How to check a broker is real and not a fraud

Where a broker is checked

In the register of the regulator whose licence the site claims. Take the licence number and the legal entity name from the footer and look them up there. The verification link for every regulator in the shortlist is in its card on the Regulators page: that is the starting point.

CONDUSEF's SIPRES registry is not the right place for this check. CONDUSEF is Mexico's agency for the defence of users of financial services, and its public registry, SIPRES, lists the institutions licensed in Mexico: banks, insurers, SOFOMs. The shortlist's international brokers do not operate under a Mexican licence to offer CFDs to retail clients: their authorisation needs to be verified in the register of the relevant foreign regulator instead, it is not CONDUSEF's competence, and they don't appear in SIPRES. Not finding one there says nothing about it, good or bad.

What a clone looks like

The FCA describes “clone firms” like this: fraudsters use the name, address and licence number of a real regulated firm, and copy its site with small changes, for example a different phone number or domain. From the outside everything looks like a well-known broker, only the money doesn't go to the broker. This is why the licence number on its own settles nothing: on a clone it is genuine, because it belongs to the firm being impersonated. What doesn't match the register are the contacts.

The check

1. Look up the licence number and the legal entity name from the footer in the register of the regulator that issued them, through the link in its card on the Regulators page.
2. Compare the contacts and the domain against the register, and contact the firm on the details from the register, not the ones you were given.
3. Compare the legal entity in the footer against the entity in the client agreement: who actually opens the account.
4. Reach the site via a bookmark or a manually typed official domain, not via a link from a messenger, an email or an ad.

SPEI: the beneficiary name counts for nothing

Under Banco de México's rules on electronic payments, a SPEI is identified in only three ways: by the recipient's CLABE (18 digits), by their account number, or by the card number. The recipient's name is not a means of identification: even though it goes into the transfer order, it is not taken into account when the payment is applied. Typing the company's name into the form and seeing it there confirms nothing, because the money reaches whoever owns that CLABE.

CONDUSEF spells out the consequence: if the CLABE doesn't match the beneficiary's name or company name, in principle neither the bank that issued the SPEI nor the bank holding the receiving account bears any responsibility.

Hence the rule: a CLABE sent in a chat is not a payment method of the broker. Deposits go through the payment form of the client area, on the official domain.

Red flags

• Be wary if all communication and payment happen through WhatsApp, Telegram or social media, especially if you're sent banking details outside the official client portal.
• Guaranteed returns are promised, or “signals” are presented as a safe way to profit.
• They rush you: “the window is closing”, “the offer ends today”.
• Funding details are a CLABE, an individual's card or a crypto wallet sent in a chat, rather than the payment form of the client area.
• The site footer has no legal entity or licence number, or they aren't found in the regulator's register.