or reference number, narrowing by postcode or town if the name is common⁶.
3. Confirm the firm is authorised for the activity in question, and read any warning shown on its entry¹.
4. Compare the phone number, email and website you were given with the ones on the register entry².
5. Contact the firm using the register's details only, and ask whether it has been dealing with you¹⁰.

The register is a record of the firms and individuals the FCA authorises or registers, and it carries each firm's full regulatory record, including historic fines and whether it has the right to approve financial promotions or handle client money¹. It also covers individuals, with a caveat the FCA states itself: not all individuals at a firm need approval, so they may not be listed¹. The FSCS makes the same check the first step of its own guidance on investment protection: check your provider is authorised by the FCA²⁰. Its protection checker displays all firms linked to the same firm reference number, including trading names and subsidiaries, which helps identify which firm you are actually dealing with²¹.

A match on the register is not enough: the contact details decide it

This is the heart of the matter and the step most victims skip. The FCA's guidance repeats it across contexts: check the contact details match those listed on Firm Checker, to avoid scammers pretending to be a real firm². MoneyHelper gives the same instruction for loan fee fraud: search the FCA Firm Checker and use the contact details listed there, not the ones given to you¹⁶. The Financial Ombudsman Service directs people to the FCA's Firm Checker to confirm a firm is authorised and help avoid scams²². The reason every official body lands on the same sentence is that the register proves a firm exists, but only the contact details prove you are dealing with it.

The check that defeats a clone: reach the register yourself and contact the firm only through the details it holds.

The same principle applies outside finance. MoneyHelper's advice on advance fee fraud is to check the organisation contacting you by searching for it on Companies House and using the contact details listed there, not the ones provided in the message¹⁶. Companies House itself warns of scam calls where the caller claims there is a "discrepancy with the information held on the register" and asks for directors' full dates of birth²³. The register is the anchor; the message is not.

One more habit reduces the risk before any of this: check your privacy settings and limit what you share online, because criminals can use that information to make their approach seem more convincing³. A fraudster who knows your postcode, your employer and the provider you bank with is far harder to dismiss as a stranger.

The FCA Warning List: what it records and how often it changes

The FCA Warning List publishes details of unregulated entities which appear to the FCA to be carrying on a regulated activity without the requisite authorisation or permission²⁴. It can be used to check whether a firm or individual is known to the FCA to be operating without permission or running scams²⁵. It is updated daily¹⁴, and warnings about unauthorised firms also appear on the Firm Checker and the register itself when you search for the firm¹.

The scale of the problem shows in the FCA's own figures. Between January and October 2020 the FCA issued 1,053 alerts, 401 of which were about clone firms where fraudsters pretend to be authorised firms⁸. In 2020 as a whole it issued 1,204 specific warnings to do with scam firms on its website⁹, an 80% increase on 2019²⁵. The FCA's ScamSmart campaign sits alongside the list as the public-facing way to check an investment and whether its provider is genuine²⁰.

A listing has real force in one specific context: the FCA has said the presence of an investment or firm on the Warning List tends to provide reasonable grounds for believing that a pension transfer involving it may result in misappropriation of funds²⁴. In other words, a listed firm is not merely risky, it is evidence in itself.

Where the register and Warning List stop

Neither tool is a guarantee, and the FCA says so. It cannot guarantee the accuracy of the information on the register and does not accept liability for errors or missing information⁶. The Warning List has sharper limits. It does not cover unregulated entities that are not conducting any regulated activity, and the FCA cannot publish warnings on behalf of other agencies and regulators²⁴. A firm absent from the list may simply not have been reported yet.

The enforcement gap is the hardest part for victims to accept. The FCA has stated that it lacks powers to compel Google, social media companies and internet service providers to remove websites and accounts promoting the entities it warns about²⁴. A warning can be published the same day a clone appears; the website can stay up regardless. The practical consequence is that no consumer can outsource vigilance to the regulator: the check described earlier in this page is the protection, because nothing reliably removes the trap before you reach it.

Two further gaps deserve mention. FCA employees are not listed on the Financial Services Register or Firm Checker¹, so a caller claiming to be an FCA official cannot be verified by searching for their name. And fake registers exist outside the FCA's world entirely: Companies House warns of payment requests that arrive under invented names such as the "New Companies Register", the "Digital Companies Register", the "National Register of Companies" and the "Scottish Commercial Register"²³. The page on protections you lose by dealing with an unauthorised firm sets out the full consequences.

Reporting a clone firm and getting help

If you have paid money or shared details, act immediately. The Financial Ombudsman Service sets out the first steps: contact your bank or payment services provider immediately, contact the police on 101, report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer²². NS&I's advice is the same in substance: contact your bank immediately if you think you have fallen for a scam, and report it to Action Fraud¹⁷. The ICO also refers complaints about fraud and scams to Report Fraud¹⁸, and Age UK directs people to Report Fraud for reporting and further advice¹⁴.

To report the clone firm itself, or to check one while a caller is on the line, the FCA consumer helpline is 0800 111 6768⁷. You can also search the register online⁶. If you have not lost money but have been approached, reporting still matters: it feeds the Warning List that protects the next person.

Free, impartial help is available. MoneyHelper, the government-backed money guidance service, sets out the types of scam and how to check a firm¹⁶. The FCA's ScamSmart pages let you check the details of an investment and whether the provider is genuine²⁰. If a bank refuses a refund and you want to challenge it, the route is the Financial Ombudsman Service, covered in taking a refused scam refund to the ombudsman, and the wider steps are in where to report a scam and the scams and fraud guide.