CARFIS: Scam Warning, Reviews and Recovery Guide

Issued by: Ontario Securities Commission (OSC) · Date: 2026-01-12 · Region: Ontario

Reviewed by: William Galipeau · Last updated: 2026-09-11

Also known as: carfis.org, CRFIS.com, CA-RFIS.com, ca-rfis.com, crfis.com, CARFIS

Overview: Is CARFIS Legit?

If a trading platform told you it was licensed by CARFIS, you were shown a credential from a body that does not regulate anything. The Ontario Securities Commission (OSC) published an investor alert on January 12, 2026 naming CARFIS at carfis.org, along with the parallel spellings CRFIS.com and CA-RFIS.com, and confirmed it is not registered in Ontario to engage in the business of trading in securities.

What makes this alert worth its own page is the order in which the OSC acted. Eighteen days later, on January 30, 2026, the commission published a long batch of warnings against individual trading platforms, and several of those platforms were recorded operating pages that carried the CARFIS name. Capital Altrion was flagged at carfis.capitalaltrion.com. Delta Wealth Ltd. was flagged at CA-RFIS.delta-wealth-ltd.com. Lexium Limited was recorded serving a PDF from its own website whose filename described it as a Carfis licence.

So the regulator dealt with the credential before it dealt with the firms relying on it. That sequence tells you what CARFIS actually is. It is not a broker that took deposits. It is the paperwork layer, the thing produced when a prospective investor gets cautious and asks who oversees the platform, and it was doing that job for more than one operation at a time.

The six letters are not accidental either. Canadian financial oversight is a thicket of initials, and a reader who cannot immediately place CARFIS or CA-RFIS among them has been put in exactly the position the name was built to create. The instinct in that moment is to assume the gap is in your own knowledge rather than in the acronym. CARFIS is designed to be granted the benefit of that doubt.

It is worth being clear about what a licence from this body was actually worth to the person holding it. Nothing at all. There was no register anyone could be struck from, no capital requirement, no obligation to keep client money separate from the operator's own, no inspection, no complaints process and no compensation arrangement. The certificate performed a single function, which was to end a conversation at the moment a prospective investor asked the right question.

None of this means the platform that has your money is beyond reach. It means the licence is not the thread to pull. Report to RecoverFunds.ca if you have dealt with CARFIS or with any platform that produced a CARFIS licence, and bring the platform's name with you.

How CARFIS Operates

Six letters engineered to be plausible

Start with the name, because the name is the product. CARFIS carries no meaning of its own. It is a sequence assembled to occupy the same mental shelf as the abbreviations Canadians associate with financial oversight, and it works by resemblance rather than by imitation of any particular one.

The alternate spelling makes the intent clearer. CA-RFIS splits the letters so that CA reads as a country code and RFIS reads as the body, in the pattern of a national office of some larger organisation. Nothing of the sort exists. But the shape is right, and shape is what most people check when a plausible-looking credential appears on a screen at the point in the conversation where money is about to move.

Compare this with how a genuine authority behaves. Real regulators are aggressive about their identity. They do not tolerate variant spellings, they publish under one name, and they spend real effort making sure the public can find them, because an authority nobody can locate cannot protect anybody. Multiple spellings are a liability to an institution and an asset to a fabrication.

Three addresses, and why there are three

The OSC recorded CARFIS at carfis.org, CRFIS.com and CA-RFIS.com. Three domains for one supposed body is redundant unless the redundancy is the point, and here it serves two purposes.

It covers approach routes. A licence number quoted over a phone call, a certificate in a PDF and a link on a website can each carry a different address, so a victim comparing what they were told with what they were shown finds everything consistent. And it survives disruption. If one domain is suspended after a complaint, the credential does not vanish, because two more still resolve and the certificates can point at those instead.

The choice of .org for the primary address deserves its own mention. That suffix has no legal restriction on who may register it, and has not for many years, but it retains a strong association with institutions, standards bodies and non-profits rather than with commercial operators. Picking .org over .com for a supposed regulator is a small, cheap signal aimed at a reader who is skimming, and it is a favourite in this category of fraud for exactly that reason.

