When the Fake Version of Your Firm Ranks Better Than You Do

The FCA has flagged 48 cloned insurance intermediaries in a decade. Most of the coverage treats that as a fraud story. It is worth reading as something else first: a test of whether the genuine firm is verifiable online at all.

What the FCA data actually says

In July 2026, Insurance Age published figures obtained from the FCA under the Freedom of Information Act. Over the previous ten years the regulator issued 104 warnings relating to insurance firms. Of those, 48 concerned cloned personal and commercial lines intermediaries, so brokers accounted for close to half the total. Annual warning volumes across all insurance firms varied from three to nineteen.

Two things are worth holding on to. The absolute numbers are modest. Forty-eight over a decade, across a market of thousands of authorised intermediaries, is not an epidemic, and anyone framing it as a wave of fake brokers is stretching it.

But these are published warnings, not attempts. A warning appears only after someone reports the clone, the FCA looks at it, and the entry goes onto the warning list. The volume of impersonation attempts sits somewhere above the number that reach that stage.

The mechanics are consistent. A clone borrows a real firm's name, its FRN, sometimes its registered address, and attaches them to a new domain, phone number and bank account. Every detail a cautious buyer might check against the Financial Services Register is accurate, because it was copied from a firm that is genuinely authorised.

Trade coverage has observed that some cloned sites look more polished than the originals. That is a characterisation rather than a measured finding, so treat it as an observation. It is still worth sitting with, for a reason that has very little to do with fraud.

Why a clone can outrank the real firm

A clone site is built for one job. It is new, it is fast, its pages are written directly against the queries a worried buyer types, and nothing on it is legacy.

Plenty of genuine broker and claims firm websites are the opposite. They have grown by accretion over eight or ten years. The about page says "established 2004, committed to service" and names nobody. The FRN sits in eight point grey in the footer, or inside a PDF. There is no structured data. The address on the site, at Companies House and on the Google Business Profile are three different versions of the same place.

Search engines do not adjudicate authenticity. They assemble a results page from signals: relevance, structure, links, consistency, history. Domain age and established link profiles genuinely help the incumbent, and a clone rarely displaces a well-established firm for its own brand name.

The competition happens further down, on the verification queries. "Is [firm] genuine." "[Firm] contact number." "[Firm] reviews." Those are the searches a buyer runs at the moment they are deciding whether to send money. A firm whose own answers to those questions are thin or scattered leaves the field open.

It is the same underlying issue as being invisible to AI search . Impersonation does not create the weakness. It reveals one that was already there.

What changes when the buyer asks an AI engine instead of Google

AI search engines have no brand memory and no local intuition. They do not know that a firm has been on the same industrial estate in Cheshire since 2003, or that everyone in the region knows the founder.

They construct an answer from what they can retrieve, parse and corroborate. That puts the weight on three things:

• Whether identity details are stated in machine-readable form, not just as page text
• Whether the same name, address and phone number appear consistently across independent sources
• Whether anything outside the firm's own website confirms that the firm exists as described

Google has been explicit that the underlying work is not a separate discipline. The signals that make a firm easy for an AI engine to describe accurately are the signals that make it easy to rank, and increasingly the same ones that make it easy for a human to verify. Trust is becoming a ranking input in its own right .

The six identity signals worth getting right this month

None of this is exotic. Most of it is a fortnight of unglamorous work.

1. Authorisation stated plainly. Firm name, FRN and regulatory status in readable text, matching the Financial Services Register entry exactly, including trading names.
2. One consistent set of details everywhere. Name, address and phone number identical on the website, Companies House, the Register, the Google Business Profile and any trade directories. Mismatches are the most common weakness I find, and the cheapest to fix.
3. Organisation structured data. Schema markup carrying legal name, company number, FRN, address, telephone and links to verified profiles elsewhere. This is how a machine reads identity rather than infers it.
4. A real about page. Named people, actual roles, when the firm started, who owns it. A clone can copy a page of adjectives. Sustaining a page of specific, checkable people is harder.
5. Independent corroboration. Trade body membership, panel listings, review platforms, local press, industry directories. Anything published somewhere the firm does not control.
6. One canonical domain. A single primary site, properly redirected, with old campaign microsites folded in or retired. Every orphaned domain is one more thing a buyer cannot easily distinguish from a fake.

What to do if you find a clone of your firm

The practical steps, in the order that matters:

• Capture evidence first. Screenshots, URLs, dates, and the WHOIS record if it is public. Clone sites disappear quickly once challenged.
• Report it to the FCA through its unauthorised firm reporting route, and separately to the hosting provider and domain registrar.
• Notify your professional indemnity insurer, and tell your insurer partners and panel contacts directly.
• Publish a short, indexable page setting out your official domains, phone numbers, FRN and payment process, with a plain statement of what you will never ask a client to do. That gives search and AI engines a canonical source to point at, and gives your team something to send.
• Brief the front line. The people answering the phone meet the confused customer first.

What does not work on its own is chasing the clone off the internet and stopping there. Registering a new domain takes ten minutes. Being the most clearly verifiable version of your own firm is the part that holds.

The wider point: trust signals and ranking signals are now the same job

For a long time, "prove you are legitimate" and "rank well" were separate workstreams. Compliance handled the first. Marketing handled the second. That separation has quietly stopped making sense. The evidence a buyer wants, the evidence Google weighs and the evidence an AI engine needs have converged on the same short list: verifiable identity, structured and consistent detail, independent corroboration.

Clone firms are a small problem in absolute numbers. They are a useful diagnostic, because they ask a question worth answering regardless: if someone put a well-built fake alongside your real firm, would the difference be obvious to a machine?

For most firms, the honest answer is that it would take some work. Optimus runs AI visibility audits that cover exactly this ground, so that recommendation is not neutral and I would rather say so. The six signals above are all checkable without us, and worth checking either way.