Clone firm scam: when a fraudster copies a real firm

• It survives the check that people are told to make: the firm is on the register.
• The product offered is often dull and plausible: a bond, a savings account, a fixed rate a little above the banks’.
• The paperwork is copied from genuine documents and the callers are patient, well spoken and unhurried.
• The real firm’s good name does the persuading.

• Contact details that differ, even slightly, from those on the firm’s register entry: another telephone number, a web address with an extra word or a different ending.
• A request to pay an account in another name, in another country, or belonging to a person.
• The firm contacted you, or reached you through an advertisement or a form, and you are using only the details it gave you.
• A warning on the regulator’s own site that the firm’s name has been cloned.
• Reluctance when you say you will ring back on the number shown on the register.

One sign alone proves nothing, and a fraud may show none of them at first. The Check this offer list puts fourteen such questions side by side.

• Tell the genuine firm, using the contact details on the register. It will want to know that its name is being used, and it can confirm that it never dealt with you.

1. 01Stop paying. Send nothing more, whatever the reason given: a tax, a fee, a deposit to “unlock” the account, a charge to recover what was lost. A further payment is the usual next step of the fraud.
2. 02Stop the conversation. There is no need to explain, argue or warn. Do not delete it, either: it is a record.
3. 03Keep records. Messages, names and numbers used, the addresses of websites, payment receipts, account and wallet details, screenshots of anything that might disappear. Note the dates.
4. 04Tell your bank or payment provider at once. Use a number you find yourself, on a card or a statement, not one from a message. Say it is fraud. Time matters, and they will say what they can and cannot do.
5. 05Report it to the authority in your country. That is usually the police or a national fraud-reporting service, and the financial regulator. A report helps others even where it does not help you.
6. 06Secure what was shared. Change passwords that were given out or reused, remove any remote-access software that was installed, and tell the provider of any account or card whose details were passed on.
7. 07Expect a second approach. People who have lost money are contacted again, by “recovery agents”, “lawyers” and “officials” who ask for a fee first. See the page on recovery-room fraud.
8. 08Tell someone you trust. These frauds are built by people who do it for a living, and they work on careful, intelligent people. Silence helps only the fraudster.

Nobody can promise that money lost to fraud will come back. Sometimes some of it does; often it does not. Anyone who guarantees a recovery, or asks to be paid first, is describing another fraud.

Regulators publish free warning lists and registers of authorised firms; this site lists several under Nice & Need: stay safe. To check an address that claims to be this site, use Verify a GIO4X link.

How can I tell a clone firm from the real one?

By where the contact details come from. The register entry for a firm lists the firm’s own telephone number, address and website. A clone can copy the name and the number of the registration; it cannot change what the register says. Details that reached you any other way are the ones in doubt.

The firm is on the regulator’s register. Is that not enough?

It shows that a firm of that name is authorised. It does not show that the person who contacted you works for it. The clone depends on that gap.

Can a firm’s website be copied as well?

Yes. A page can be copied in minutes, and an address can differ from the real one by a single character. This site keeps its own list of official addresses, and a checker that compares any address with it, on the page “Verify a GIO4X link”.