Free Fraud Prevention Tools & Checklists

Why Fraud Prevention Requires More Than Awareness

Knowing that investment fraud exists is not the same as being equipped to detect it. The most effective fraud prevention is systematic: running the same set of verifiable checks on every platform, broker, or investment opportunity before committing any funds. The tools and checklists in this article are all free, require no specialist knowledge, and take minutes to use. Together, they cover the five highest-risk fraud scenarios facing investors today.  

Section 1: Broker and Investment Platform Verification

Free Tools

FCA Financial Services Register – register.fca.org.uk The UK’s definitive public register of authorised financial firms. Search by firm name, registration number, or website address. The FCA also maintains a Warning List of unauthorised firms and clone operations, searchable at fca.org.uk/consumers/warning-list. Use both simultaneously. ESMA Registers – registers.esma.europa.eu The European Securities and Markets Authority’s centralised register covers MiFID II-authorised investment firms across all EU member states. Essential for verifying any broker claiming EU regulation. CySEC Register – cysec.gov.cy Cyprus is the most common EU passporting jurisdiction for retail forex and CFD brokers. Verify licence status, permitted activities, and authorised website addresses directly. BaFin Database – bafin.de Germany’s Federal Financial Supervisory Authority publishes its full register of authorised firms and a separate list of unauthorised entities operating illegally in the German market. ASIC Register – search.asic.gov.au Australia’s financial services licence register. Also check ASIC’s MoneySmart investor alert list at moneysmart.gov.au/scams/check-before-you-invest for flagged platforms. MAS Financial Institutions Directory – mas.gov.sg Singapore’s Monetary Authority publishes both its register of authorised firms and a dedicated Investor Alert List of unregulated entities. WHOIS Domain Lookup – whois.domaintools.com Reveals when a domain was registered, by whom, and its registration history. A platform claiming years of operation on a domain registered in the past 12 months is misrepresenting its history. Wayback Machine – web.archive.org Shows what a website looked like at any point in its history. Use it to check whether a platform recently changed its name, branding, or claimed regulatory status.

Broker and Investment Platform Checklist

Before depositing with any broker or investment platform, confirm every item below:

• The firm name appears on the FCA, ESMA, CySEC, ASIC, or MAS register — searched directly on the regulator’s website, not via the platform
• The licence number displayed on the platform matches the register entry character for character
• The website URL recorded on the regulatory register matches the URL you are actually using
• The licence status is active — not suspended, cancelled, or under restriction
• The permitted activities on the licence include the specific service being offered
• The firm does not appear on any regulator’s warning list or alert list
• The domain was registered more than 24 months ago, or the registration history is consistent with the platform’s claimed operating history
• Named directors or executives can be independently verified through LinkedIn, company registries, or industry sources
• The company’s legal registration can be confirmed through the relevant national company registry
• Withdrawal terms are clearly stated in writing before any deposit is made
• No guaranteed returns, fixed profit promises, or risk-free investment claims are made
• The platform does not require an upfront fee, tax payment, or deposit to process a withdrawal

 

Section 2: Crypto Platform Verification

Free Tools

Etherscan – etherscan.io Ethereum blockchain explorer. Paste any wallet address or transaction hash to view the complete on-chain history, transaction volume, and whether the address has interacted with flagged wallets. Blockchain.com Explorer – blockchain.com/explorer Bitcoin blockchain explorer. Use it to verify Bitcoin transaction IDs and trace wallet activity. BSCScan – bscscan.com Binance Smart Chain explorer. Essential for verifying transactions involving BEP-20 tokens and BSC-based DeFi platforms. OFAC Sanctions Search – sanctionssearch.ofac.treas.gov The US Treasury’s Office of Foreign Assets Control publishes a searchable sanctions list that includes cryptocurrency wallet addresses. Check any receiving wallet address before sending funds. Google Play Store & Apple App Store Search for the platform’s app in both stores independently. Verify the developer name, review volume, publication date, and user feedback. A platform not listed in either store has bypassed independent app review processes. Trustpilot – trustpilot.com Search the platform name. Analyse the age distribution of reviews, the ratio of one-star to five-star reviews, and whether negative reviews describe substantive issues such as withdrawal problems or account freezes.

