A clone broker scam uses a real financial business’s identity to make a fraudulent trading service look legitimate. The name, address and licence number may all belong to an authorised company. The person contacting you, the trading platform and the payment instructions may have no connection to that company.
This creates a trap: finding a genuine licence can feel like the end of your checks, when it should be the beginning. You need to establish who controls the website, who employs the person contacting you and who will receive your money. If you have already paid a suspected clone, contact your bank immediately rather than waiting for the platform to explain.
The Australian binary options warning comes first
ASIC’s prohibition on issuing and distributing binary options to retail clients took effect on 3 May 2021 and runs until 1 October 2031. An Australian financial services licence does not override that prohibition. The dates and scope are set out in ASIC’s extension of the binary options ban.
If a platform claims that its copied Australian licence allows it to offer binary options to Australian retail clients, that claim conflicts with the restriction. Do not accept a certificate, account manager’s reassurance or Australian office address as an answer.
There are two separate questions here: whether the business is genuine, and whether it can offer the proposed product to you. Passing an identity check would not make a prohibited retail offer acceptable.
What a clone broker copies
A clone does not need to reproduce an entire business. It needs enough genuine details to make its false contact details look believable. It might copy a company’s website and replace the telephone number, or direct you to the genuine website while conducting the conversation through an unrelated email address. These methods appear in the FCA’s warning about clone firms and individuals.
The distinction matters. A search result confirming that a business exists does not connect your caller to it. Nor does a genuine document establish who sent it.
| What you see | What remains unverified |
|---|---|
| A genuine company name and licence number | Whether the platform belongs to that licence holder |
| A familiar logo and professional documents | Whether the business produced or authorised them |
| A real office address | Whether the caller works for the business at that address |
| An email signature naming a real employee | Whether that employee sent the message |
| A link to a genuine company website | Whether the separate login page or payment destination is genuine |
Treat the impersonated business and the suspected clone as separate parties until the connection is verified. When asking questions or reporting the incident, identify the suspicious domain and contact details rather than accusing the genuine company simply because its name was used.
How to check a suspected clone broker
Check the legal entity, not just the trading name
Write down the claimed legal entity, licence number, trading name and any authorised representative number. Open the official register through an independently located government page, not a link supplied in the sales conversation.
Compare the licence holder’s name and current status with the offer. Check the relevant authorisations and representative relationship where one is claimed. Company registration alone does not establish permission to provide financial services. Moneysmart’s checks for investment businesses and licence details distinguish company registration from financial services authorisation and warn about stolen licence details.
Keep the checks separate on paper. One column should contain details from the official record; another should contain details supplied by the platform. This makes discrepancies harder to overlook than when you switch between several browser tabs and rely on memory.
Break out of the sales conversation
Do not ask the suspected impersonator to verify itself. Another certificate or telephone call from the same operation adds no independent confirmation.
Instead, establish a contact route outside the offer. Use independently verified details for the genuine business, starting with official register information where available. Ask whether it controls the exact domain you have been using and whether the named employee, platform and proposed service belong to it.
Make your questions concrete: “Does your business operate this website?” is more useful than “Are you a legitimate company?” The genuine company can answer yes to the second question without knowing anything about the clone.
For the wider authorisation checks, use the guide to checking a broker’s licence. Here, the extra task is connecting the licence holder to the actual communication and payment channel.
Verify the payment instructions separately
Before paying, ask the independently contacted business to confirm the intended recipient and payment method. Do not treat an explanation about a “regional processing partner” or “segregated account” as verification by itself.
If the recipient changes, pause the transaction and repeat the check. Record the original and replacement instructions. Do not send a small payment to resolve an identity mismatch; sending less money does not answer who receives it.
Where the connection cannot be established, stop. You do not need to prove a criminal offence before deciding not to transfer money or identity documents.
A hypothetical binary options clone scam
Consider this illustrative scenario, not a reported case. A social media advertisement leads an Australian reader to a binary options platform. Its footer displays the name and licence number of a genuine financial services company.
An “account manager” helps the reader deposit A$500. The dashboard shows several winning trades, and a requested A$50 withdrawal arrives. The manager then encourages a further A$5,000 deposit, presenting the successful withdrawal as proof that the platform is trustworthy.
Later, a larger withdrawal is blocked. The explanation changes from an account review to a payment required before release.
