How to Verify a Financial Company and Spot Fake Sites

Payment fraud across the European Economic Area reached €4.2 billion in 2024, up from €3.5 billion a year earlier, according to the joint EBA and ECB report on payment fraud. On credit transfers – the euro payments you make from an IBAN – users themselves absorbed roughly 85% of the losses, largely because they were tricked into authorising the transfer.

The only way to know if what's in front of you is real is to verify a financial company before you send it anything, and that's simpler than it sounds.

What “Verifying a Financial Company” Means

In practice, this verification includes three checks. If you skip any of them, you might end up sending money to a licensed company's stolen identity rather than the company itself.

First: Does the legal entity hold a valid licence for what it's offering from a real regulator?

Second: Is the website or app messaging you actually operated by that entity, not just wearing its name?

Third: Check the claims on the page; ensure the rate, fee, and protection scheme match what that licence type allows.

A company can pass the first check and fail the second, which is exactly how “clone firm” fraud works: the licence is real; the site in front of you isn't.

In a nutshell: the name, licence, and website all have to point to the same place, be independently verified, not just displayed convincingly.

Here are some interesting facts:

• A padlock is no longer a good sign. More than nine in ten phishing sites tracked by the Anti-Phishing Working Group now run on valid HTTPS. Free certificates take minutes to get, no proof of identity required.
• Clone firms don't just steal a logo; they steal the paperwork. UK regulator warnings show fraudsters routinely copy a real firm's official reference number, banking on victims “verifying” it without checking who it belongs to.
• Some fake domains aren't misspelt; they're written in the wrong alphabet. A Cyrillic “а” looks identical to a Latin “a” in most browsers, making a homoglyph copy pixel-for-pixel indistinguishable in an address bar.

Why Scammers Clone Real Companies Instead of Inventing New Ones

Most fraud built around a fake financial company doesn't invent anything. It copies. Germany's BaFin has a standing term for it – Identitätsmissbrauch, identity abuse – and publishes warnings about it most weeks. A typical case from July 2026: a website offering fixed-term deposits without a licence, filling its legal notice with the registered company data of a real Hamburg firm that had nothing to do with it. The company details were genuine. The people taking the money weren't.

The 2026 version of this runs at scale. When the MiCA licensing deadline passed on 1 July 2026 and European crypto users started moving funds to authorised providers, fraudsters moved with them. France's AMF found scammers posing as AMF staff and directing users to counterfeit websites. ESMA confirmed that criminals were misusing its own name, logo and falsified documents to convince people their money was at risk. The Dutch AFM's advice was the fix for all of it: check the official register before transferring anything.

This is what a lookalike domain scam looks like in practice: not a crude misspelling, but a full environment – site, legal notice, official-looking documents, a link – built so that handing over your details feels unremarkable. What is a lookalike domain? Any address built to be mistaken for one you already trust: a payment provider's, a regulator's, or a newspaper's.

The Regulator Register: The Single Most Reliable Check

Check the financial company's license details first. Every legitimate payment company, e-money institution, investment firm or bank in the EU and UK is listed on a public register run by its regulator, and unlike a website, a scammer can't add themselves to it.

How can I check a specific financial license? Go directly to the regulator's own site, never a link the company sent you, and search by the exact legal name or registration number.

In the UK, that's the FCA's Register, via its Firm Checker; in Malta, the MFSA's Financial Services Register. Other EU countries run the same through their own regulator: Germany's BaFin, France's AMF, and Ireland's Central Bank.

Table: national financial regulators and how to search their public registers. Source: Malta Financial Services Authority, Financial Services Register, 2026 and the FCA.

Where can I check a financial regulator register if a company operates across several EU countries? Start with wherever it's headquartered, then check if it's passported into the countries where you'll use it.

A financial regulator register search takes about as long as reading one email, and answers the question that matters: is this entity, under this name, authorised for this activity, right now?

Matching the Details That Actually Matter

Getting to the register is only half the job. The company is counting on you to stop there, see a roughly matching name, feel reassured, and move on.

What details should match the regulator's register? Four things:

• The legal entity's full registered name
• Its licence or reference number
• Its registered address
• The contact details you use to double-check

That last point is the whole trick behind clone-firm fraud. Fraudsters know people check a Firm Reference Number, so they copy it, along with a phone number that looks official but routes back to them. The only number worth calling is on the regulator's own register.

Marta, a freelance illustrator in Kraków, ran into a version of this last year. A payment app offering a generous loyalty deal listed a Maltese e-money licence and registration number in its onboarding flow. The name and number checked out on the register, but the registered address didn't match the app's own terms, off by one entity in a group structure. That mismatch separated a real, licensed provider from a similarly-named shell with no licence of its own.

Reading the Website Itself: Domain and Padlock

Does HTTPS mean a website is safe? No. HTTPS and the padlock confirm the connection is encrypted, nothing more. A locked door tells you it's locked, not who's behind it, and a scammer can lock their own door as easily as a real financial company can.

Free, automated certificates take minutes to issue without any identity checks, which is why most phishing sites carry one too. So does the HTTPS padlock mean a site is legitimate?

Treat it as a baseline, not a verdict, and look at the domain instead. Financial brands are a favourite target for lookalike domains: addresses built to be mistaken for the real one, by swapping a character, adding a word, or using a different extension.

How do I spot a fake banking website in practice? A short checklist covers most of it:

• Type the address yourself instead of clicking a link from an email, ad or message
• Check the domain character by character: extra words, hyphens, or a different ending (.info instead of .com) are red flags
• Look for a registered address and company number in the footer, then verify both independently
• Be wary of a page leading with a bonus or urgency (“today only”) before it says who's offering it, and don't call a “support” number that appears only on the site itself

That's roughly how to spot a fake financial website without needing any technical background at all.

Verifying Blackcat and Papaya Ltd

It's worth running this process on Blackcat itself as a demonstration of how quickly it is to properly verify a fintech company. Blackcat is issued by Papaya Ltd, and its registered details are published on Blackcat's official Blackcat website, which points to the MFSA's register and tells you exactly what to search: “Papaya Ltd.”

Is Blackcat a regulated financial service? Yes, Papaya Ltd is authorised and regulated by the Malta Financial Services Authority as an Electronic Money Institution, and its registered address (31 Sliema Road, Gzira, Malta) matches the MFSA's own listing.

How can I verify Papaya Ltd, specifically? Search “Papaya Ltd” directly on the MFSA's register, confirm the registration number matches C55146, and check the address against Blackcat's own Blackcat regulatory information page, or read about the checks Blackcat applies to its own systems on the Blackcat security page.

This article is for general information only and is not legal, tax or financial advice.