Crypto Platform Checklist

• The platform is registered with a recognised financial regulator under a national crypto asset framework (FCA, MiCA, MAS, ASIC)
• The receiving wallet address has been checked on a blockchain explorer and shows no suspicious patterns (newly created, receiving from many senders simultaneously)
• The wallet address does not appear on the OFAC sanctions list
• The platform has a verifiable app store presence with consistent, long-term review history
• The platform can demonstrate proof of reserves — published wallet addresses confirming sufficient assets to cover client balances
• No “wallet connection” or “approval” transaction is required simply to verify or activate an account
• Withdrawal functionality is described in detail in the terms of service with no minimum balance or fee preconditions
• The platform has not contacted you unsolicited through social media, messaging apps, or dating platforms
• Named founders or executives are independently verifiable and do not use stock photography as profile images
• The domain registration date is consistent with the platform’s claimed history

 

Section 3: Phishing and Email Fraud Detection

Free Tools

Google Safe Browsing – transparencyreport.google.com/safe-browsing/search Enter any URL to check whether Google has flagged it as a phishing, malware, or deceptive site. Updated in near-real time based on Google’s web crawling data. VirusTotal – virustotal.com Scan any URL, file, or email attachment against over 70 antivirus and threat intelligence engines simultaneously. Essential before opening any attachment or clicking any link received from an unknown source. URLScan.io – urlscan.io Analyses and screenshots any URL in a sandboxed environment without you visiting the site directly. Reveals the site’s actual hosting location, redirects, embedded scripts, and connections to known malicious infrastructure. Have I Been Pwned – haveibeenpwned.com Check whether your email address has appeared in any known data breaches. Phishing campaigns frequently target individuals whose email addresses and associated data were exposed in breaches. MXToolbox Email Header Analyser – mxtoolbox.com/EmailHeaders.aspx Paste the full header of any suspicious email to reveal its true sending origin, routing path, and whether it passed standard authentication checks (SPF, DKIM, DMARC). Identifies spoofed sender addresses that appear legitimate in the visible “From” field.

Phishing and Email Fraud Checklist

When you receive an unsolicited email, message, or communication involving financial services or investment opportunities:

• The sender’s actual email domain — visible in the full email header, not just the display name — matches the organisation’s official domain exactly
• The URL in any link, when hovered over without clicking, matches the domain you expect
• The URL has been checked on Google Safe Browsing and VirusTotal before clicking
• Any attachment has been scanned on VirusTotal before opening
• The communication does not create artificial urgency, time pressure, or fear of loss
• The communication does not request personal data, passwords, seed phrases, or two-factor authentication codes
• The offer or opportunity was not delivered exclusively through a messaging app, WhatsApp, Telegram, or social media DM rather than official channels
• You have independently verified — using contact details from the organisation’s official website, not the email — that the communication is genuine

 

Section 4: Social Media and Romance Scam Detection

Free Tools

Google Reverse Image Search – images.google.com Drag any profile image into Google’s image search to identify whether it is a stock photograph, a stolen image, or appears across multiple unrelated profiles. A definitive tool for exposing fabricated online identities. TinEye – tineye.com A dedicated reverse image search engine that tracks where an image appears across the web. More thorough than Google for identifying reused profile photographs. Social Catfish – socialcatfish.com A people-search and identity verification tool that cross-references names, images, email addresses, and phone numbers across social media platforms and public records. Useful for verifying whether an online contact is who they claim to be. Romance Scam Databases – romancescam.com and scamdigger.com Community-maintained databases of known romance scammer profiles, photographs, and scripts. Searching a contact’s profile image or name may reveal previously reported fraudulent identities. LinkedIn Company Verification For contacts claiming professional credentials, verify their employer’s LinkedIn company page independently. Check whether their profile was created recently, whether they have genuine connection networks, and whether their employment history is consistent and verifiable.

