Fake brokers and clone firms: how they operate, the recovery-room follow-up scam and checking the BaFin and ESMA registers

What you will learn

• The step-by-step script of a fake broker, from the first advert to the "tax" demand
• What a clone firm is and how it misuses the name and licence number of a real company
• How the recovery-room scam targets the same victims a second time
• How to verify a firm in the BaFin company database and the ESMA registers

Explanation

A fake broker is a website or app that looks like a trading platform but never places any trade in a real market. The prices on the screen may be real, but the account is a database entry controlled by the operator, and "profits" are numbers typed into your dashboard. The "broker" fails at one moment only: when you try to withdraw.

The script

1. Contact. A social-media advert, often with a stolen celebrity photo or a fake news article, promises automated trading profits. You leave your phone number.
2. The account manager. A friendly, well-trained caller helps you open an account with a few hundred euros. Within days the dashboard shows a gain.
3. The test withdrawal. A small payout, for example €100, "proves" that withdrawals work. It costs the operator almost nothing and removes your doubt.
4. Escalation. The manager calls about a "special opportunity" and asks for more, using flattery and time limits; some victims are guided to take loans or install remote-access software.
5. The blocked withdrawal. When you ask for your money you must first pay a "tax", a "liquidity fee" or an "anti-money-laundering verification" of 10–20% of the balance. Each payment produces a new reason.
6. Disappearance. The website goes offline and the numbers are dead. A new site with a new name appears within weeks.

Clone firms

A clone firm copies the name, address, licence number and sometimes the whole website of a genuinely licensed company, so that a register search for the name finds the real firm and reassures you. The clone differs only in a detail: a slightly different web domain, phone number or email address, or a "branch" in another country. BaFin publishes warnings about identity misuse (Identitätsmissbrauch) when a real company reports that its name is being cloned.

The recovery room

After a loss, victims are contacted again by a "law firm", a "recovery agency", a "blockchain analysis company" or someone claiming to be from the authorities. They know the details of your case because victim lists are sold between criminal groups, and they promise recovery for an advance fee. BaFin warned in 2018 that genuine authorities never charge a fee, never guarantee recovery and never give preferential treatment for a formal complaint. A demand for money in advance to get money back is itself the scam.

How to verify a firm

1. BaFin company database (Unternehmensdatenbank): search the exact company name and note the registered address, licensed services and contact details.
2. BaFin consumer warnings: a list of companies offering services without a licence and of identity misuse. Search the name and the web domain.
3. ESMA registers: the European Securities and Markets Authority lists investment firms licensed anywhere in the European Economic Area, including those using the EU passport to serve German clients.
4. Compare every detail. Domain, email domain, phone number and address must match the register entry. If in doubt, call the number from the register, not from the website.
5. Check the payment route. A licensed EU broker receives deposits into a client account in the firm's own name. Payment to a private person, a differently named company, a crypto wallet or by gift card is a stop sign.

As of 2026 these registers are free and online; check the current BaFin and ESMA pages, because their layout changes.

Worked example

Hypothetical example: a victim's payments to a fake broker and the follow-up scam. Assumptions: all transfers are irreversible; fees and taxes are ignored.

Total paid: €250 + €4,750 + €15,000 + €9,000 + €3,500 = €32,500. The real value of the account at every point was €0. €20,000 (steps 1–3) was paid before the victim ever tried to withdraw, and €12,500 (steps 4–5) after the first refusal, when the fraud was already provable. The €86,000 balance was the bait that justified paying "tax" on gains that never existed. In Germany, tax on securities gains is withheld by the custodian bank or declared in the annual return; no legitimate broker asks you to transfer tax to it before paying out.

Common mistake

Practice activity

On paper: a caller from "Nordkapital Invest" offers you an account. The BaFin database shows a licensed "Nordkapital Invest GmbH" in Hamburg with the domain nordkapital-invest.de. The caller's email comes from nordkapital-invest-eu.com, the deposit IBAN belongs to "NK Payments UAB" in Lithuania, and the brochure quotes the Hamburg firm's BaFin licence number. List the mismatches and decide what to do.

Key takeaways

• Fake brokers show real prices but never place trades; the fraud becomes visible only at withdrawal.
• Small test withdrawals, VIP managers and "tax before payout" demands are standard script elements.
• Clone firms copy real licences; verify domain, email, phone and the payment account against the BaFin and ESMA register entries.
• Anyone who asks for an advance fee to recover your loss is running the recovery-room scam.

Next step

Next you will look at a greyer area: real people selling signals, copy-trading and courses, and how to audit a track record before you pay for it.