Audio played live by your browser, with no audio file or extra download.
Fraud in trading, in the sense this lesson uses, is when a party takes your money without being licensed for that activity by the authority it names, or claims to be another party. This is a working definition, based on what you can check; it is not a legal definition.
A bad offer has weak terms, which you can read and refuse. What distinguishes fraud in this sense is not found in the terms but in the register: is the party asking for your money licensed for this activity by the authority it names? The lessons on regulation in the Gulf and on checking a broker explained how to read the register and how to understand a warning list, and this lesson deals with what surrounds that: how the offer reaches you, what the lists say, and how to check a domain.
Someone who presents themselves as the manager of your account and offers to trade on your behalf is a sign that came up in the lesson on checking a broker, tied to the rules of the Financial Services Regulatory Authority (FSRA) in Abu Dhabi Global Market (ADGM) and to the register. The description that follows is taken from the bodies’ own texts, and each step in it is attributed to whoever stated it.
The International Organization of Securities Commissions (IOSCO) describes a pattern it calls relationship investment scams: a stranger contacts you through social media, a dating app, an investment group chat, or a text message that seemed to have the wrong number; then wants to move the conversation to an encrypted text messaging app; then points you to a specific platform, often one you have not heard of, whose charts show you huge returns; and when you want to withdraw, technical problems appear, or taxes and fees appear that you need to pay first.
The four steps as IOSCO describes them: a general description of a pattern, not the description of any particular offer
The Gulf authorities speak about the channels. In an alert dated 10 April 2025, the FSRA stated that fraud impersonating licensed firms may arrive through fake websites, emails, social media profiles, phone calls, group chats such as WhatsApp and Telegram, and text messages. It advises avoiding making payments or providing personal information in response to messages you did not ask for.
The Saudi Central Bank (SAMA) page on unlicensed activities lists indicators, among them: communication through unofficial channels such as WhatsApp, Telegram, X, Snapchat and TikTok; promises of quick or guaranteed returns; pressure to make prompt decisions; and the use of names similar to licensed entities.
The lesson on regulation in the Gulf showed that a warning list is not a public register. What is new here is what each list says about impersonation:
IOSCO has an alerts portal named I-SCAN that gathers the warnings its members send about firms offering investment services without authorisation. IOSCO says the portal does not provide a complete list of the warnings of all its members, and that it does not itself verify everything the members send. In the portal’s national competent authority filter, as read on 14 October 2026, are the UAE Capital Market Authority, the DFSA and the FSRA, and there is no mention of the Saudi Capital Market Authority. IOSCO warns you not to assume, merely because a warning is absent from the portal, that a firm that has approached you is authorised or legitimate.
The rule for all of these lists is the same: absence from them is not approval. A name’s absence from a list means only that the authority has not warned about it.
A registered domain is the name that is registered with the registrar, together with its extension; the parts before it are added by the domain’s owner as they wish. Take hypothetical names: support.broker-a.example belongs to the registered domain broker-a.example, whereas broker-a-support.example is a different registered domain that may be owned by someone else. The similarity of the two names does not mean they have one owner.
The DFSA’s advice is to compare the domain of the email address the party writes to you from with the domain of the email addresses the firm lists on its website, and to check on the regulator’s website that the firm is listed and licensed. It adds that an internet search alone may not be enough, because scammers have built sophisticated websites, and because copying genuine pages to a fake address is technically easy.
Do not expect to find the company’s website in the register: no website field appeared in the DFSA entry that was read, nor in the FSRA register, nor in the CMA’s list of licensed institutions. So compare the entity’s name in its documents, such as the client agreement, with its name in the register, and compare its address where the register shows an address, as in the DFSA entry and the FSRA register.
The ICANN tool for searching domain registration data, as ICANN describes it, lets you look up the current registration data for domain names. In a 2019 blog post, ICANN says that results containing personal data may be redacted to protect privacy, and that what is redacted varies between registrars. So do not assume you will see the owner’s name. In the registration data of a domain reserved for examples, which was read as a specimen for this lesson, the registration, expiration and last-changed dates appeared, and the registrar’s name, but the domain’s owner did not appear at that level. The field names mentioned are those of the RDAP protocol at the domain registry operator, and may differ from what the tool’s screen shows.
A very recent registration date for the domain of a company that says it is long established is a question to put to the offer, not proof: none of the bodies read said that a domain’s being new proves fraud.
IOSCO advises you not to pay money to recover your investment, and not to make an upfront payment to release your funds. This is its statement alone: the other bodies read for this lesson did not mention recovery offers, so the lesson says nothing about them.
The authorities have pages for reporting. These are the names of those pages, not the means of contacting the authorities, so look for them on the authority’s own website:
This is a procedure, not a promise: the lesson says nothing about whether money can be recovered, or about the outcome of any report.
What you are not usually toldA fraudster may carry the name of a real licensed firm, its address and its licence number. In an alert it published about a firm licensed by it, the DFSA said that the scammers used the firm’s name, its address in the DIFC and its DFSA reference number without permission, and set up a fake website and email address attributed to the firm, and that the firm has a genuine website and email domain, different from those. The DFSA’s Clone category describes a case close to this one. So if you are told the name and number are genuine, that settles nothing: the licence is settled by the register entry, and the contact route to trust is the one the regulator itself publishes, as the DFSA published the firm’s genuine domain in its alert, and not the one given to you by whoever contacted you.
| The sign | What you check | Where it is written |
|---|---|---|
| A message or an invitation to a group chat that you did not ask for | Which entity it is, and which authority licenses it, before you reply or pay | The register of the authority it names, and the FSRA’s advice to avoid making payments and providing personal information in response to messages you did not ask for |
| A promise of quick or guaranteed returns, and pressure to make a prompt decision | Whether the entity is in the register for this activity | The indicators on SAMA’s page on unlicensed activities |
| A platform you do not know, huge returns in its charts, and a withdrawal made conditional on taxes or fees | Have you been asked to pay something before withdrawing? According to IOSCO, do not pay to release your funds | IOSCO’s description of relationship investment scams |
| A genuine name, address and licence number | Whether the offer comes from the licensed entity itself | The register entry, and the DFSA’s alerts on impersonation of licensed firms |
| The domain of the website or the email | Whether it is the same registered domain as in the entity’s documents | The entity’s documents, and the ICANN tool for registration data, with the possibility of redaction |
| A name absent from a warning list | Nothing: absence from it is not approval | The register of the authority the entity names |
| An offer to recover money | Have you been asked to pay something to recover it? According to IOSCO, do not pay | IOSCO’s own page |
WarningLeveraged trading in CFDs carries high risk, and you may lose the entire amount you deposited. This lesson is an educational explanation of the nature of the product, not a recommendation to trade and not investment advice.
This ends the “Before you start” level. The next level begins with currency pairs: how a pair’s price is written, and how it is read.
