Regulators warn about fake firms. The fakes stay up.

• 139 warnings named a real, authorised firm and at least one fake web address: 94 FCA clone-firm warnings (January to September 2026) and 45 SRA scam alerts (July to September 2026).
• At least 24 of them (17%) still had a fake address serving a website on 30 September: 16 of the FCA warnings and 8 of the SRA alerts.
• For those 24, the warning had been public for a median of 72 days. The oldest was 253 days. 19 of the 24 had been up for more than a month after the regulator spoke.
• Separately, of every firm the FCA has warned about since it began publishing, 17% were cloned again, typically about 18 months later and under a new address.

A regulator's warning tells the public. It does not remove anything. A fake site comes down when someone reports it to the company it was registered through and the company hosting it, with evidence, and keeps following up. The warnings do not say anyone will; in practice it falls to the firm being copied, and a small firm, busy and unsure who to contact, often never does.

Meanwhile the fake keeps working. The warnings describe fakes that use the firm's name and often its real details, and a further 37 of the 139 addresses no longer serve a page but still publish mail records, so a reply to a message sent in the firm's name may still reach whoever set it up.

We read the published warnings on fca.org.uk and sra.org.uk and kept those that name a genuine firm and at least one fake address. On 30 September 2026 we checked each fake address from outside: does it resolve, does it serve a page, and is that page a registrar's parking or for-sale page. We read page text only; nothing was opened in a browser.

The count is deliberately conservative. A fake counts as live only if it served a real page. Addresses that no longer serve a page but still publish mail records are not counted. We left out six rows we could not be sure of: generic domains picked up from the text of a warning, and pages that looked suspended. The true figure is therefore likely higher.

• Check whether the fake address still answers, and whether it has email. A warning from last year does not mean it is gone.
• Tell whoever handles payments, and clients with money in motion, that you never change bank details by email.
• Report the address to the registrar and the host shown in its public registration record, and keep a note of the date. Hosts often act within days; registrars vary.
• Watch for the next one. A firm that has been cloned once is likely to be cloned again.

NameSignal does the watching and the reporting for small firms. Check which lookalikes of your name exist today, free.