Client.octopus-firm.com: Scam or Legit? FCA Clone Warning, 3 New Domains

Client.octopus-firm.com is a login portal wearing the name of a UK investment manager, and on 30 October 2026 the FCA listed it as a clone of an authorised firm.

We opened the portal, read its code and compared everything with the real firm, and the evidence points to a thin shell built around a borrowed name.

Overview

What You See When You Open the Site

We loaded client.octopus-firm.com and found one page with an octopus logo, email and password boxes, a login button, a forgot password link and an English or French switch.

The page names no company, gives no address, shows no phone number and carries no regulatory text, so a visitor has nothing to check without leaving the page.

What Our Checks Found

The real Octopus Investments sells tax-efficient investments through advisers, but the code behind this portal belongs to a trading platform with deposit and withdrawal functions and a linked trader login.

The domain is four months old, a sister domain was registered 21 minutes later, and the support address printed in the code sits on a domain that cannot receive email.

What We Could and Could Not Verify

Here is where the evidence stands after our checks of the portal, its code, its domains and the genuine firm’s own site:

• Verified by us: the FCA notice, the genuine firm’s contact details, the three domain registrations, the certificate history, the missing mail records and the 8 November rebuild.
• Not found: a company name, an address, a licence number, a sign-up page, or any payment details visible without logging in.
• Not verified: who runs the portal, what a logged-in customer is told to pay, and whether anyone has lost money through it.

Our advice is not to log in, deposit or answer anyone who points you to this portal, and the section on what to do covers anyone who already did.

What the FCA Warning Says

We began with the primary document, the FCA warning about Client.octopus-firm.com, which was first published on 30 October 2026 and had not been updated when we read it.

The notice says the firm is not authorised but has been contacting people while pretending to be an authorised firm, which the regulator calls a clone firm.

It lists the clone’s website as https://client.octopus-firm.com and an email address on a separate domain, octopus-firm.email, in a personal-style name that we have left out of this article.

It then names the genuine firm: Octopus Investments Limited, reference number 194779, based at 33 Holborn, London EC1N 2HT, with the telephone number +4408003162295 and a compliance email.

The FCA adds that this genuine firm has no connection with the clone, and that people dealing with the clone would have no access to the Financial Ombudsman Service.

It also says compensation from the Financial Services Compensation Scheme is unlikely, and that scammers may mix real details with false ones and change them over time.

That last warning shaped our checks, because the clone’s email domain differs from the clone’s website domain, and we wanted to know what each of them actually does.

The Real Octopus Investments Does Something Else

We opened octopusinvestments.com and its contact page, where the head office is 33 Holborn, London EC1N 2HT and investors are told to call 0800 316 2295.

Both details match what the FCA lists for the genuine firm, so the notice and the firm’s own site agree on who the company is.

The home page greets visitors with a question asking whether they are a financial adviser, and the products on show include venture capital trusts and business relief investments.

It also warns that some of its investments are high risk and says the firm does not offer investment, tax or legal advice.

We searched the text of the home page for forex and for a trading platform and found neither, so nothing there describes a trader login or an online trading account.

The firm’s domain was registered on 3 August 2005, which makes it nearly 21 years older than the domain used by the clone.

The genuine site also has its own Log in link in the top bar, which is the only portal a real customer would need.

That matters because a clone only needs to copy a firm’s name to work, and the gap between the two businesses is where a victim is misled.

What a Visitor Sees: A Login Box and Nothing Else

We captured client.octopus-firm.com as any visitor would see it, without typing anything, and it is a login form for an account the visitor is assumed to have.

The logo is a teal octopus illustration, while the genuine firm’s header shows its name in plain lettering, so the clone did not copy the real firm’s logo.

The photograph beside the form shows the lower Manhattan skyline, an odd choice for a firm whose registered address and phone numbers are all in the UK.

We found no register button, no sign-up link and no terms or privacy link on the page, and the footer carries no company name.

Our reading is that accounts are not opened here at all, which means someone must hand each victim a ready-made login by email, phone or chat.

That fits the pattern the FCA describes of contacting people directly, but it is our inference, because we did not log in or contact anyone.

The browser tab title is built from a template that ends with the words Octopus-firm, spelled with a hyphen, which is how the brand is written everywhere in the code.

