Impersonation alerts: verify the action behind the promise
UK, Dubai, Hong Kong and Swiss warnings show why checking the sender, current status and requested action matters before sharing data or approving payments.
The brief
Dubai’s regulator warns about fabricated cryptocurrency-recovery documents. Hong Kong’s monetary authority rejects a supposed e-HKD loan scheme, while Switzerland’s NCSC describes hotel-refund messages designed to obtain banking access. DFSA warning. HKMA warning. NCSC analysis.
Our analysis identifies a shared decision point: a promise to return or provide money is used to justify a different action by the recipient. Before supplying information, approving access or transferring funds, establish what that action actually does and verify the request independently. The sources concern different jurisdictions and reporting systems; we do not combine them into a global scam count. For professional advisers, the useful exercise is to review the requested action separately from the reassuring story used to introduce it.
The full record
The non-UK warnings below were published between 19 and 26 October; they are selected examples, not a complete count. A separately labelled UK catch-up follows.
Three different promises
The DFSA’s 20 October warning describes fabricated investigation documents claiming that cryptocurrency has been recovered. They direct recipients to unofficial contact routes. The regulator says such claims should be verified through its official channels. DFSA cryptocurrency-recovery warning.
On 26 October, HKMA warned of a loan scheme falsely linked to e-HKD, including agreements claiming loans would become digital Hong Kong dollar assets. It says its pilot and sandbox programmes do not solicit public funding or offer associated investment products. HKMA e-HKD warning.
The NCSC’s 20 October account describes hotel-booking messages promising cashback. The process leads to imitation banking pages and attempts to obtain authentication approval. Detailed booking knowledge can make the request convincing without making it genuine. NCSC hotel-booking phishing analysis.
Check the claimed institution’s role
HKICL’s 22 October warning describes fake payment-support sites seeking identity information and banking details. It says it does not directly provide FPS services to individual members of the public. HKICL warning hosted by HKMA.
A separate DFSA alert concerns false current-regulation claims using Adaa’s former identity. The genuine firm’s licence was withdrawn in 2017 and the company dissolved in 2019. Historical credentials require a current-status check. DFSA Adaa warning, 20 October.
UK catch-up: a genuine firm’s identity is not proof of the sender
We also read six FCA clone warnings dated 6–21 October; five of the six predate 20 October. Each warning distinguishes the impersonation from an unconnected genuine firm:
- GoTempCover Limited: FCA clone warning, 21 October 2026.
- callassists.com: FCA clone warning, 16 October 2026.
- claimmydisrepair.co.uk: FCA clone warning, 16 October 2026.
- quorumcapitalltd.com: FCA clone warning, 14 October 2026.
- Coinhub.pro: FCA clone warning, 12 October 2026.
- VFM Leasing: FCA clone warning, 6 October 2026.
Our practical conclusion is to verify both the firm’s status and the route through which the instruction arrived. A matching name or registration entry cannot, by itself, authenticate an email address, website or payment request. This catch-up list is selected coverage; it is not a complete count of FCA warnings.
Our analysis: describe the action before approving it
For a fictional refund request, ask the recipient to state what the next screen or message is asking them to authorise. Receiving a payment, signing an agreement, changing an account’s contact details and approving a login have different consequences. The reassuring reason given in the message should not replace that description.
If the recipient cannot reconcile the requested action with the promised result, stop the exercise at that point and establish an independent route to the genuine organisation. Do not use the suspicious message as the source of the verification channel.
Authentication strength is a procurement question too
The NCSC’s 19 October technology brief describes authentication categories that consider resistance to real-time phishing. It explicitly says the classification is not a formal testing or certification basis. NCSC authentication brief.
Our proposed supplier test is to show what an approval prompt tells the user about the action being authorised. Include an attempt to redirect the user from a legitimate task into an unrelated account action. Record the demonstrated result and its limitations; do not turn a classification label into a security guarantee.
Keep a useful account of the intervention
When a client brings a suspicious request to an adviser, retain the request, the action it sought and the independent verification outcome. Limit circulation of sensitive attachments. The next colleague should be able to see why the request was stopped or referred, rather than having to repeat the client’s story from the beginning.
Related reading: This week’s SRA alerts.
Read DFSA warnings dated 20 October; HKICL’s 22 October notice on HKMA’s site; HKMA’s 26 October e-HKD warning; and NCSC publications dated 19 and 20 October 2026. Also read six original FCA clone warnings dated 6–21 October as a separately labelled catch-up. This is a selected cross-jurisdiction analysis, not an exhaustive alert register or loss estimate. Proposed exercises were not performed.
- DFSA: cryptocurrency-recovery impersonation, 20 October
- DFSA: false Adaa regulation claims, 20 October
- HKMA: fraudulent e-HKD loan scheme, 26 October
- HKICL: fraudulent payment websites, 22 October
- NCSC: hotel-booking phishing, 20 October
- NCSC: authentication categories, 19 October
- FCA: GoTempCover Limited clone warning, 21 October 2026
- FCA: callassists.com clone warning, 16 October 2026
- FCA: claimmydisrepair.co.uk clone warning, 16 October 2026
- FCA: quorumcapitalltd.com clone warning, 14 October 2026
- FCA: Coinhub.pro clone warning, 12 October 2026
- FCA: VFM Leasing clone warning, 6 October 2026