How it reached the investor

On the evidence in the OSC's own alerts, CARFIS did not usually arrive as an independent website that someone visited. It arrived embedded in the platform.

When the commission listed the web addresses associated with Capital Altrion, one of them was carfis.capitalaltrion.com. For Delta Wealth Ltd., one was CA-RFIS.delta-wealth-ltd.com. Those are subdomains, which is to say sections of the platforms' own websites, run on infrastructure the platform operators control. Whoever runs the broker decides what appears on that page, updates it, and takes it down.

That arrangement inverts the thing it imitates. Registration works because the register is kept somewhere the registered firm cannot reach. Any firm able to write its own entry can write whatever it likes, which is why an oversight page served from the broker's own domain carries no information at all about the broker. The comfort it produces is real. The verification is not.

The Lexium Limited alert shows the same idea in file form, with a document hosted on Lexium's own site under a name identifying it as a Carfis licence. Once a certificate is a downloadable file, it travels. It gets forwarded to a partner, shown to an adult child, attached to an email as proof. Each retelling strips away a little more context, and by the third or fourth the document has become simply the licence, with no memory of the fact that it came from the same website as the sales pitch.

Not the only invented authority in the batch

CARFIS was one of at least two supervisory fictions operating across the same set of platforms. FINAEU, which the OSC flagged on January 30, 2026, appeared under seven spellings and turned up as a subdomain on a longer list of flagged sites. Some platforms carried both. Capital Altrion was recorded with a carfis address and a finaeu address on the same website.

Two separate authorities vouching for one small platform reads, to a hurried person, as a lot of oversight. Considered for a moment longer it makes no sense at all. Real regulation is jurisdictional. A firm is authorised by the regulator where its clients live, and stacking credentials from unrelated bodies is not how legitimate authorisation is described. The stacking happens because each certificate is cheap to produce and because more of them tests better on people who are already inclined to believe.

Alongside the invented names, the same batch contained borrowed ones. Addresses beginning cad-finra were recorded on flagged platforms including Glencore Trade. FINRA is a genuine United States regulator that has never had a Canadian division, and the cad prefix manufactures one.

What the OSC has said about the pattern

The commission has addressed this as a growing method rather than a handful of cases. In a public statement on March 19, 2026 it warned that fraudulent platforms are being built with fabricated credentials and licensing numbers that point to fictitious Canadian or international regulators, and noted that some schemes go as far as misusing the OSC's own branding. The statement also set out what the OSC never does: it does not solicit payments, does not promote investments, does not make unsolicited contact about money, and does not offer to recover lost funds.

The limits of what is known

The OSC alert establishes that CARFIS is unregistered in Ontario. It does not say who operates the three domains, where they are run from, or what the relationship is between CARFIS and the platforms that displayed its name. Whether a single group runs both, or the certificate was sold as a service to unconnected operators, is not on the public record, and there is no honest way to assert either. What can be said with confidence is narrower and sufficient: no licence issued under this name has ever conferred any protection on anyone.

Red Flags in CARFIS Reviews

  • Named in an Ontario Securities Commission investor alert on January 12, 2026, not registered in Ontario to trade in securities
  • Operates from three separate domains, carfis.org, CRFIS.com and CA-RFIS.com, for a single supposed authority
  • The acronym is built to resemble Canadian financial regulator initials without matching any real body
  • Appeared as subdomains of the trading platforms it claimed to license, including carfis.capitalaltrion.com and CA-RFIS.delta-wealth-ltd.com
  • A licence PDF carrying the Carfis name was served from Lexium Limited's own website rather than from any register
  • Uses a .org address, which carries institutional associations but is open to anyone to register
  • Several platforms displayed CARFIS and FINAEU credentials at the same time, which is not how genuine authorisation works
  • Flagged by the OSC eighteen days before the platforms relying on it were flagged, indicating a shared credential rather than one firm
  • No CARFIS registration can be verified on any official register in Canada or elsewhere
  • The OSC warned on March 19, 2026 about fabricated licensing numbers pointing to fictitious regulators

What the Regulator Said

CARFIS found at https://carfis.org, CRFIS.com and CA-RFIS.com is not registered in Ontario to engage in the business of trading in securities.

