The website looks professional. The testimonials look real. There's even a company registration number sitting quietly in the footer. None of that tells you anything useful, because scammers in 2026 don't build sloppy websites anymore — they clone real, authorised firms down to the logo and the phone number, and run social media ads pointing straight to the fake. The only check that actually protects you takes about two minutes: the FCA Register.
What the FCA Register actually is
The Financial Conduct Authority (FCA) is the UK regulator responsible for financial firms and markets. Almost every business or individual offering financial services, investment products, or pension advice in the UK must be authorised or registered with the FCA. The Financial Services (FS) Register — at register.fca.org.uk — is the public record of every firm and individual the FCA currently approves, has previously approved, or has issued a warning about.
This matters for one very concrete reason: your legal protections depend entirely on whether the firm is on this register. If you deal with an unauthorised firm and something goes wrong, you have no right to complain to the Financial Ombudsman Service, and you're not covered by the Financial Services Compensation Scheme (FSCS) if the firm collapses or disappears with your money. There is no separate safety net — if the firm isn't authorised, that protection simply doesn't exist for you.
The clone firm problem — and why "it has a registration number" isn't proof
A clone firm is exactly what it sounds like: a scammer copying the name, firm reference number (FRN), and sometimes even the address of a real, FCA-authorised company, then using those legitimate credentials to build trust with victims who never check any further. The FCA actively publishes known clone firms on its Warning List — in a single seven-day period in May 2026, it issued 38 new warnings about unauthorised or clone firms, many built around "AI trading" or "algorithmic investment" branding designed to sound cutting-edge rather than suspicious.
This is exactly why checking that a firm's name merely exists somewhere on the register isn't enough — you have to cross-check the details.
How to actually check a firm — the steps that matter
- Search the firm by name or FRN at register.fca.org.uk, or use the FCA's Firm Checker tool directly.
- Confirm the status. You want to see "Authorised" for most financial services and investment firms. A status of "registered" rather than "authorised" means something different and more limited — see the crypto note below.
- Cross-check every contact detail. The register lists the firm's official phone number, website, and address. If the site you're being asked to send money to uses a different domain, phone number, or email than what's listed on the register, you are very likely looking at a clone site impersonating a real firm — regardless of how convincing it looks.
- If you were contacted out of the blue by someone claiming to represent a firm, don't call back on the number they gave you. Call the number listed on the register instead, and ask the real firm directly whether that person works for them.
- Check the Warning List separately at fca.org.uk/consumers/warning-list-unauthorised-firms if you can't find the firm on the main register at all, to see if it's already been flagged.
The crypto exception — read this before you assume "registered" means "safe"
Cryptoasset firms are a special case right now. As of 2026, the UK doesn't yet have a full authorisation regime for crypto businesses — that's expected to start on 25 October 2027. Until then, crypto firms only need to be registered with the FCA under the Money Laundering Regulations (MLRs), which is a narrower check focused on anti-money-laundering compliance, not the full consumer-protection bar that "authorised" firms meet. Even for a crypto firm that legitimately appears on the register, the FCA is explicit that its cryptoasset services are "unlikely to be protected" by the Financial Ombudsman Service or the FSCS if something goes wrong. Being on the register at all is still worth checking — an unregistered crypto platform is a firm hard stop — but "registered" and "authorised" are not the same level of protection, and no crypto platform today gives you the same safety net as a fully authorised investment firm.
What to do if you already sent money to an unauthorised or clone firm
Report it to the FCA directly through its website — this feeds into the same intelligence process that gets new firms added to the Warning List and helps protect the next person. If you paid by UK bank transfer, also contact your bank immediately: payments to fraudsters made on or after 7 October 2024 may be covered under the Payment Systems Regulator's mandatory reimbursement rules for authorised push payment scams, completely separately from whether the receiving firm was authorised by the FCA.