Eight checks to run before money leaves your account

Look the domain up in ICANN Lookup and read the creation date. A brokerage, exchange, or retailer that claims years of operation on a domain registered eleven weeks ago is not what it says it is. The overwhelming majority of alerts in this feed involve domains under six months old at the time money was sent, and most were under sixty days.

A domain under six months old asking for an irreversible payment is where you stop.

Lookalike domains are the entire mechanism behind phishing. Read the hostname from right to left, starting at the part immediately before the first single slash, because that is the only part that identifies the owner. Everything to the left of it is chosen freely by whoever registered the domain and can be made to say any brand name at all.

Never reach a login page through a link in a message. Open the app you already have.

Any platform holding funds or offering investments must be authorised. Search your national regulator's register directly — the FCA register in the UK, FINRA BrokerCheck and the SEC in the US, your own authority elsewhere — using the licence number the site displays. Cloned firms quote a real licence belonging to a real company, so compare the registered address, phone number, and website in the register against the site you are on.

A licence number that resolves to a different website is a clone, not a coincidence.

Take the exact company name from the footer, invoice, or terms page and search the business register of the country it claims to operate from. No filing, a filing registered a few weeks ago, a dissolved status, or a name that does not match the payment instructions all mean the counterparty on your paperwork does not exist as described.

No company register entry means no legal recourse and nobody to pursue.

Save the product photographs, the team headshots, the certificates, and the profile pictures, then run them through Google Lens or TinEye. Fake storefronts copy catalogues wholesale from real retailers. Fake platforms and fake profiles use stock photography or photographs taken from unrelated people's social accounts.

Images that appear elsewhere under other names mean nothing on the page is original.

The brand is disposable; the payment destination usually is not. Paste a crypto address into a public block explorer and look at its history: a wallet receiving many small deposits from many unrelated addresses with no outgoing commerce is a collection wallet. For a bank transfer, compare the beneficiary name to the legal entity name. A personal name, an unrelated company, or a third-party processor is the single most common feature across this entire feed.

A beneficiary name that does not match the business is the point of no return.

Ask for a video call in the next ten minutes with the person you have been talking to, on camera, and ask them something unscripted. Fraudulent operations cannot pass this, because the photographs belong to someone else and the account manager is a shared script. Endless rescheduling, broken cameras, and pre-recorded clips are all the same answer.

If they will not appear live on short notice, the person you know does not exist.

Before any further deposit, withdraw a small amount and watch what happens. A working platform returns funds to their origin without conditions. A fraudulent one produces a tax clearance, a liquidity fee, a compliance deposit, or an upgrade requirement — always payable from outside the balance, because the balance is a number in a database and no position was ever opened.

Any fee demanded before a withdrawal is proof the balance is not real. Pay nothing further.