Official regulator source

What to Do if You Were Targeted by CARFIS

  1. Report to RecoverFunds.ca at recoverfunds.ca/report-crypto-fraud-canada. The licence is a dead end but the platform behind it is not, and the free case review starts by separating the two. Bring the name of the platform, the CARFIS number or certificate you were given, and the address the verification page sat at. We will match the platform against the OSC alerts published in January 2026, tell you which regulator your file belongs with for your province, and give you a frank read on what can realistically be pursued given your payment method, because a card deposit and a crypto transfer lead to completely different next steps. The review is free and there is no upfront fee.
  1. Call the OSC Contact Centre at 1-877-785-1555 if you are in Ontario. The commission flagged CARFIS itself and then the platforms carrying its name, so your report is adding to an existing file rather than opening a new subject. Give them the exact web address where the CARFIS page appeared, including the subdomain, since that is the detail that connects your account to the operation they have already documented.
  1. Contact your bank or your crypto exchange now. Card payments have a dispute window that closes, and a merchant that induced payment with a fabricated regulatory licence is squarely within what a chargeback is meant to address, so say that explicitly when you call. If you sent crypto, ask the exchange to flag the destination address straight away. That will not reverse the transfer, but it narrows where the funds can be converted to cash and its value decays quickly.
  1. Capture the credential while it still exists. Verification pages are pulled once alerts are published. Take screenshots showing the full browser address bar so the carfis or ca-rfis subdomain is readable, save any certificate PDF you were sent, and keep the original message or call notes where the licence was first mentioned to you. Add your deposit receipts, the wallet addresses used, and the names and contact numbers of whoever handled your account. The address bar screenshot is the highest value item, because it demonstrates the licence was published by the broker itself.
  1. Treat every offer to recover your money as a fresh attempt to take some. People who have lost money to one of these platforms are frequently approached again, sometimes within weeks, by someone presenting as a compliance officer, an investigator, a lawyer or a regulator, and the CARFIS licence is often cited as the reason a payout is owed. Anyone who requires a fee, a tax, a release charge or a deposit before releasing funds is running the second half of the same fraud. The OSC has stated it never offers recovery services and never asks for payment, and RecoverFunds.ca charges nothing to look at your case.
  2. Report to the Canadian Anti-Fraud Centre and to the securities regulator for your province, the full process, with contact details for every province, is here

CARFIS: Frequently Asked Questions

Is CARFIS a real regulator?

No. CARFIS is not a securities regulator and has no authority to license anyone. The Ontario Securities Commission named it in an investor alert on January 12, 2026, covering carfis.org, CRFIS.com and CA-RFIS.com, and confirmed it is not registered in Ontario to engage in the business of trading in securities.

Can RecoverFunds.ca help me get my money back from a platform that showed a CARFIS licence?

We start with a free case review and never charge an upfront fee. We will work out which platform actually received your deposit, check it against the OSC alerts from January 2026, point you to the right provincial regulator and tell you honestly what is recoverable given how the money left your account. We do not promise recovery, and where funds moved as crypto the realistic outcome is often limited.

Is CARFIS connected to CIRO or the Canadian Securities Administrators?

No, and the resemblance is the point. CARFIS and CA-RFIS are constructed to sit near the initials of genuine Canadian financial bodies without matching any of them. Canada's real oversight structure consists of the provincial securities commissions, the Canadian Securities Administrators as their coordinating body, and CIRO for investment dealers. CARFIS is not part of it in any capacity.

How can I check whether a CARFIS registration number is genuine?

You cannot, because there is no genuine register behind it. Any number issued under this name can only be confirmed on pages the operation itself controls. To verify a firm properly, use the Canadian Securities Administrators national registration search or your provincial regulator's own register, and reach it by typing the address yourself rather than by clicking a link the platform supplied.

