Key takeaways

  • Fake brokers are either invented (no licence anywhere) or clones copying a real firm's name and licence number.
  • Check the entity on the regulator's register and search its warning list for lookalike domains.
  • A WHOIS lookup showing a domain only months old is a serious warning sign.
  • Passing the licence check rules out fakes; an offshore licence still means far weaker protection.

There are two kinds of fake broker. The invented one has no real licence anywhere and hopes you will not check. The clone is more dangerous: it copies a legitimate broker’s name, licence number and address onto a lookalike domain, so a quick check appears to pass. Both leave tracks, and ten minutes of looking will catch almost all of them. Cross-check any name against our scam broker list and the regulators guide.

Check 1: the entity and licence

Find the exact company name and licence number in the site footer or client agreement. Then look it up on the regulator’s own website, such as the FCA register, ASIC Connect or the CySEC list. Confirm the entity exists, the licence covers dealing in forex or investments, and it is current. If there is no entity name at all, stop there.

A real licence is not the same as a good broker. A light-touch offshore registration (Seychelles, Vanuatu, Saint Vincent and similar) still passes this check, since the entity is genuinely registered there, but it comes with far weaker client-fund protection and conduct rules than an FCA, ASIC or CySEC licence. Passing Check 1 rules out an invented or clone operator; it does not by itself mean the broker is safe to use.

For a suspected copycat, compare carefully. These operations often use a domain that is almost right (an extra word, a different top-level domain), and a regulator’s warning page will frequently already name the impostor with the exact lookalike domain. Search the regulator’s warnings for the broker’s name.

Check 2: the domain age

A WHOIS lookup shows when the domain was registered. A broker aggressively advertising to you on a domain that is three months old is a serious warning sign. Real brokers have histories; scam sites are spun up, run until complaints accumulate, then abandoned and rebranded.

Check 3: how you download the platform

Legitimate brokers use MetaTrader 4, MetaTrader 5, cTrader or a platform built and supported by the broker itself, available through the official app stores. Warning signs: an app you can only get as an APK file from a link, a “custom” MetaTrader server that does not appear in the official server list, or a web platform that looks like a template with the numbers hard to reconcile against real market prices.

Check 4: how you pay

If the deposit page asks you to pay a personal bank account, a named individual, or a personal crypto wallet, rather than a company or a named payment processor, it is a scam. This single check catches a large share of them.

Check 5: the withdrawal terms

Read the withdrawal section of the client agreement before you deposit, not after. Legitimate brokers have straightforward terms: a minimum withdrawal amount, a processing time, and the requirement to withdraw to your original deposit method. Fakes, and brokers with deliberately unfavourable terms, bury conditions here: a minimum trading volume before any withdrawal, a fee that scales with the amount, a clause letting them cancel profits deemed to come from “abusive” trading, or a bonus that locks your own deposit. If the terms make it conditional or expensive to get your money out, that is the whole business model showing through.

Check 6: the reviews, read properly

  • Ignore five-star reviews posted in bursts on the same few dates, because those are seeded.
  • Ignore one-star reviews that are just insults with no detail.
  • Read the detailed reviews that describe a specific withdrawal experience, with dates and amounts. Those are the useful ones, positive or negative.
  • Search the broker’s name with the words “withdrawal problem” and “scam” and see what comes back from forums, not review sites the broker can seed.
Illustrative example, Priyanka, 32, Bengaluru

Priyanka was sent a broker link in a WhatsApp group. The site showed an FCA number. She looked it up: the number belonged to an insurance intermediary, not a broker, and the FCA had a clone-firm warning listing the exact domain she was on. The platform was an APK download. She never deposited. Two months later the same site was live under a different name with the same layout.

What to do if you’ve already deposited with a fake or clone broker

  1. Stop depositing more immediately. A request for an additional "release fee," "tax," or "verification amount" before you can withdraw is itself confirmation you are dealing with an operator like this.
  2. Attempt a withdrawal and document everything: screenshots of the request, any response, and timestamps. Even a refused withdrawal is evidence.
  3. Contact your bank or card issuer about a chargeback if you funded by card, and act quickly, since chargeback windows are time-limited. Payments made by bank transfer or crypto are much harder to reverse.
  4. Report it to your local cybercrime unit, and to the regulator whose name or licence number was copied, if one was.
  5. Treat any "fund recovery" offer that follows as a second scam. No legitimate service recovers money for an upfront fee.

