- Official regulatory registers and warning lists are the starting point for checking a broker or investment platform. Verify the legal entity, permissions and contact details together.
- A genuine licence number can be copied by a clone firm. Contact the authorised business through independently obtained details before transferring money.
- Domain history, website archives and security scanners provide supporting evidence. A clean result or an old domain does not establish that an investment is legitimate.
- Use separate checks for investment offers, cryptocurrency services, suspicious messages, online relationships and payment instructions.
- If money has already been sent, notify the bank or payment provider immediately, preserve evidence and assess the available reporting and recovery procedures.
Free fraud prevention tools help individuals and businesses investigate financial offers before committing funds. The most useful approach combines official licensing checks, independent verification of identity, website research and careful review of the proposed payment. No single database can certify that a transaction is safe.
This guide explains which resources to use, what their results mean and how to apply practical checklists to common fraud scenarios. Official registers are generally publicly accessible. Commercial security and research tools may limit free searches or charge for advanced reports.
How to Check a Broker or Investment Platform
Start with the exact legal entity named in the client agreement. A trading brand, company registration certificate or screenshot of a licence is insufficient. Identify the jurisdiction, licence number, service offered and country in which the firm proposes to serve you. Then open the relevant regulator’s website independently.
Check whether the entity is authorised for the particular activity and whether restrictions apply. Search warnings using the brand, legal name, domain and telephone number. An absence of warnings means only that no matching published warning was found; newly created scams may not yet be listed.
Eight Resources for Regulatory and Website Checks
Use the resources below together. Financial regulators verify regulatory status; domain and archive tools help test the history claimed by a website.
Resource | What to check | Official links | Limits and interpretation |
|---|---|---|---|
FCA United Kingdom | Authorisation, permissions and clone warnings | Match the legal entity and official contact details. A copied reference number does not identify the person contacting you. | |
ESMA European Union | EU and EEA investment firm records and relevant sector registers | Check the relevant register and national authority. A MiFID record is not a general authorisation for every crypto service. | |
CySEC Cyprus | Cyprus investment firms and approved website domains | Check current status, permitted services and the exact domain. Cyprus authorisation is not worldwide permission. | |
BaFin Germany | Company regulatory records and warnings | Use the company database and consumer warnings. Verify the basis for serving Germany, including relevant cross-border permissions. | |
ASIC Australia | Australian financial services licensing and investor alerts | Select the professional register. Company incorporation does not establish an AFS licence or authority to provide the proposed service. | |
MAS Singapore | Institution licensing, regulated activities and alerts | Verify identity through official channels. The alert list is not a complete list of impersonation scams. | |
Domain registration tools | Available creation dates, registrar and registration data | Personal data may be redacted. Full historical records may require payment; domain age alone proves neither fraud nor legitimacy. | |
Wayback Machine | Archived branding, company details and website claims | Only available captures can be viewed. Missing snapshots do not prove the site did not exist. |
The FCA also offers a Firm Checker. ESMA explains how to verify firms through its investor guidance. Use national registers to clarify permissions or discrepancies rather than relying on an aggregator alone.
Broker and Investment Platform Checklist
- Identify the contracting legal entity and independently verify its company registration.
- Check current regulatory status and permissions for the service and your location.
- Match the website, telephone number and email address with official records where available.
- Contact the genuine firm through independently sourced details to confirm the offer and representative.
- Search official warnings for the entity, trading name and exact domain.
- Read the contract, withdrawal conditions, costs and risk disclosures before paying.
- Clarify inconsistencies between the website history, claimed experience and legal entity.
- Pause if the offer relies on pressure, secrecy, unexplained payment recipients or guaranteed high returns.
A company can be properly incorporated without holding permission to offer regulated investments. Likewise, an authorised firm can offer a product outside its permissions. Company verification and licensing checks answer different questions.
Free Tools for Checking Cryptocurrency Platforms
Identify the platform’s legal entity and the applicable regulatory framework. For EU services, consult ESMA’s MiCA information and register resources and the competent national authority. Do not treat an ordinary company registration, overseas licence or AML registration as equivalent to every required crypto authorisation.