We found no mention in the code of Octopus Investments, the number 194779, or words such as authorised or regulated, so the site never claims a licence outright.

It borrows the name only, and the credibility comes from whoever introduces the site to the victim.

What the Code Reveals About the Platform

We read the page source as plain text and never ran it, and its size surprised us: the HTML is only 3,913 bytes and loads two script files.

Those files weigh 3.7 MB and 3.3 MB, and the site is an AngularJS application served from Amazon storage behind the CloudFront network.

The brand settings inside the code name the company Octopus-firm, set the support email to an address on octopus-firm.com, and point every logo and background to a single storage bucket.

That bucket’s name and the style folder both carry the word quantx, which looks like a ready-made portal template label, though we could not identify who sells it.

The settings also describe a web trader called Octopus-firm Trader, which sits on a separate domain, trading.octps-web.com, and which we captured as a second login page.

That second page is titled Trading platform, tells search engines not to index it, and shows market clocks for London, Tokyo and New York above four exchange bars.

It loads its styling and scripts from a third-party content network and, like the first page, shows no company name, only a copyright line.

A market-hours panel sells the idea of live trading, which has nothing in common with the venture capital trusts and business relief products the real firm offers.

We looked for the buyer’s money path and found tools for it in the code, though nothing visible to a visitor who is not logged in.

A deposit function opens a hosted checkout page on evirtualpay.com, and a separate routine redirects to a cashier page on praxispay.com.

Those are payment gateways that many merchants use, so their presence says that card deposits are built in, not that the providers know about this site.

The code also links to a third-party trading app, a chat widget and a WhatsApp button, and it sends requests to an API host at apife.octopus-firm.com.

We could not log in, so we cannot say what a customer is told to deposit, to whom, or what the screens look like after signing in.

We also read the files’ timestamps, and the server stamps both script files and the page itself with 8 November 2026 at 05:42 GMT.

That is nine days after the FCA published its warning, so the files were rebuilt or redeployed after the notice, and the site was still online on 11 November.

The logo image has an older stamp, 11 August 2026, which suggests the branding was prepared weeks before the site was last refreshed.

Three Domains in Three Months

We looked up the registration of each domain involved, and the dates show a setup assembled over a summer and then maintained long after the FCA notice.

The domain octopus-firm.com was registered on 1 July 2026 at 14:06 GMT through the registrar Tucows, which made it 121 days old when the FCA published its warning.

The domain octps-web.com, the home of the trader login, was registered through the same registrar on the same day at 14:28 GMT, only 21 minutes after the first.

Both use the same pair of Cloudflare name servers, named jim and lindsey, which shows a common setup but is not proof of common ownership.

The certificate logs fit the same story: wildcard certificates for both domains were issued on 13 July, minutes apart, and renewed again in September.

The portal itself serves an Amazon certificate valid from 13 July 2026 to 26 January 2027, covering every subdomain of octopus-firm.com.

A wildcard certificate hides any other subdomains from the public logs, so we cannot rule out that further portals exist on the same domain.

The third domain is octopus-firm.email, the one in the FCA notice, which was registered on 19 August 2026 through a different registrar, Namecheap, for two years.

That made it 72 days old when the FCA published its warning, and its record was last changed on 24 August.

The different registrar means we cannot tie this domain to the first two by registration alone, so we treat the link as likely but unproven.

The bare domain octopus-firm.com does not load at all, because it has no address record, and the Internet Archive’s availability check returned no saved copy of the portal.

The genuine firm’s domain dates from 2005, so every clone domain arrived about 21 years after it and within one summer of one another.

The Support Address That Cannot Receive Mail

We queried the mail records of each domain, because the code names support@octopus-firm.com as the portal’s contact and a customer would try it first.

From our server, octopus-firm.com has no mail exchange record, no address record and no text records, so mail sent to that support address has nowhere to go.

The octopus-firm.email domain is set up very differently: it routes mail through Google’s mail servers and publishes a matching sender policy, which means it can send and receive.

The FCA’s notice lists the working address on the .email domain, which suggests the operators did their talking from the domain that works.

The practical effect is a trap: mail to the support address in the code cannot be delivered, while mail to the address the FCA lists can.