Social Media and Romance Scam Checklist

Apply these checks to any online contact who introduces an investment opportunity, regardless of the nature of the relationship:

• Profile photographs pass a reverse image search — they are not stock images or photographs stolen from another person’s public profile
• The contact’s social media profile was created more than 12 months ago and has a consistent, organic history of activity
• The contact has verifiable mutual connections or a traceable professional history — not a freshly created profile with few connections
• The investment opportunity was not introduced after a period of relationship-building, trust development, or emotional intimacy building via a messaging app
• The contact has not discouraged you from discussing the investment with family, financial advisers, or other trusted people
• The investment platform the contact introduced has passed the broker or crypto platform checklist above independently
• The contact has not claimed to be making exceptional returns and shared fabricated screenshots of profits as proof
• No urgency has been applied to invest before a “window closes” or a “special opportunity expires”
• You have verified, through independent means, that the person exists and is who they claim to be before sending any funds

 

Section 5: Bank Transfer and Payment Safety

Free Tools

UK Finance – Take Five to Stop Fraud – takefive-stopfraud.org.uk The UK banking industry’s official fraud awareness campaign. Includes practical guides, a self-assessment tool, and real-time fraud alerts by category. FIN-NET – ec.europa.eu/fin-net The European Commission’s network of national financial dispute resolution bodies. Use it to identify the correct ombudsman or complaints authority for your bank’s country of registration. Action Fraud – actionfraud.police.uk The UK’s national fraud reporting centre. Also maintains a fraud alert feed updated with active fraud campaigns targeting UK consumers. Your Bank’s Confirmation of Payee Service Most UK banks now operate Confirmation of Payee (CoP) — a name-checking service that verifies whether the account name you are paying matches the account number and sort code. If your bank’s CoP check returns a mismatch, stop the payment and verify the payee details through independently obtained contact information before proceeding. Your Card Issuer’s Dispute Portal All major card issuers — Visa, Mastercard, American Express — provide online dispute filing for fraudulent or undelivered transactions. Locate your card issuer’s official dispute portal before you need it, and note the applicable time limits for your card type.

Bank Transfer and Payment Safety Checklist

Before making any bank transfer or card payment to an investment platform or financial service:

• You have verified the payee’s bank details through independently sourced contact information — not details provided in an email, message, or by the platform itself
• A Confirmation of Payee check (UK Faster Payments) returned a full match — not a partial match or mismatch
• You have not received a call, email, or message from someone claiming to be your bank asking you to transfer funds to a “safe account”
• The payment is not being made under time pressure or urgency imposed by the payee
• You have checked whether your bank has issued any specific warnings about the type of payment or recipient you are about to pay
• For credit card payments, you have confirmed the transaction is eligible for Section 75 protection (UK) — purchase between £100 and £30,000 from a merchant, not a peer-to-peer transfer
• For wire transfers above a significant threshold, you have verbally confirmed the recipient’s details using a phone number independently sourced — not a number provided alongside the payment instructions

 

If Prevention Has Already Failed: Immediate Next Steps

These tools and checklists are most valuable before a fraud occurs. If you are reading this after losing funds, the following steps apply regardless of which fraud category was involved: Act within hours, not days. Payment recall requests, chargeback claims, and emergency freezing orders all have dramatically higher success rates when initiated immediately. Every hour of delay allows funds to move further from reach. Preserve all evidence before anything else. Screenshot account balances, transaction records, all communications, and the platform’s website. Fraudulent platforms and contact profiles are deleted rapidly once operators sense legal exposure. Do not pay any further fees. No recovery fee, release charge, tax payment, or verification deposit will return your funds. Any such demand is a continuation or a secondary fraud. Report formally to your national financial regulator and police. This creates an official record, may contribute to a broader investigation, and is a procedural prerequisite for several recovery mechanisms. Seek specialist legal and advisory support where significant funds are involved, particularly where the fraud has connections to European financial infrastructure.