Public explorers such as Etherscan, Blockchain.com Explorer and BscScan help confirm transactions and examine address activity on their respective networks. They do not generally reveal the verified identity of a wallet owner or prove that an exchange is solvent. Select the correct network and preserve the transaction hash.
The US Treasury’s OFAC Sanctions List Search can supplement sanctions screening, including searches for published digital currency addresses. A missing match is not a clearance certificate and does not replace other applicable sanctions checks.
Cryptocurrency Safety Checklist
- Verify the provider, exact domain and relevant authorisation independently.
- Confirm the receiving address, network and asset before approving a transfer.
- Never disclose a seed phrase, private key or one-time authentication code.
- Read wallet approval requests carefully; do not connect a wallet simply because an unsolicited contact asks you to.
- Investigate requests for separate tax, insurance or verification deposits to release a displayed balance.
- Treat app store listings, reviews and proof of reserves as supporting information with limitations.
- Keep transaction hashes and records of the person or platform requesting the payment.
A new receiving address or high transaction volume may have an ordinary explanation. Conversely, an established address and a successful small withdrawal do not establish legitimacy. Sophisticated scams may permit early withdrawals to encourage larger deposits.
Tools for Detecting Phishing and Email Fraud
Use Google Safe Browsing to check reported website threats. VirusTotal provides security analysis of URLs and files, while urlscan.io can help examine redirects and page behaviour. These tools can miss new threats, and a clean result should never replace independent confirmation of the sender.
Protect confidential information when using public scanners. Do not submit client documents, identity records, bank statements, password reset links or URLs containing access tokens to a public service without checking its privacy settings and sharing policy. urlscan distinguishes public, unlisted and private scans; unlisted results are not fully private.
Have I Been Pwned can help identify known breaches involving an email address. The MXToolbox Email Header Analyzer can assist with reviewing routing and authentication results. Successful SPF or DKIM checks do not establish that a message is honest: a fraudster may use an authenticated lookalike domain or a compromised genuine account.
Phishing Checklist
- Inspect the complete sender address and destination domain, including subtle spelling changes.
- Open the organisation’s app or manually entered official website instead of a message link.
- Confirm unusual requests through a telephone number or channel obtained independently.
- Do not share passwords, seed phrases or authentication codes with a caller or message sender.
- Treat unexpected attachments and urgent payment instructions as requiring verification.
- If credentials were entered on a suspicious page, change them through the official service and secure active sessions.
Social Media and Romance Scam Checks
Google Lens and TinEye can help identify reused profile photographs. Search distinctive phrases from messages and examine whether the person’s claimed employment or business can be independently confirmed. No image match does not prove that an identity is genuine; private, edited or AI-generated images may produce no useful results.
An old social media profile can be purchased or compromised. Video calls, professional profiles and testimonials are also supporting evidence rather than conclusive identity checks. The decisive concern is often the request: an online relationship becomes a financial risk when the contact directs you to an unfamiliar investment platform, asks you to receive money for others or insists on secrecy.
Online Contact Checklist
- Verify claimed identity and professional connections independently.
- Investigate inconsistencies in profile photographs, employment and account history.
- Apply the full platform verification checklist to any recommended investment.
- Do not send money because of affection, urgency or screenshots of supposed profits.
- Discuss the proposal with a trusted person before making a financial commitment.
- Do not allow an online contact to use your account to receive or forward third-party funds.
Bank Transfer and Payment Safety
Before a payment, establish why the named beneficiary is entitled to receive the funds. A recipient name matching the account helps reduce misdirected payments but does not prove that the underlying offer is legitimate. Where your bank provides a beneficiary verification or Confirmation of Payee service, investigate mismatches before proceeding.
For business payments, verify changed bank details through a previously established contact channel. A convincing invoice and a message within an existing email conversation may still result from business email compromise. Use independent approval for unusual or high-value transfers.