We read this as a sign of a quickly built setup in which the portal’s own contact details were never made to work.

Who Runs Client.octopus-firm.com?

The Only Company Named Is the Real One

The only company named in any document we read is Octopus Investments Limited, and the FCA states plainly that it has no connection with the clone.

The portal and the trader login name no operator, no legal entity and no officer, and their footers carry no company name or registration number.

Where the Address and Registration Leads Stop

We found no address on either portal, so there was nothing to trace beyond the genuine firm’s Holborn office, which belongs to the real company.

We searched the Companies House register for octopus-firm and it returned no results, so no UK company appears under that name.

The Domains, the Template and the Hosting

The domains are anonymous in the public record, with a registrar, dates and name servers but no named registrant, and the portal sits on Amazon storage.

Shared name servers and registration times link two of the domains in setup, and the template, the payment gateways and the hosting are all generic services open to anyone.

What We Could Not Confirm

We could not establish who runs the portal, who sends people to it, what happens after login, or whether anyone has lost money.

We did not log in, email, call or use any form, and we did not follow the payment links, so everything about deposits comes from reading the code.

How to Check an FCA Firm Yourself

The FCA’s Firm Checker shows whether a firm is authorised and what permissions it holds, and it is the first place to look before dealing with any UK firm.

Searching it takes a minute, and a firm that does not appear there should be treated as unauthorised until it proves otherwise.

The FCA’s guidance on using the Financial Services Register adds the check that catches clones: compare the contact details you were given with those on the register.

The genuine firm’s number is 0800 316 2295 and its address is 33 Holborn, while the clone offers only a login page and an email on another domain.

If a contact insists on a different phone number or email, or on a link to a portal, stop and phone the number from the register instead.

What to Do If You Logged In or Paid

1. Stop using the portal. Do not log in again, do not open the trader login, and do not follow instructions from the person who sent you to it.

2. Verify the real firm. Look up Octopus Investments Limited, FRN 194779, in the FCA Firm Checker and use only the phone number listed there.

3. Send no money. Refuse every request for a deposit, a fee, a tax payment or a release charge, however official the reason sounds.

4. Keep every record. Save emails with full headers, chat logs, call dates, screenshots of the portal and the dates and amounts of any payment.

5. Report it. Use the FCA page for reporting unauthorised firms, call Report Fraud on 0300 123 2040, and the FCA on 0800 111 6768.

6. Call your bank or card provider. If you paid by card or transfer, ask at once about a chargeback or a recall and give them the records you saved.

7. Secure your accounts. Treat any email and password you typed into the portal as exposed, change them wherever you reused them and turn on two-factor authentication.

8. Ignore recovery offers. Anyone who contacts you promising to get your money back for an upfront fee is usually running a second scam.

Frequently Asked Questions

Is Client.octopus-firm.com legit?

No. The FCA lists it as a clone of an authorised firm, and we found no company, address or licence on the site and no way to register.

Is Octopus Investments connected to client.octopus-firm.com?

The FCA states the genuine Octopus Investments Limited has no connection with the clone, and we found nothing on the genuine firm’s own site that points to it.

Is Client.octopus-firm.com authorised by the FCA?

No. The FCA says the firm is not authorised, so you would have no access to the Financial Ombudsman Service and compensation from the FSCS is unlikely.

Can I trust an email from octopus-firm.email?

No. The FCA lists an address on that domain as a clone detail, and the domain was registered on 19 August 2026, nearly 21 years after the real firm’s domain.

What if I logged in but did not deposit anything?

Change any password you reused, turn on two-factor authentication, avoid every later contact from the person who sent you, and watch your accounts and inbox for new approaches.

How do I check an FCA firm’s contact details?

Search the firm in the FCA Firm Checker or Register, compare its phone, address and email with what you were given, and use only the register’s number if anything differs.

The Bottom Line

Do not use client.octopus-firm.com or trading.octps-web.com. The FCA lists the portal as a clone, and we found no named company or licence, only a rebuild after the warning.

If you want to invest with the real Octopus Investments, find the firm in the FCA Firm Checker, phone the number on the register and ask for written terms first.

If you already logged in or paid, stop all contact, keep your records, ask your bank about a recall, change reused passwords and report the site to the FCA.