Norway FSA Republishes French AMF Warning on Impersonation Site pgroup-user.com

Key Takeaways

• Finanstilsynet (Norway FSA) has published a warning about the website pgroup-user.com, which was originally flagged by France's Autorité des marchés financiers (AMF) on its blacklist of usurpation (impersonation) sites.
• Compliance teams should treat the domain as a likely fraud vector and add it to monitoring and blocking controls.
• The notice also shows how European regulators share investor-alert information across borders.

Deep Dive

Finanstilsynet (Norway FSA) has published a warning about the website pgroup-user.com, which was originally flagged by France's Autorité des marchés financiers (AMF) on its blacklist of usurpation (impersonation) sites. Compliance teams should treat the domain as a likely fraud vector and add it to monitoring and blocking controls. The notice also shows how European regulators share investor-alert information across borders.

For compliance teams, the notice creates no new regulatory obligation, requirement, or deadline. Its value is as threat intelligence. Impersonation sites are commonly used for investment fraud, phishing, credential harvesting, and authorized push payment scams. Customers, employees, and counterparties could be targeted, and payments or data could be sent to the site's operators. Institutions with exposure to Norwegian or French clients, or to the EEA more broadly, should treat the warning as relevant.

Recommended actions include:
- Add pgroup-user.com to web filtering, email security, and brand-protection blocklists.
- Search transaction monitoring and customer communications for references to the domain, and for payments to related beneficiaries.
- Review the AMF page to identify the impersonated entity, any related domains, and any associated contact details.
- Where customers may be affected, consider updating fraud-awareness messaging and preparing frontline scripts.
- Escalate any confirmed hits to the fraud and financial crime teams, and evaluate whether a suspicious activity or transaction report is required.

The risk impact is moderate and mainly concerns fraud, customer harm, and reputation. Where the impersonated entity is connected to your organization, the risk is higher, and takedown requests and regulator notification may be warranted. Because the entry has been republished across jurisdictions, similar warnings from other European authorities may follow. Teams should therefore keep regulator warning lists as a regular input to fraud and financial crime intelligence feeds.

Source: Norway Financial Supervisory Authority