A Firm's Name in an Email Proves Nothing on Its Own
Anyone can type a firm's name into an email, copy its logo and add its Firm Reference Number to the signature. None of these details shows who actually sent the message, which is why clone firms rely on them so heavily.
What matters is the address the email came from, and in particular the domain: the part after the @ sign.
Compare the Domain With the Firm's Own Website
Search the FCA Register for the firm and note the website on its entry. A genuine email from that firm will normally come from the same domain, or from one the firm itself publishes.
Read the domain slowly, letter by letter. In October 2026 the FCA warned that fraudsters were using email addresses ending in callassists.com to pose as Call Assist Limited, whose own website is call-assist.co.uk. The difference is a missing hyphen, one extra letter and a different ending, and all three are easy to miss at a glance.
Free Mailboxes and Changing Addresses Are Warning Signs
A regulated firm is unlikely to deal with its clients through a free personal mailbox such as Gmail, Outlook or Yahoo. An email that moves you from one address to another partway through a conversation deserves the same caution.
Look at the reply address as well as the sender. Pressing reply can send your answer to an address that differs from the one shown at the top of the message.
Use the Firm's Own Contact Details, Never Those in the Email
Links, telephone numbers and attachments in a suspicious email can all lead back to the sender. Find the firm's number on the FCA Register, call the firm and ask whether the email came from them.
Take particular care with any email that changes payment details. Before transferring money, use your bank's Confirmation of Payee check to confirm that the account is held in the exact name of the firm you expect to pay.
Report Suspicious Emails
You can forward a suspicious email to report@phishing.gov.uk, the National Cyber Security Centre's reporting service. If the sender is pretending to be an authorised firm, report the approach to the FCA on 0800 111 6768 as well.
How MetaAshes Examines This
A MetaAshes assessment cross-references a firm's details against the official record in a single pass. For this question, the most relevant checks include:
- Email domain consistency
- Official website on record
- Official telephone number on record
- Domain registration age
- Live website presence
- FCA Warning List screening
- Authenticity of representatives
- Payee name verification
Frequently Asked
How can I tell if an email is from a genuine firm?
Compare the domain after the @ sign with the website on the firm's FCA Register entry, then confirm by calling the telephone number the Register shows.
Where do I report a suspicious email?
Forward it to report@phishing.gov.uk. If the sender is pretending to be an authorised firm, also report the approach to the FCA on 0800 111 6768.
Can MetaAshes check an email address?
Yes. An assessment compares the email address you were given with the firm's official website and record, alongside the other details of the approach.
This guide is provided for general information and does not constitute financial or legal advice.