What a clone broker scam is
A clone broker scam is a fake business that copies the name, logo, licence details and website design of a real, known firm. The goal is to make you trust the copy because you have heard of the original. You register, deposit and see a "balance" grow on screen, but your money never reaches a real broker. When you try to withdraw, new fees, "taxes" or delays appear, and then contact stops.
A fake trading app works the same way. It looks like a real broker's app or a MetaTrader platform, but the prices, trades and balance shown inside it are controlled by the scammer.
These scams often arrive through WhatsApp, Telegram, Facebook and Instagram ads, or through a "mentor" who sends you a link. See Fake Signal Groups for how those groups operate.
- Find the company's legal name and licence number on its website.
- Search that number on the regulator's official register.
- Compare the name, website address and contacts with the register entry.
- Check which company would actually serve clients from your country.
- Search the regulators' warning lists for the name and the website.
How copied names and domains work
Scammers rarely build anything original. They copy small details and hope you do not look closely.
| Trick | What it looks like |
|---|---|
| Changed spelling | A letter swapped, doubled or dropped in the brand name |
| Added words | The real name plus words like "global", "pro", "invest", "trade" or "pk" |
| Different ending | The same name on a different domain ending than the real site uses |
| Subdomain trick | The real brand name placed at the start of a long address that ends on an unrelated domain |
| Copied licence text | A real firm's licence details pasted onto the fake site's footer |
| Look-alike characters | Letters from other alphabets that look the same on a phone screen |
The part of an address that matters is the domain just before the first single slash. Everything before it can be invented. A padlock icon only means the connection is encrypted. It does not mean the site belongs to the company it claims to be. Clone sites often have a valid padlock.
The same copying is used for login pages. If a link in a message takes you to a page asking for your password or a code, read Phishing and Fake Logins before typing anything.
How fake APKs work
An APK is an Android app installation file. Real apps are normally installed from an official store, such as Google Play or the Apple App Store, or from a link on the company's official website. Fake apps are usually sent as an APK file in a chat, or offered on a page that tells you to allow "install unknown apps" in your phone settings.
Once installed, a fake app can:
- show invented prices and profits so you deposit more;
- collect your login details, ID photos and card data;
- read messages or notifications, including one-time codes, if you grant those permissions.
If someone insists you install a trading app from a file instead of an official store, treat that as a warning sign on its own.
How to check the official domain
- Start from the regulator, not from the link. Find the firm in the register of the regulator that licenses it and note the website listed there. Our Verify a Broker guide and the register pages linked from Regulation and Safety explain where to look.
- Type the address yourself and save it as a bookmark. Use the bookmark every time instead of links from messages, ads or search ads.
- Compare every letter of the domain with the one in the register, including the ending.
- Check the contact details. Real firms list the same entity name and licence number in the register and on their site. A mismatch is a reason to stop.
- Check regulator warnings. Regulators publish warnings about clones and unlicensed platforms. In Pakistan, the SECP publishes SECP warnings by press release naming platforms (Quotex 09.04.2025; IBKR look-alikes, IGIL Securities, BMA Capital No.108 etc. 22.05.2025; Hillhouse Capital, S-169 Wharton 13.01.2026), none of which names Exness.
How to check an app's publisher
- Open the app's page in the official store and read the developer or publisher name. It should match the company name exactly, not just look similar.
- Go to the company's official website (from your bookmark) and use its link to the store listing. Check that the link opens the same app you found.
- Look at the developer's other apps and contact address on the store page. A brand-new developer account with a famous brand name is suspicious.
- Do not rely on star ratings or download counts alone; both can be inflated.
- For MetaTrader, the platform itself comes from its developer, and your broker gives you the server name to connect to. A server name that does not match what the official site shows is a warning sign. See Platforms and apps for how this works in general.
Turn on two-factor authentication on real accounts, and never share the codes with anyone, including "support" staff who contact you first.
The Pakistan position
In Pakistan, the regulator for these markets is the Securities and Exchange Commission of Pakistan (SECP), with trading in listed securities and commodities only via SECP-licensed securities and futures brokers. Per the SECP, lists of licensed brokers are on the PSX and PMEX websites.
Also, per the SECP, offshore forex/CFD platforms operate without regulatory approval in Pakistan, and per the SECP, offshore platforms have no Pakistani licence or oversight and offer no legal protection or recourse. On the legal position, under the Futures Market Act 2016, s.47(1), no one may carry on a regulated activity (futures broker, adviser, representative) without an SECP licence. Read Law and regulators and Offshore vs Onshore for what this means for you.
This matters for clones: if you send money to a fake offshore site, there may be no local body that can act for you. Even with a genuine firm, leveraged forex and CFD trading can lose money fast.
If you already used a fake site or app
- Stop sending money, whatever reason is given for "unlocking" a withdrawal.
- Uninstall the app and change passwords on your email and any account where you reused the same password.
- Contact your bank or wallet provider about the payments.
- Keep screenshots, chat logs, addresses and transaction records.
- Report it. See Report a Scam.
- Ignore anyone who offers to get your money back for a fee. That is a second scam, explained in Recovery Scams.
For a wider list of red flags, see Scam Warning Signs and the Broker Checklist.
Frequent questions
How can I tell a fake broker website from the real one?
Find the firm in the regulator's register, take the website listed there, and compare the domain letter by letter. Use only that address, saved as a bookmark.
Does a padlock or "https" mean the site is safe?
No. It only means the connection is encrypted. Clone sites can have a valid padlock.
Is a fake forex app in Pakistan always an APK file?
Not always, but APK files sent in chats are a common route. Fake apps can also briefly appear in stores under look-alike publisher names, so check the publisher name against the official site.
Can the SECP help if I lost money to a clone site?
Per the SECP, offshore platforms offer no legal protection or recourse in Pakistan. You can still report the case; see Report a Scam.
Does a regulator warning mean a firm is a scam?
A warning means the regulator has publicly cautioned about that name or site. Do not accuse a company of fraud unless an official source says so; rely on the regulator's own wording.
