Malte ZanderContents
Fraudsters imitate banks and insurers because their name, license and imprint create trust when money is involved. The most common patterns are clone firms with copied company details, fake customer portals and fake support pages with false phone numbers. Regulator warnings protect consumers, but they don't remove sites. For that, regulated firms need their own takedowns through hosts, registrars, DNS providers and Google, plus monitoring that finds replacement domains early.
- The UK regulator FCA describes clone firms as fake firms that use the name, address and registration number of genuine authorized firms. Victims reported losses of more than £78 million in 2020 (FCA).
- Germany's financial regulator BaFin publishes warnings about unauthorized offers and identity fraud on the basis of Section 37 (4) of the German Banking Act (BaFin).
- In January 2025, BaFin warned about a website that was almost identical to a site it had warned about twelve days earlier, calling it yet another case of identity theft (BaFin).
- In a phishing campaign observed by Microsoft, payment fraud began just five minutes after the credentials were stolen (Microsoft).
Why are financial brands hit so often?
Because money is at stake, and trust in financial matters rests on a few markers: a well-known name, a license and company details with a registration number. Those markers can be copied. A website carrying a real bank's name, address and registration number looks more credible than any promise of high interest.
On top of that, bank and insurance customers are used to logging in online, uploading documents and filling in forms. A copy of the customer portal therefore stands out less than it would for companies whose customers rarely log in.
What patterns are there?
Five patterns cover most cases:
| Pattern | What it looks like | What the fraudsters want |
|---|---|---|
| Clone firm | A website with the name, company details and registration number of a real institution | Deposits into the fraudsters' accounts |
| Fake customer portal | A copy of online banking or the insurance portal | Credentials, approvals, sessions |
| Fake support | A page or ad with a false hotline or chat | Remote access, transfers, data |
| Offer and comparison pages | Fake savings or policy comparisons using real institutions' names | Deposits, contract details |
| Refund phishing | Emails such as "Your refund is waiting" linking to a fake portal | Account details and access |
Fake support is often underestimated because it works without a cloned website. Fake support pages shows how it operates, and Cloned login pages explains how to spot rebuilt portals.
What does a regulator warning mean for you?
It helps your customers, but it doesn't close the case. A warning from the FCA or BaFin makes it public that an offer does not come from you. The site still stays online until the host or registrar acts. And it often has successors: in the January 2025 case, an almost identical site appeared under a different ending twelve days after the first warning (BaFin).
For affected institutions, that means the regulator's warning and the takedown are two separate routes, and you need both. The resurfacing problem explains why copies come back.
How should regulated firms respond?
With a fixed process that combines takedown, regulator and customer protection:
Capture evidence: screenshots, the full link, the fake's company details, any account and phone numbers it lists, domain and hosting data. See Securing evidence of a fake website.
Frame it correctly: a fake portal is phishing, a clone firm with a copied website is brand forgery. See Takedown framing.
Report in parallel: host, registrar, DNS provider and Google Safe Browsing. How to take down a fake website shows the process.
Inform the regulator through the channels it provides, so it can warn the public.
Report beneficiary accounts. If the fake lists bank details, have your fraud team inform the institutions that hold those accounts.
Brief customer-facing teams: call centers, branches and intermediaries need a short text for inquiries.
Inform customers on a security page listing your official domains and phone numbers. How to warn customers about a fake website includes a template.
How can you prevent it?
With measures that make copies visible sooner and less effective:
A security page listing all official domains, apps and phone numbers, plus what you will never call or email about.
Consistent addresses, such as a fixed pattern for login and service pages, so deviations stand out.
Monitoring for lookalike domains that combine your name with add-ons like login, online, service, savings or claims.
Watching ads, especially for searches like your name plus hotline or customer service. See Brand impersonation in search ads.
A reporting route on contact and security pages where customers can report a suspicious link in one step.
Phishing-resistant sign-in where possible, so stolen credentials alone are not enough.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned portals, copied websites and phishing pages that use your name. On a schedule, the domain scanner checks variants of your domains, and through the report widget on your website customers report suspicious links directly. The AI compares every finding with your real page and names what was copied. The evidence package is compiled automatically, the reports to host, registrar, DNS provider and Google are prepared to fit the framing, and every message is reviewed and sent by a person. Closed cases keep being scanned, so a replacement domain does not go unnoticed.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedowns in the app.
FAQ
Do regulators take fake sites offline?
Regulators such as the FCA and BaFin warn the public and publish information about unauthorized business and identity fraud. Removing the site is up to the host, registrar or other providers. That is why a takedown alongside the warning pays off.
What is a clone firm?
A fake firm that poses as a genuine, authorized company, using its name, address and registration number, as the FCA defines it. Customers check the register, find the real company and feel reassured.
Should we inform the regulator when our name is misused?
Usually yes, because only then can it warn consumers. Clarify which duties and channels apply to your institution with compliance and legal. This is not legal advice.
Does a warning on our own website help?
Yes, if it is easy to find and stays specific: official domains, phone numbers and apps, plus clear statements about what you will never ask for. Customers who are unsure look exactly there.
Sources
FCA: warning about clone firm investment scams, 27 January 2021
BaFin: warning about kersten-anlageberatung.de, 29 January 2025
Microsoft Security: from cookie theft to BEC, AiTM phishing as an entry point to financial fraud, 12 July 2022