The initial withdrawal does not establish that the platform belongs to the licensed company, that the displayed trades occurred or that the remaining balance is available. Fake performance data and small withdrawals used to build trust are documented in Scamwatch’s investment scam warning.
The missed check in this example happens before the first deposit: nobody independently asks the genuine company whether it operates the platform. Watching the dashboard more carefully would not fix that gap. Neither would checking the copied licence number a second time.
What should not settle your doubts
A convincing explanation for mismatched details
“That is our old number” and “this is our international division” are explanations to verify, not reasons to abandon verification. Ask the genuine business through an independent route. Do not let the caller choose both the evidence and the person supposedly confirming it.
A discrepancy does not need to look dramatic. A changed email domain or separate payment portal deserves attention even when the company name is an exact match.
Professional presentation and reassuring conversations
Keep your decision focused on identity rather than presentation. Clear English, detailed market commentary and a patient account manager do not answer whether the person represents the licence holder.
Use the same standard whether the caller is pushy or polite. Your question is not whether they sound trustworthy; it is whether their claimed connection can be confirmed outside the conversation.
Finding no warning about the domain
Do not make “I found no complaint” your approval test. A warning search can supplement identity checks, but it cannot establish the missing connection between a website and a licensed business.
Save the exact domain you checked, including its spelling. Searching only the genuine company’s name risks reviewing information about the business being impersonated rather than the service contacting you.
What to do if you have already paid
Stop payments and contact the payment provider
Do not send another deposit to demonstrate that your account is active, complete a verification process or obtain a withdrawal. Contact your bank or card provider through its official channel and explain that you suspect investment fraud involving an impersonated business. Ask whether transactions can be stopped and what recovery or dispute options are available.
If you sent cryptocurrency, notify the exchange or service used to send it. Keep the transaction details. Neither a report nor a request to stop a payment guarantees recovery. These immediate steps form part of Moneysmart’s guidance after a scam.
Tell the provider what actually happened: who contacted you, what you authorised, what you believed you were paying for and when you became suspicious. Do not change the account to make it sound more likely to qualify for reimbursement.
Preserve the evidence
Keep the material you already have without sending more information or installing software to obtain it. A useful evidence file includes:
- The full website and login addresses, plus screenshots showing the address bar.
- Emails, messages, telephone numbers and the names used by callers.
- Documents displaying the copied company or licence details.
- Payment receipts, recipient details and cryptocurrency transaction identifiers.
- A dated record of deposits, withdrawal requests and demands for further payments.
Separate money actually sent and received from the balance displayed on the platform. Record the displayed balance as a claim made by the platform, not as independently established funds.
Secure affected accounts and devices
If you allowed remote access or suspect your device was compromised, disconnect the affected device from the internet. Use an unaffected device to secure accounts, change exposed passwords and enable multifactor authentication. Check account activity and get help assessing the affected device before using it for banking. The Australian Cyber Security Centre provides steps for recovering from compromised devices and accounts.
If you supplied identity documents, tell the relevant financial institutions and seek identity protection support. For the reporting sequence and further support routes, follow the steps to take after a binary options scam.
Watch for a second impersonation
A later message claiming to come from a regulator does not resolve the original fraud. ASIC has warned about fake versions of its own services and impersonators demanding money to recover or release funds. ASIC does not collect payments to release investments or assets; its warning about ASIC impersonation scams covers these approaches.
Apply the same independent verification rule to any supposed investigator, lawyer or recovery service. Do not accept possession of your account details as proof of authority. Ask how the person obtained those details, but verify their identity elsewhere rather than relying on the answer.
Keep requests for further money separate from your legitimate reports to banks and authorities. The guide to trading fund recovery scams covers follow-up offers that promise to retrieve losses.
Common questions about clone broker scams
Can the licence number be genuine even if the broker is fake?
Yes. That is the central problem with cloning: genuine details can support a false claim of identity. Verify the relationship between the licence holder, website and person contacting you, not just whether the number exists.
Should I ask the account manager for more documents?
More documents from the same unverified contact do not provide independent confirmation. Preserve what you have, then ask the genuine business through an independently established contact route whether it issued them.
Should I confront the suspected clone?
You do not need a confession before protecting your money. Prioritise contacting your payment provider, securing accounts and preserving evidence. Avoid sending further documents or payments in an attempt to make the operator prove its identity.
The practical rule is simple: verify the connection, not just the copied details. A real licence belongs to a real business. It does not authenticate everyone who quotes it.
This article was last updated on: October 22, 2026