Clone firm

A clone firm is a fake operation wearing a real company's identity. It uses a genuinely authorised firm's name, its registration number, often its address and the names of its actual staff — with one website, one phone number and one set of bank details changed.

It is built to survive the check you were told to make.

Why it works on careful people#

The advice everyone gives is "look the firm up on the regulator's register." A clone firm is the specific attack designed to defeat that advice. You look up the name, you find a properly authorised company with years of clean history, and you proceed — because the registration is real.

It just belongs to somebody else.

Reconstruction · not a screenshot.

This is not hypothetical. A clone-firm warning the FCA published on 19 March 2026 lists, side by side, the two look-alike websites the fraudsters were using, the phone number they were calling from — and the name, address and firm reference number of the genuine insurance firm whose identity they had taken. The cloned firm had done nothing wrong and had no idea.

What gets copied#

The FCA describes it in its own words: fraudsters "use the name and address of a genuine firm, or they may copy the firm reference number (FRN)" and "copy the website of an authorised firm, making small changes (for example, to the phone number)."

In practice that means:

• The name — exactly, or one character out: a hyphen, an extra word, a .net where the real one is a .com.
• The reference number. This is the load-bearing piece, because it is what makes your check come back clean.
• The website, often copied wholesale with only the contact details altered.
• Staff names, lifted from LinkedIn, so the "adviser" you spoke to searches out as a real professional.
• Documents — terms, statements, compliance certificates, on convincing letterhead.

What is never copied is where the money goes.

The step that actually defeats it#

Checking that a number is registered is not the same as checking that the person who gave you that number is the registrant. The move that works is the reverse one:

Find the firm on the regulator's register. Then use only the phone number and website the register itself holds, and ask the firm whether the approach was theirs.

Never verify contact details using contact details from the same source. Never call a number to confirm a number that arrived in the same email. That single habit is the whole defence, and it takes about ninety seconds.

The FCA's own instruction is the same shape: search the firm by name on its Firm Checker, confirm it has permission for the product being sold, and "check the firm's contact details listed on the Firm Checker and make sure they match the contact details you've been given."

Small things that give it away#

• A domain close to the real one but not identical.
• An email from a free provider, or from a domain registered weeks ago.
• Bank details in a different country, in a different name, or changing between messages.
• A phone number that does not match the register's.
• Pressure to move before you have had time to verify — always, without exception, a reason to stop.
• Small wrongness in the paperwork: a company number that does not match the footer, an old logo, a regulator's address that no longer exists.

The same trick, pointed at a newspaper#

Cloning is not only aimed at financial firms. In the campaign we documented around Quantum AI, the operators rebuilt the look of the BBC, CNN and DW News to host a fake exclusive that carried the advert. Same principle: borrow an institution nobody would think to check, and spend its credibility. See Quantum AI: the endorsements are all deepfakes.

If you have already sent money#

Speed matters more than anything else here. Contact your bank immediately and use the words "I have been the victim of a clone firm scam" — a transfer can sometimes still be recalled. Report it to your national fraud body and to the regulator. The real firm being impersonated will want to know too; it usually has a route for exactly this.

Then tell us what happened. We will go through it with you at no charge, and we will never ask you to pay to get your money back — anyone who does is running the second scam that follows this one.

Sources

• FCA, Clone firms and individuals — https://www.fca.org.uk/consumers/clone-firms-individuals
• FCA, published clone-firm warning notice, Limitless Cover (Clone of FCA registered firm), first published 19 March 2026 — https://www.fca.org.uk/news/warnings/limitless-cover-clone-fca-registered-firm
• FCA, Warning List of unauthorised firms — https://www.fca.org.uk/consumers/warning-list-unauthorised-firms
• The Proofmark, Quantum AI: the endorsements are all deepfakes, 28 September 2026.