How to check that an investment firm or lender is real, and what the check cannot tell you

A cold call, an advert with a celebrity in it or a friendly message from a stranger can all lead to the same place: a firm with a professional name and a website, asking you to move money. Regulators publish free registers so you can check the firm. This post covers the main ones in four countries, what a listing does and does not prove, and why scammers copy real names. It is an explainer, not financial advice.

Why a register is worth a minute

The US Securities and Exchange Commission (SEC) says, “Unlicensed, unregistered persons commit much of the investment fraud in the United States.” FINRA, the industry regulator for US brokers, says many financial scams involve unregistered people or unregistered investments sold through unregistered institutions, and that without regulation, filing a complaint or recouping lost funds can be difficult.

A register does not catch every scam, but it is a cheap early filter. Our pages on investment and crypto platform fraud and pig butchering show the schemes it is meant to help with.

United States: investment firms and advisers

• SEC Investment Adviser Public Disclosure (IAPD). Covers advisers registered with the SEC and most state-registered advisers. You can see the firm’s Form ADV and its relationship summary.
• FINRA BrokerCheck. Covers brokers and brokerage firms. The two databases redirect to each other when needed. FINRA says both can be used to research firms as well as individuals. The SEC says the searches are free and the person is not told you looked.
• Your state securities regulator. The SEC and FINRA both advise checking with it as well. NASAA’s contact page links to state, provincial and territorial regulators.

Ask the firm “who are you registered with, and in what capacity?” and check the answer. FINRA also notes that an investment may legitimately be unregistered, and that most crypto assets are not registered, so a missing registration for the product is a prompt to ask why, not proof of fraud.

United States: lenders and loan brokers

For lenders, the sources point to state regulators and to a shared licensing system. For mortgage companies and individual loan originators, the Conference of State Bank Supervisors runs NMLS Consumer Access. CSBS says anyone can use it to check the status of mortgage companies and originators, see the states they may work in and whether regulators have taken action. The SAFE Act requires state-licensed mortgage companies and their originators to be licensed through NMLS.

For other lenders, the FTC’s advice is to contact your state attorney general or banking regulator and confirm the lender is registered where it does business. States set their own rules. Connecticut’s Department of Banking, for example, says it is illegal in the state for brokers of unsecured loans to require a fee before loan proceeds are disbursed. The FTC adds that legitimate lenders may charge application or appraisal fees, but “nobody legit” will say a fee guarantees a loan. In an advance-fee scam, it says, there is no loan and no lender. See our page on the advance-fee loan scam.

United Kingdom, Australia and Canada

• UK: the FCA Firm Checker and Financial Services Register. The FCA says almost all firms and individuals must be authorised or registered. Check that the firm reference number and contact details you were given match the Checker, and contact the firm only through the details the Checker lists. The register also records firms warned about, including those falsely claiming to be a genuine authorised firm. See the UK page.
• Australia: ASIC Professional Registers Search. Search by licensee name, ABN, ACN or licence number. ASIC is also adding each licensee’s website address, so you can check whether the site in front of you is the real one. See the Australia page.
• Canada: the National Registration Search. Run by the Canadian Securities Administrators, it shows whether a firm or individual is registered in a province, the category, and any conditions. The CSA’s address, per a New Brunswick regulator release, is aretheyregistered.ca. People banned from doing business in British Columbia do not appear on it, only on the BCSC’s Disciplined List. See the Canada page.

What a registration does and does not prove

A listing shows that a firm or person went through a licensing process and what has been disclosed about them. The SEC and FINRA say the records include qualifications and disciplinary history. CSBS says mortgage originators must complete education, pass a test and submit to a background check before being licensed.

It does not show that the person contacting you is who they say they are, that the product in front of you is the one that was registered, or that the investment is sound. The FCA warns that investment scams often involve products it does not regulate. FINRA says some bad actors falsely claim to be registered and even provide doctored information from sources like BrokerCheck. The SEC singles out one false proof: a firm that points to a Form D filing as evidence of SEC registration. The SEC says a Form D has nothing to do with being registered, and that it does not verify the information in one.

Why scammers clone real firm names

Because the register is the test, impersonators copy what passes it. The SEC and FBI describe fraudsters who use a real firm’s actual name and information to open accounts and register domain names, copy a registered professional’s registration number and history from BrokerCheck or IAPD, call from a spoofed number that appears connected to the real firm, and even encourage victims to research the firm they are copying. Our post on why caller ID cannot be trusted covers that last part.

ASIC says criminals are increasingly copying licensees’ names, licence numbers and websites, and that about 20% of new Moneysmart investor alert listings since late 2023 involve impersonation of a licensee, an authorised representative or a registered company. The FCA says some firms pretend to be authorised, which is why it tells you to use only the contact details on its own Firm Checker.

A routine that survives cloning

1. Look the firm up on the register yourself, typing the address in, not following a link you were sent.
2. Take the phone number and website from the register or the firm’s official filing, not from the person who contacted you. The SEC and FBI suggest using the contact details in the firm’s Form CRS; the FCA says use only the Firm Checker’s contact details.
3. Check the product as well as the firm, and ask why it is unregistered if it is.
4. Treat refusal to take a call or meet as a red flag, as the SEC and FBI do.
5. If the firm is not listed, or the details do not match, do not send money, and tell your regulator.

What we could not verify

We found no source counting how many people check a register before investing, or how many clone-firm approaches a lookup stops. ASIC says its website field is still being filled in, so a missing website is a question to ask, not a verdict. We did not verify state-by-state lending rules beyond the examples above.