Read five URL examples, then compare entity, permissions, representative and payment links. Use an evidence worksheet instead of trusting a copied licence or HTTPS alone.
Clone-site checking is an identity problem: does the person, domain and account you are dealing with belong to the authorised entity they claim to represent? A site can copy a name, logo and registration number without establishing any of those connections. Equally, a difference needs investigation rather than an immediate accusation against an unrelated company.
This worksheet is for comparing identifiers before providing money or sensitive documents. It is not a malware scanner or a legal verdict. Do not open suspicious links just to investigate them. Copy the address as text without visiting it, and obtain the official contact route independently.
The table uses reserved example domains, not broker websites. For the exercise only, assume the independently confirmed official host is portal.example.com. A matching host is still just one check: it does not establish the legal entity, permissions or integrity of the page.
| Address shown as plain text | Actual host | Comparison with the assumed official host |
|---|---|---|
| https://portal.example.com/account | portal.example.com | Host matches; account and permissions still need checking |
| https://portal.example.com.example.net/account | portal.example.com.example.net | Different host; the familiar name is only a subdomain beneath example.net |
| https://example.net/portal.example.com | example.net | The familiar name is in the path, not the host |
| https://portal.example.com@example.net/login | example.net | Text before @ is not the destination host in this URL |
| https://portal-example.example/login | portal-example.example | Different spelling and domain; hyphens do not establish affiliation |
Do not assume that the last two pieces always identify the registrable domain: public suffixes can have multiple parts. For a consumer check, compare the complete host with the independently confirmed address instead of guessing ownership from a suffix. Similar-looking characters, added words and shortened links require additional care. The IANA example-domain page explains the documentation role of example.com and example.net; the addresses here are not recommendations to visit.
Start with the original onboarding agreement. Write the full contracting name and any licence reference. Next, find the relevant regulator's own record and compare status, activity and contact details. Then ask through that independent contact whether the domain and representative belong to the entity. Finally, establish how the named payment beneficiary is authorised to receive funds for the account.
These are separate links. A company can be registered yet lack permission for the advertised product. A genuine group company may not be the party on your contract. A payment processor may have a different name, but that difference needs a documented relationship. “Same group” and “our new website” are claims to verify, not the verification itself.
| Identifier | What the proposed account says | Independent evidence to collect |
|---|---|---|
| Legal entity | Exact name and agreement version | Official record plus confirmation of the contracting party |
| Permission | Number, status, product and client category | Current regulator entry and any restrictions |
| Website | Complete host, including subdomains | Confirmed official domain or written clarification through official contact |
| Representative | Name, email domain and phone | Confirmation obtained without using the disputed message's contact details |
| Payment | Beneficiary, country, currency and reference | Contractual collection arrangement confirmed by the actual entity |
| Warning | Exact name, host and publication date | Original regulator notice, not a reposted summary |
Add your own columns for date checked, source URL, filename and status: matched, unresolved or conflicting. Missing register fields remain unresolved, not automatically false. Do not substitute a screenshot supplied by the salesperson for a live official entry. Save evidence of the actual destination after any authorised, independently verified redirect; the original link label may not show it.
Suppose a fictional representative says the register is outdated and asks you to use a new portal. Do not let that statement close the investigation. Reach the genuine entity through a separately verified route and ask whether the precise new host and representative are authorised. Include the contract's entity name and proposed beneficiary, without sending passwords or identity scans.
If the official response confirms only the domain, the payment relationship may still be unresolved. If it denies the representative, retain the denial alongside the original message. If there is no response, record the unknown; do not turn silence into approval. The FCA's clone-firm guidance addresses impersonation and independent identity checking in its UK context.
HTTPS protects the connection but does not prove authorisation. A long-lived domain may have changed hands. Public ownership records may be redacted or identify a service provider. An app-store listing, MT4/MT5 server name or copied company certificate does not establish that your account is with the licensed entity. A social-media verification mark concerns that platform's process, not every financial permission.
Avoid installing a file or granting remote access to complete this check. A request for a one-time bank code, seed phrase or password is not needed to confirm a public company identity. Do not upload private documents into an unfamiliar “verification” page merely because the sender displays a regulator logo.
Keep the complete message, URL text, dates with time zones, proposed contract and payment instruction. Export originals where possible; keep annotated or redacted copies separately. For a regulator notice, quote its exact identifier in your private record and distinguish “not authorised” from a finding about fraud or a similarly named genuine company.
Pause unverified new payments while checking material conflicts. If money has already moved, contact your payment provider promptly through its official channel and ask which dispute or recall mechanisms apply. Do not pay an unknown recovery service for a promised guaranteed refund. See the scam triage guide and complaint evidence template.
The licence number matches. Is that enough? No. Match the entity, host, representative and payment chain separately.
The register does not list a website. Is it a clone? Not established. Seek clarification from the official entity or regulator rather than inventing a match or accusation.
The address differs by one letter. Should I sign in to check? Do not use an unverified destination to test credentials. Verify the address independently first.
Can a broker score settle the matter? No. A score about a genuine firm cannot authenticate someone impersonating it. Use the official-register process for the legal identity, then compare the particular contact and destination.