The five-minute routine

The five-minute routine. Invented fake: No real licence anywhere; hopes you will not check; Clone fake: Copies a real broker's licence onto a lookalike domain; Fastest single check: Does the deposit go to a person or a company?; Clone tell: A near-right domain, often already named in a regulator warning; Time to check: About five minutes
The five-minute routine: the figures from this section at a glance.
  1. Entity name and licence number, verified on the regulator’s site.
  2. Regulator warnings page searched for the broker and its domain.
  3. WHOIS lookup for the domain registration date.
  4. Platform available through official app stores, not an APK link.
  5. Deposit goes to a company or named processor, never a person.
Invented fake No real licence anywhere; hopes you will not check
Clone fake Copies a real broker’s licence onto a lookalike domain
Fastest single check Does the deposit go to a person or a company?
Clone tell A near-right domain, often already named in a regulator warning
Time to check About five minutes

If you cannot verify a broker on any regulator’s register under the exact entity name in its own terms, treat that as a serious warning rather than a technicality, and be aware some legitimate smaller or offshore entities are listed under a parent company's name or a slightly different legal name than the trading brand, so check variations before concluding there is no listing at all. If there genuinely is none, treat the broker as unregulated, and any money you send as money you may not get back.

Key financial regulators in Asia

MalaysiaSecurities Commission Malaysia (SC)
ThailandSEC Thailand / Bank of Thailand (BOT)
SingaporeMonetary Authority of Singapore (MAS)
PhilippinesSEC Philippines / Bangko Sentral ng Pilipinas (BSP)
IndonesiaBappebti
PakistanSECP / State Bank of Pakistan (SBP)
IndiaSEBI / RBI (FEMA)

Several of these bodies do not directly licence retail forex/CFD brokers for domestic use, which is why many traders in the region end up with an offshore-regulated broker (FCA, ASIC, CySEC) instead. That is a separate question from whether the broker is fake, use this table to confirm which authority is relevant to cross-check against, not as a list of brokers you must use.

Sources and where to check it yourself

Frequently asked

How do I know if a forex broker is fake?

Verify the entity name and licence number on the regulator’s own website, check the regulator’s warnings page, look up the domain registration date, confirm the platform is on official app stores, and make sure deposits go to a company rather than a person. An operation like that fails at least one of these.

What is a clone forex broker?

A fake that copies a legitimate broker’s name, licence number and address onto a lookalike website, usually on a slightly different domain, so a superficial check appears to pass. Regulators publish clone-firm warnings naming the fake domains.

Is an APK-only trading app a red flag?

Yes. Legitimate brokers distribute MetaTrader, cTrader or their proprietary app through the official app stores. An app you can only install from an APK link, or a MetaTrader server not on the official list, is a strong warning sign.

How can I check a broker’s domain age?

Use any WHOIS lookup tool and enter the domain. It shows the registration date. A brand-new domain combined with heavy advertising and pressure to deposit is a serious red flag.

Can a broker with a real licence still be unsafe?

A light-touch offshore licence (Seychelles, Vanuatu, Saint Vincent) imposes few requirements on client-fund handling and conduct. It is not illegitimate, but it offers weak protection, so check which entity you are signing up with.

The broker’s reviews are all five stars. Is that good?

Not necessarily. Bursts of five-star reviews on the same dates are usually seeded. Look for detailed accounts of specific withdrawal experiences, and search forums the broker cannot control.

What should I look for in a broker’s withdrawal terms?

Straightforward ones: a minimum amount, a processing time, and withdrawal to your original deposit method. Warning signs are a minimum trading volume before any withdrawal, fees that scale with the amount, or a bonus that locks your own deposit.

A broker asked me to pay a fee before my first withdrawal. Is that normal?

No. A legitimate broker deducts any fee from the payout. Being asked to send money in before a withdrawal is processed, whether it is called a tax, a verification amount or a release fee, is one of the clearest scam signals there is.