Check more than url for clone scams. We’ve been trained to look for the “lock” icon and double-check the URL before entering sensitive information. While this remains vital, a more sophisticated threat has emerged that bypasses these basic checks: Cloned Firm Scams.

Fraudsters don’t just copy a website; they hijack the entire identity of a legitimate, regulated financial institution to steal your money.

What is a Cloned Firm Scam?

A cloned firm scam occurs when fraudsters pose as a genuine, authorized company—often an investment firm, bank, or insurance provider. They use the firm’s real name, registration numbers (like a CRD or FRN), and even the names of real employees to convince victims they are dealing with a licensed entity.

How the Scam Evolves Beyond the URL

While many people think they can spot a fake by looking for typos in the domain name (e.g., “https://www.google.com/search?q=wellsfargo-secure.com” instead of “wellsfargo.com”), scammers are becoming much more resourceful.

• The “Authorized” Mirror: Scammers often create a professional-looking site and claim it is a specific “branch” or “new digital division” of a known firm that hasn’t updated its main site yet.

• The Redirect Bait: You might click a link in an email that looks perfect, but a hidden redirect sends you to a clone.

• The “Offline” Conversion: This is the most dangerous tactic. Scammers use a convincing website just to build initial trust, then move the conversation to encrypted apps like WhatsApp or Telegram, where they send “contracts” and “account details” that look 100% official.

Why the URL is a False Sense of Security

If you are only checking the address bar, you are missing three critical ways scammers hide in plain sight:

1. Look-alike Characters (Punycode): Scammers use characters from different alphabets that look identical to Latin letters. For example, a Cyrillic “а” looks exactly like an English “a,” but it leads to a completely different server.

2. The “Hidden” Registration: Fraudsters frequently register a business name that is nearly identical to a regulated firm (e.g., “XYZ Investments LTD” vs. “XYZ Investment Holdings LTD”). The website URL will match their fake legal name perfectly, making it look legitimate on paper.

3. The Subdomain Trick: Scammers might use a URL like “https://www.google.com/search?q=legitfirm.com.investment-portal.net.” Your eyes see “https://www.google.com/search?q=legitfirm.com” at the start and stop reading, but the actual domain is “investment-portal.net.”

4 Red Flags That Go Beyond the Website

Since you can’t rely on the URL alone, look for these behavioral red flags:

Awareness is your strongest defense.   

Contact us if you’d like more information on how cyber intelligence can help you locate scammers. 

Please share this guide with friends and colleagues.