Multiple Regulators Flag Coordinated Email Scam Using Fake Regulator Identities and “CLIOPOST eFAX Delivery”

Multiple financial regulators across different jurisdictions have warned about a coordinated email scam that impersonates regulatory authorities and their staff, using fabricated email domains and third-party delivery tools to deceive recipients. Recent alerts from regulators in Mauritius, Gibraltar and Jersey point to a shared method rather than isolated incidents.

The scam involves emails falsely claiming to originate from financial regulators or their employees, often referencing compliance issues, internal reviews or regulatory documents. In several cases, the messages direct recipients to access files allegedly delivered via “CLIOPOST eFAX Delivery” or similarly branded services. The emails use addresses that closely resemble official regulator domains but include additional routing elements, such as extended domain chains, to mask their true origin.

Authorities confirmed that these emails were not issued by them and that the domains used have no legitimate connection to the regulators being impersonated. Some messages falsely carried the names of senior officials, regulator logos, or reference numbers belonging to legitimate firms, increasing their apparent credibility. The purpose of the communications ranged from harvesting sensitive information to prompting recipients to click links or open attachments that could enable further fraud or malware activity.

Although the warnings were issued independently, the technical similarities are consistent across jurisdictions. These include near-identical domain construction, the repeated use of CLIOPOST-branded eFAX delivery language, and claims that documents must be accessed urgently through external links. Regulators noted that this approach is designed to exploit familiarity with formal regulatory correspondence, particularly among businesses and regulated entities.

The pattern reflects a broader shift in financial fraud tactics. Rather than promoting investment opportunities, scammers increasingly pose as supervisory authorities, leveraging trust in regulatory institutions to lower suspicion. By framing communications as routine regulatory matters and using document-delivery branding, the scam blends into normal compliance workflows.

Read more:

DFSA Alerts Public to Fake Notice Impersonating Regulator and Chief Executive

Canadian Securities Administrators Warns of Spear Phishing Threat Involving Email Impersonation

Four Malaysians to Face Court Over Government Official Impersonation Scams Targeting Singaporeans