A red flag is a fact that makes a check or an operational stop necessary. It is not a verdict: urgency, a promised return, a domain name, or a payment method only acquires meaning in the context of the available evidence.
In plain terms — A warning sign does not prove a scam by itself, but ignoring it means acting before an important question has been resolved.
Three levels, not a score
Contextual signal
A recently registered domain, a foreign company, high fees, or aggressive communication deserves attention, but does not by itself prove unauthorised activity or fraud. The entity, service, client, product, and jurisdiction all need to be understood.
Verification required
Vague credentials, undocumented results, unexplained conflicts, unclear withdrawal terms, or inconsistent contractual details require independent evidence. Do not increase the exposure while the question remains open.
Operational stop
Stop before acting if someone asks for a seed phrase, password, remote access to a device, a payment to an individual or to unverified bank details, or more money to “release” a withdrawal. The stop prevents harm while you check; it is not a public declaration of guilt.
The most important families
Identity mismatch. The website name resembles an authorised firm, but its domain, email, phone number, or legal name differs from the register. This is the pattern used by a clone website.
Permission does not cover the offer. The entity is registered for one activity but offers a service, product, or country outside the verified perimeter.
A promise replaces risk. “Guaranteed” returns, eliminated risk, unverifiable testimonials, pressure to decide immediately, and secrecy are recurring indicators in regulatory guidance.
Unusual payment or access request. Transfers to inconsistent payees, crypto sent to a wallet supplied in a chat, screen sharing, remote-control software, or disclosure of credentials move control towards the requester.
A withdrawal creates new obstacles. Fees or taxes first disclosed after a withdrawal request, mandatory top-ups, and paid recovery promises may indicate an ongoing fraud or a recovery scam. Verify each request with the intermediary and authority through independent channels.
What to do when you encounter a red flag
Stopping the action is the first control. Then preserve the evidence, state the exact question, and look for the answer in the competent source. “Does this domain belong to the entity named in the register?” can be checked; “this website feels strange” cannot.
Due diligence reconstructs the entity, permission, contact details, custody arrangements, and warnings. If a discrepancy cannot be resolved, do not deposit or transmit data. If you have already acted, follow the response path in Regulation, security, and fraud prevention.
Common mistake — Mechanically adding weak signals and turning them into an allegation, or waiting for several signals when one already exposes money, keys, or identity directly.
Sources
- Investor.gov — Red Flags of Investment Fraud Checklist — recurring signs including unauthorised persons, urgency, guarantees, testimonials, and suspicious payments.
- FCA — How to check a firm or individual is authorised — comparison between official contact details and those of a possible clone.
- FCA — Warning List — absence from the list does not prove that an entity is authorised or legitimate.
- IOSCO — I-SCAN — international alerts, including unauthorised entities and clones; the database is not exhaustive.
- CONSOB — Communication on unauthorised activity, 20 May 2026 — clone websites, public figures, and AI-generated content used to promote unauthorised offers.