Eight SRA alerts: verify the route offered to prove an identity

The brief

We identified eight distinct SRA alerts dated 13–19 October, linked individually below. One describes a purported verification website used alongside recovery correspondence. Separately, a 16 October Hong Kong warning describes a fake FPS-related site requesting identity and account information. SRA archive. Hong Kong warning.

Our conclusion is to verify the route offered for verification itself. A link supplied by the questionable sender cannot independently establish that sender’s authority. Start from a contact route established separately, then check the precise instruction, document request or payment. The eight is a count of SRA warning pages found during this scan, not victims or unique scams. The Hong Kong example is separate and is not added to that total.

The full record

The register below records each SRA warning once by its displayed publication date. Names identify identities or purported entities discussed in the warnings; they are not allegations against the genuine firms or professionals whose details were misused.

The eight linked warnings

19 October — Forsters. Documents and WhatsApp messages misused genuine professional details in an alleged investment-fund release. Read the SRA warning.

19 October — Duncan Lewis. Immigration communications included a purported authority letter and a payment request. Read the SRA warning.

16 October — City Law and Shane Ravson. A cloned website and a purported transfer deed misused the genuine firm’s and solicitor’s details. Read the SRA warning.

16 October — Purported Grey Oak Chambers. Inheritance correspondence misused a genuine solicitor’s name and SRA number. Read the SRA warning.

15 October — LWPC. A cloned identity was used in supposed crypto-account assistance and verification requests. Read the SRA warning.

14 October — Janes. Recovery documents were accompanied by a purported professional-verification site claiming regulator and Law Society connections. Read the SRA warning.

13 October — Greene & Greene. Agreements and a purported notarisation misused genuine identities. Read the SRA warning.

13 October — Osmans. Conveyancing emails used a lookalike sender identity. Read the SRA warning.

A separate Hong Kong example

HKICL’s 16 October warning describes a fraudulent FPS-related refund and support site that sought identity documents and bank details. It explains that HKICL does not directly provide FPS services to individual members of the public and does not normally contact them proactively. Read the official warning hosted by HKMA.

Our analysis: check the checker

A verification step only helps if its origin is independent of the request being checked. A sender can provide a professional name, a registration number and a convincing route to “confirm” them. Treat those as claims to investigate, rather than as three independent confirmations.

For a request affecting a live matter, use contact details already established with the genuine organisation or obtain them through an independently located official route. Ask whether the specific message and requested act are authorised. Confirming that the professional exists leaves that second question unanswered.

Record how the contact route was established, who answered and which instruction was confirmed. Keep an unresolved answer visible. If the requested payee, document destination or purpose later changes, review that change rather than relying on the previous confirmation.

Separate the warning count from the risk conclusion

This register supports a precise account of what we found in one regulator’s publications. It does not tell us how many people received the messages, whether the examples share perpetrators or how many losses occurred. The Hong Kong example offers a comparison of the request being made, not a basis for a combined international total.

A useful next test for a professional firm is to give a colleague a fictional request containing a supplied verification link. Observe whether they establish a separate route and obtain an answer about the actual instruction. We have not run that exercise as a benchmark and make no prevention claim for a product.

Eight unique SRA warning URLs dated 13–19 October 2026 were read individually on 19 October. Cutoff: 19 October, 21:45 UTC for the compiled warning set. Count uses publication dates, not incident dates or page discovery times. HKICL’s 16 October warning is a separate example. This is not an exhaustive worldwide count. Malicious domains are not linked.

1. SRA: Forsters, 2026-10-19
2. SRA: Duncan Lewis, 2026-10-19
3. SRA: City Law and Shane Ravson, 2026-10-16
4. SRA: Purported Grey Oak Chambers, 2026-10-16
5. SRA: LWPC, 2026-10-15
6. SRA: Janes, 2026-10-14
7. SRA: Greene & Greene, 2026-10-13
8. SRA: Osmans, 2026-10-13
9. HKICL via HKMA: fraudulent FPS-related website, 16 October 2026