When someone clones your firm: protecting your name, your domain and your clients

What a clone looks like

The SRA publishes scam alerts most weeks about websites and emails that misuse the names of genuine firms. The patterns repeat:

• A lookalike web address: one letter added or missing, a hyphen, or .com instead of .co.uk.
• Cloned details: the genuine firm’s name, address, SRA number and Companies House number, copied onto a new site.
• Email that appears to come from you, either from a lookalike address or by spoofing your real one.

The aim is usually money: deposits, completion funds, fees or “release” payments sent to the fraudster’s account. The genuine firm often finds out only when a stranger rings to ask where their money is.

AT A GLANCE

Harder to copy, easier to check

Five things that protect your clients from someone pretending to be you.

• Look

  Search for your firm’s name and check the SRA’s scam alerts regularly.

  Clones found early

• Own

  Register the obvious lookalikes of your web address.

  Fewer easy copies

• Lock

  Set up DMARC, SPF and DKIM so others cannot easily send email as you.

  Spoofed email blocked

• Tell

  Clients hear, early and often, that your bank details will not change by email.

  Clients who check

• Plan

  A one-page plan for the first hour if a clone appears.

  A calm, fast response

Make your firm harder to copy

Register the obvious lookalikes. Ask your IT support to list the closest variations of your web address (the .com and .co.uk versions, a hyphenated version, common misspellings) and register the ones that matter most. It costs little, and each one you own is one a fraudster cannot.

Stop others sending email as you. Three settings on your domain, known as SPF, DKIM and DMARC, let receiving mail systems check whether an email really came from you, and tell them to reject it if it did not. The NCSC’s email security guidance explains them. Ask your IT support whether yours are in place and whether DMARC is set to reject, not just monitor.

Keep your public details consistent. Your website should show the SRA’s digital badge, which links to the SRA’s own record of your firm; the Transparency Rules require it. Make sure your firm’s details on the SRA register, Companies House (if you are a company) and your website match, so a client who checks finds the same answer everywhere.

Make your firm easier to check

The best protection is a client who checks. Tell them, at the start and at the moments that matter:

• in the client care letter, that your bank details will never change by email and how to confirm them;
• in your email footer and on your website, which web address and email domain are genuinely yours;
• before every significant payment, by phone on a number they already have, not one in the email.

Apply the same rule inside the firm: no change to a client’s or supplier’s bank details on the strength of an email alone.

Keep looking

Once a month, someone searches for the firm’s name and its variations, and glances at the SRA’s scam alerts. Ask reception and the fee earners to pass on any call from someone who is not a client but thinks they are. Those calls are often the first sign.

Free services worth signing up to

• NCSC Early Warning: a free service for UK organisations that alerts you to possible attacks and malicious activity involving your domains and public IP addresses. It takes a few minutes to register.
• NCSC reporting: forward suspicious emails to report@phishing.gov.uk, and report scam websites through the NCSC’s online form. Both help get fake sites taken down.
• SRA scam alerts: the SRA publishes its alerts and a regular round-up on its website. Make checking them part of the monthly look.
• Your regional Cyber Resilience Centre: police-led, not-for-profit centres for smaller organisations, with free core membership, guidance and alerts.

The first hour if it happens

1. Tell the SRA straight away. Its guidance asks firms and the public to report misuse of a genuine firm’s identity immediately, and it can publish an alert.
2. Report it to Report Fraud (the police service that replaced Action Fraud in England, Wales and Northern Ireland; in Scotland, Police Scotland on 101), and report the fake website to the NCSC. Keep a record of what you have found: screenshots, addresses, dates.
3. Ask for the site to be taken down, through the company that hosts it and the domain registrar; your IT support can identify both.
4. Warn your clients, particularly those with payments due, and put a notice on your website.
5. Tell your COLP and your insurer, and consider whether any of your own systems or data were involved.

Write these steps on one page, with names and numbers, before you need them.

Start this week

Search for your firm’s name, ask your IT support two questions (which lookalike addresses do we own, and is DMARC set to reject?), and check that your client care letter says your bank details will never change by email. That is an afternoon’s work, and it protects the clients who trust your name.

It sits alongside how cyber risk shows up in your insurance renewal and onboarding as the point where risk is controlled.

We help firms review their security and client communications in plain terms, and put simple plans in place before they are needed.

If you think anything here is out of date, please tell us and we will correct it.