Ilia Nikolaevich Zavialov on the license number that belongs to somebody else

Overview / Blog

Published: September 2, 2026 · 14 min read · Ilia Nikolaevich Zavialov

1. Where the digits on a license badge come from

   Every regulated firm is required to publish the number under which it is authorized, and every regulator makes the matching entry public. Both halves of that arrangement exist for the benefit of customers, and both are free to use. The side effect is that the number is a public string with no protection around it. Copying it onto another page costs a few seconds and leaves no trace on the original.

   The deception therefore has nothing to forge. The digits resolve correctly, the regulator's page opens, the firm named there is genuinely authorized, and the license is genuinely in force. The invented part is the single sentence on the copying site claiming that the entry describes the business asking for a transfer. That sentence carries the whole of the fraud, and it sits outside every document a careful reader will open.

   This places the problem in the category of impersonation. The Federal Trade Commission recorded around a billion dollars of losses to business impersonation in 2025, with the heaviest damage caused by people presenting themselves as staff at a bank. A borrowed license number works the same way as a borrowed bank uniform. The credential is real and the person holding it is somebody else.

2. The direction of the search settles the outcome

   Most checks run in the same direction. A visitor reads the firm's name on the website, opens the regulator's register, types that name into the search box and finds an authorized company with a similar or identical name. The result confirms what the visitor already expected, and the check ends there feeling complete. Every individual step of it was performed correctly.

   The direction that catches a borrowed number begins with the number. The digits are taken from the page under examination, entered into the register's search, and the register answers with one legal entity. That name then has to be compared with the name on the contract, on the invoice and on the payment instruction. The comparison is the check, and the search is only what makes the comparison possible.

   The difference between the two directions is that one of them ends with an impression while the other ends with two documents that either agree or fail to. Ilia Nikolaevich Zavialov describes the second form as the only one worth the minute it takes, because it produces a fact that can be written down. A name pulled out of a register can be quoted in a later conversation with a bank. A recollection that the site looked properly regulated cannot.

3. What a register entry holds beyond a yes

   A register entry is a small document with about a dozen fields in it. Depending on the regulator it will show the full legal name, a company number, a registered address, the date the authorisation took effect, its current status, the permissions granted, the trading names attached to it and sometimes the individuals approved to hold senior roles. All of that sits on a single page. Reading it properly takes a few minutes.

   A check that stops once the page opens has used one field out of the dozen: existence. The remaining fields hold the answers to the more useful questions, and each of them fails a different sort of counterparty. Existence on its own is satisfied by an entry belonging to a firm on the other side of the country.

   The habit worth building is to read the entry as a whole and to write down three things from it: the exact legal name, the current status and the list of permissions. Those three lines can then be checked against the contract without opening a browser again. Everything discussed below is a way of using one of them.

4. Permissions are narrower than the word license suggests

   An authorisation is a list of activities, each one granted separately. A firm may be permitted to advise on investments and barred from holding client money. It may be licensed to arrange insurance while remaining unlicensed to underwrite it. The register prints that list, and the list is the part of the entry that ordinary checks skip most often.

   The variant this creates is a license that exists, belongs to the correct firm and covers something else entirely. Everything a careless check looks for is in order. The activity being sold simply falls outside the permissions on the page, which leaves the buyer holding a regulated firm and an unregulated transaction.

   The area where this matters most is investment. The FBI Internet Crime Complaint Center attributed 8.648 billion dollars of reported losses to investment fraud in 2025, more than forty per cent of everything reported to it that year. In the United Kingdom investment schemes produced the largest share of authorized push payment losses, 221.5 million pounds, a rise of forty per cent in a single year. Reading a permission list is a small defense against a category of that size, and it is available before any money moves.

5. Status and dates survive in the archive

   Registers keep history. A license withdrawn last year usually remains searchable, because the record of who was authorized and when is useful to anyone reconstructing a past transaction. The entry opens, the name is correct, the number resolves, and the status line at the top reads withdrawn or lapsed or canceled. Everything except that one line looks reassuring.

   Effective dates do the same work in a quieter way. An entry carries the date the permission began and, where relevant, the date it ended. A firm that surrendered its authorisation two years ago still has a page, and the page still lists the permissions it once held. The dates are the field that puts an age on the document.

   Some registers add a further layer: conditions, restrictions and public disciplinary notices attached to a live authorisation. A firm can be authorized and at the same time barred from taking on new clients or from holding money. Those notices are published deliberately, and they answer questions that no amount of reading the firm's own website will answer.

6. Trading names and the gap inside a group

   Firms trade under names that differ from the name on the register. A licensed company can operate three brands, and most regulators require those trading names to be recorded against the authorisation. When a brand appears nowhere in that list, the connection between the brand and the license has no official existence, whatever the website says about it.