Why did the CARFIS page load at an address inside the trading platform's website?

Because the platform was hosting it. Addresses such as carfis.capitalaltrion.com and CA-RFIS.delta-wealth-ltd.com are subdomains of those platforms, running on servers the operators control and editable by them at any time. Genuine registers are published by the regulator on its own domain precisely so that a firm cannot write its own entry.

The platform showed both a CARFIS licence and a FINAEU licence. Does that make it safer?

It makes it worse. Authorisation is jurisdictional, so a legitimate firm is registered with the regulator where its clients live rather than accumulating certificates from several unrelated bodies. Capital Altrion was recorded carrying both a carfis and a finaeu address on one website. Two fabricated credentials simply mean two fabrications rather than any additional oversight.

What is the difference between CARFIS and the cad-finra addresses in the same OSC alerts?

CARFIS is invented outright, so searching it turns up nothing official. Addresses beginning cad-finra instead borrow FINRA, a real United States regulator that has never operated a Canadian division, so a quick search appears to confirm the name. In both cases the reliable test is whether that regulator lists the firm on the regulator's own official website.

Which company actually took my money if CARFIS was only the licence?

The trading platform did. CARFIS supplied the credential and never held an account. Check your bank or exchange statement for the payee that was debited and your browser history for the site you signed into, then look that name up against the OSC alerts published on January 12 and January 30, 2026, which cover the platforms recorded carrying CARFIS addresses.

Who is behind CARFIS?

The public record does not say. The OSC alert establishes that the entity operating those three domains is not registered in Ontario, but it does not identify the operators, their location, or whether they also run the platforms that displayed the licence. Anyone who tells you confidently who is behind it is going further than the published evidence allows.

Is CARFIS a scam?

CARFIS is the subject of a published investor alert from Ontario Securities Commission (OSC) on January 12, 2026. Regulators issue these when an operation is offering investments to people it has no authorisation to deal with, and dealing with an unregistered platform means no regulatory recourse if the money disappears.

Is CARFIS legit, and is it registered in Canada?

Registration is the check that settles this, and it is one you can run yourself in under a minute at aretheyregistered.ca. CARFIS was named in an investor warning from OSC on January 12, 2026. Certificates and licence numbers shown on a platform's own site are not evidence; the national register is.

Why can't I withdraw my money from CARFIS?

If a CARFIS withdrawal has stalled, the important thing is to stop paying. Regulators see the same sequence repeatedly: the withdrawal is approved in principle, then a fee is required before release, then another after that. The fees demanded after a failed withdrawal often exceed the original deposit. There is no threshold that unlocks the money. Here is what to do instead.

Why is my CARFIS login not working?

A CARFIS login that stops working is worth treating as information rather than a glitch. Accounts on flagged platforms are frequently locked once the operator decides a client is no longer going to deposit, and domains disappear entirely when an operation moves on. Screenshot whatever you can still reach. Balances, transaction history, chat logs, all of it, before it becomes unreachable.

Are CARFIS reviews real?

Ratings-site reviews are among the easiest things to manufacture, and a platform under a regulatory warning has every reason to manufacture them. For CARFIS, weigh the OSC warning on January 12, 2026 above any star rating. Also be wary of reviews that appear immediately after a warning is published. A sudden burst of five-star reviews is a response to the warning, not evidence against it.

Is carfis.org a safe website?

No. carfis.org is named in connection with the OSC warning about CARFIS on January 12, 2026. Beyond the money, avoid installing anything it asks you to install and never grant remote access through tools like AnyDesk or TeamViewer to someone contacting you from it.

How do I report CARFIS in Canada?

Report to the Canadian Anti-Fraud Centre, to your provincial securities regulator, and to your local police. Your bank or exchange comes first though, the same day, ahead of all of them. Report to the regulator for the province you live in rather than wherever CARFIS claimed to be based, because that is almost always fictional. Step by step, with every provincial contact, is here.

Related Fraud Alerts

How to report investment fraud in Canada, the full process · How we verify these warnings