The Take Five to Stop Fraud campaign provides practical guidance on challenging unexpected requests. For an unresolved cross-border financial services dispute in the EEA, the European Commission’s FIN-NET resources can help identify participating out-of-court bodies. FIN-NET is a dispute resolution network, not a tool for approving investments.
Payment Checklist
- Confirm the beneficiary, amount and purpose against the agreement or verified invoice.
- Independently confirm new or changed bank details.
- Investigate a name mismatch or unexplained third-party recipient.
- Stop if someone tells you to move funds to a safe account or conceal the purpose from your bank.
- Review available dispute rights before paying; protection depends on the method, transaction and jurisdiction.
- Keep the contract, invoice, payee details and payment confirmation.
A bank recall, card chargeback and statutory reimbursement are different mechanisms. Card disputes are normally raised with the issuing bank or payment provider, and time limits and eligibility vary. Avoid assuming that a card payment or an investment transaction is automatically refundable.
What to Do If You Have Already Sent Money
Contact the Bank or Payment Provider Immediately
Report the suspected fraud and request the appropriate action: stopping a pending transfer, attempting a recall, securing an account or investigating a disputed card payment. If cryptocurrency was involved, notify relevant exchanges with the transaction hashes and addresses. Recovery is not guaranteed, but prompt reporting may help prevent further movement of funds.
Preserve Evidence and Secure Accounts
Save contracts, messages, email headers, invoices, payment records, wallet addresses and dated website screenshots. Preserve originals and create a chronology. Block compromised cards, reset affected passwords through official channels and remove unauthorised access. Do not delay an urgent bank report while assembling a complete evidence file.
Report the Fraud and Assess Recovery Options
Report to the competent police authority and, where relevant, the financial regulator. A supervisory report may assist enforcement but does not itself secure compensation. Depending on the facts, recovery may involve payment disputes, a formal complaint, an ombudsman, asset tracing or civil proceedings in a jurisdiction connected to the defendant or assets.
Do not pay additional deposits requested by the suspected platform to release funds. Independently verify anyone offering recovery services. Guarantees of recovery, requests for seed phrases and claims that a private agent can simply reverse blockchain transactions are serious warning signs.
Frequently Asked Questions
Does an FCA or CySEC Licence Guarantee Safety?
No. Check the permissions, restrictions and exact entity. A scammer may copy a real licence number, and regulated investments can still involve substantial losses. Regulatory status should be verified alongside the offer and identity of the counterparty.
Is a Platform Safe If It Is Not on a Warning List?
No. Warning lists are not exhaustive and may not yet contain new platforms or domains. Search both authorisation records and warnings, and resolve unexplained inconsistencies before sending money.
Does a Newly Registered Domain Prove Fraud?
No. Legitimate businesses launch new websites. A recent registration becomes relevant when it contradicts a specific claim about that domain’s history. Established domains may also change owners or be compromised.
Are All These Tools Completely Free?
Official public registers and many basic checks are accessible without a paid subscription. Commercial tools may impose usage limits or charge for historical records, expanded reports or private analysis. Use free official resources first and check current terms.
Can Veritas Advisory Group s.r.o. Assist If Checks Raise Concerns?
Veritas Advisory Group s.r.o. provides due diligence services and legal and advisory support for fraud matters connected to European jurisdictions. Where funds have already been lost, an assessment can identify the relevant parties, available evidence and potential recovery routes. Outcomes depend on the facts, applicable law and identifiable assets.
Make Verification Part of Every Financial Decision
Effective fraud prevention is a repeatable process: identify the legal entity, check the relevant permissions, independently confirm the contact and review the payment recipient. Use website and security tools to support those checks, then stop when a material inconsistency remains unresolved.
If you are considering a suspicious investment or have already suffered a loss connected to Europe, contact Veritas Advisory Group s.r.o. to discuss the available verification or legal recovery options.
This material provides general information as of 2 October 2026 and does not constitute individual legal advice. Resource availability and regulatory records may change.