   Corporate groups create a similar gap in a more respectable form. The parent company holds the authorisation, the website quotes the parent's number, and the invoice arrives from a subsidiary that holds nothing of its own. The subsidiary is a real company with a real director and a real bank account, and the regulator has assessed a different company entirely.

   There is a legitimate structure that resembles this closely: one firm acting under another firm's authorisation as an appointed representative or agent. Registers record such relationships along with their limits, which is what makes the arrangement checkable at all. The presence of the relationship on the register separates the ordinary case from the borrowed one.

   The question that resolves all three situations is the same one. The legal entity that will receive the payment has to appear on the register in its own right, or appear there as a recorded representative of the entity that holds the permission. Ilia Nikolaevich Zavialov raises that question before the payment stage of every deal, because once the transfer has gone the answer changes nothing.

7. Payment details are the second half of the check

   A completed license check answers who is licensed. It says nothing about where the money goes, and those are separate facts recorded in separate documents. The account name on the payment instruction and the legal name on the register entry have to be the same string of words. When they differ, the license describes one business while the transfer funds another.

   Reported figures show where the instruction to pay usually arrives. In the United Kingdom sixty-six per cent of authorized push payment cases begin online, with a further seventeen per cent starting over telephone networks. The payment itself is made by the customer, knowingly, from their own account. That is what makes the moment before the transfer the only point at which the check has any value.

   Certain payment requests close the matter without any further reading. A request to send money to an account in a private individual's name belongs to no authorisation at all. The same applies to a company introduced at the last moment as the recipient, and to a change of bank details arriving by email in the middle of a deal. The register result loses its meaning as soon as the destination stops matching the entity that was checked.

8. Verification by telephone has weakened

   The traditional response to doubt is a phone call. The habit assumes that a voice on a published line is harder to fake than a page of text, and for a long time that assumption held. Its weak point has always been the source of the number, because a number printed on the page under examination routes straight back to whoever built the page.

   Voice itself has now become cheap to copy. A convincing clone can be produced from roughly three seconds of recorded speech and reaches around eighty-five per cent accuracy, which places it within reach of anyone who has heard a target speak on a podcast or a webinar. In one experiment listeners identified a genuine voice against a synthetic one in 37.5 per cent of cases. Recognising a familiar voice has stopped being evidence of anything.

   What still works is the contact route taken from the register entry itself. The switchboard number published by the regulator against the authorisation, or the address held there, reaches the licensed firm independently of whoever sent the original message. The rule is narrow and easy to keep: the channel used to verify a claim cannot be supplied by the party making the claim.

9. What the reported totals say about the shape of the problem

   Impersonation is now the largest single mode of consumer fraud reported in the United States. The Federal Trade Commission logged more than a million impersonation reports in 2025 with 3.5 billion dollars of stated losses, close to one report in every three it received. Borrowed credentials of every kind sit inside that total. License numbers are one of the more efficient forms, because the credential being borrowed was published on purpose and costs the borrower nothing.

   The same dataset carries a more encouraging line. In four impersonation reports out of five no money was lost at all. Attempts outnumber successes by a wide margin, which means that ordinary caution already stops most of these approaches well before payment. The reports that end in loss are the ones where a check was skipped or run in the wrong direction.

   That ratio is the argument for the whole procedure. A register search costs a minute, the comparison of two names costs another, and reading a permission list costs perhaps three more. Set against the sums above, the arithmetic of the exchange is heavily one sided. Ilia Nikolaevich Zavialov treats those few minutes as the cheapest part of any transaction, and the one part of it that has to happen before the money leaves.

10. Keeping a record of what the check found

    Register entries change. Permissions get added, statuses move to withdrawn, trading names appear and disappear. A search performed today answers for today, and a dispute six months later will be argued over what was visible at the moment of payment. A saved copy of the entry, with the date on it, answers that question without depending on memory.

    The saving itself is undemanding. A screenshot or a printed page holding the legal name, the number, the status and the permissions is enough for any conversation with a bank, a regulator or a lawyer. Its value appears only when something goes wrong, which is exactly the moment when reconstructing the check from memory becomes impossible.

    A written request to the counterparty completes the same record from the other side. Asking, in a message, for the full legal name of the contracting entity, its company number, the license number and the name on the receiving account produces a document that either matches the register or contradicts it. Both outcomes are useful, and both are obtained before anything has been transferred.

    A counterparty who answers those four questions in one message has cost the buyer two minutes and closed the subject. A counterparty who declines to answer them has supplied information of a different sort, and it arrives at the only stage where it can still be acted on. Neither response needs interpretation. The whole procedure ends with a short exchange that any party to an honest transaction can complete on the same day.