How to Check a Lender Is Legitimate (and Spot Clone Firms)

A convincing website and a friendly phone manner prove nothing. Before you borrow a penny, you need to know that the lender is genuine, authorised, and who they claim to be. Fraudsters are good at looking legitimate — some go as far as impersonating real, regulated companies. The good news is that a few quick checks, done in the right order, will expose almost any fake. This is general information, not financial or legal advice.

Start with the FCA Register

In the UK, firms that lend to consumers must be authorised by the Financial Conduct Authority (FCA), and you can verify any firm for free on the FCA Register. This is your first and most important check.

To do it properly:

1. Go to the FCA Register at register.fca.org.uk (type the address yourself rather than following a link from an advert).
2. Search for the firm by name or, better, by its firm reference number.
3. Confirm it is authorised for consumer credit, not just listed for something unrelated.
4. Cross-check the contact details — phone, website, email and address — against what the lender has given you.

That last step is the one people skip, and it is the most important. A name appearing on the Register is not enough on its own, because scammers exploit real names. What you are really checking is whether the way you are being asked to make contact matches the official details. Our guide to choosing a lender treats this authorisation check as step one for good reason.

If a firm is not on the FCA Register, walk away. If it is on the Register but the contact details do not match, you may be dealing with a clone — walk away and contact the real firm using the Register's details.

How clone-firm scams work

A clone firm is one of the most deceptive scams because it borrows the credibility of a genuine, authorised company. The fraudsters copy a real firm's name, FCA reference number, and sometimes its entire website, then insert their own phone number, email or bank details.

The trap works like this:

• You see an advert, email or call for what looks like a respectable lender.
• You check the name on the FCA Register — and it is there, because it is a real company.
• Reassured, you proceed using the contact details the scammer gave you, sending money or personal data straight to the fraudster.

The defence is simple but must be followed every time: only ever use the contact details published on the FCA Register, never the ones in the advert, email or text that prompted you. If the details differ, that mismatch is the scam. Genuine firms are aware of this problem and sometimes publish guidance clarifying their real identity; UK lender Credicorp, for example, explains who it is and who it is not to help people avoid impersonators — a useful reminder to always confirm you are dealing with the real company.

For the wider tactics fraudsters use to impersonate trusted brands, see our guide to staying safe from impersonation scams.

Warning signs that should make you stop

Beyond the Register check, certain behaviours are red flags in their own right. Any one of these is reason for serious caution:

The upfront fee is especially common. You are told a loan is approved but that you must first pay an "insurance", "release" or "admin" fee. Once you pay, the loan never arrives — or you are asked for another fee. Genuine lenders take any fees from the loan or build them into the repayments; they do not require you to send money before you receive anything. Our dedicated guide to spotting loan scams goes through these tactics in more detail.

Extra checks worth doing

If a lender passes the Register check and shows no obvious red flags, a few more steps add confidence:

• Check Companies House for the registered company, directors and address.
• Look for a real address and landline, not just a mobile number or web form.
• Read independent reviews, but treat both glowing and hostile reviews with care.
• Confirm a secure website (an address beginning https) before entering any details — though note that scammers can use https too, so this is necessary, not sufficient.
• Verify how they handle data. A legitimate firm will have a clear privacy policy; the ICO oversees data protection in the UK.

None of these replaces the FCA Register check, but together they help you separate a professional, established lender from a hastily assembled fake.

What to do if you suspect a scam

If something does not add up, trust that instinct. Then:

1. Stop all contact. Do not send money, documents or personal details.
2. Do not pay any fee, however small or "refundable" it is described as.
3. Report it to Action Fraud (the UK's national fraud reporting centre) and to the FCA, which keeps a warning list of unauthorised firms and known clones.
4. Contact your bank immediately if you have already paid, as fast action improves the chance of recovering funds.
5. Warn others and get free, confidential help from Citizens Advice.

Reporting matters even if you did not lose money, because it helps protect the next person who is targeted.

The bottom line

Checking a lender is legitimate comes down to a disciplined routine: confirm the firm on the FCA Register, and then verify that the contact details you have been given match the official ones — because clone firms copy real companies and only the contact route gives them away. Treat upfront fees, pressure, guaranteed approval and unusual payment methods as reasons to stop. If you suspect a scam, do not pay, report it to Action Fraud and the FCA, and contact your bank if money has changed hands. A few minutes of checking is the cheapest insurance you will ever buy against a loan scam.