Clone firm

An impersonation aimed precisely at the check a careful reader performs. The details copied are the ones a register lookup uses: the entity name, the licence number, sometimes an address and a set of officer names. What differs is everything the impersonator controls and the register does not, which means the contact details, the website domain, the bank account funds are asked for, and the platform credentials are issued on.

The check that defeats it is the one that runs in the opposite direction. A number read from the firm's own material and typed into the regulator's register will match, because the number is real. The details published on the register, contacted independently of anything the firm supplied, will not: the phone number, the domain and the payment instructions differ. A link to a register is content the firm controls and can point at a page that resembles one and belongs to nobody, so the register is reached through the authority's own site.

Regulators publish warning lists of firms known to be operating without authorisation or impersonating an authorised one, and those lists are read alongside the register rather than instead of it. Absence from a list is not clearance, because a list is compiled after harm has been reported and named, so the newest operations are the ones least likely to appear on it.