It starts with an advert or a friendly message in a messenger. A platform shows you profits, the chart climbs, an adviser keeps in touch. Only when you want to withdraw money is there a problem: a fee, a tax or a security deposit must be paid first. This guide describes how to recognise the pattern and what to do afterwards.
How the scam works
The police crime prevention service describes how the offenders make unsolicited contact via messenger or phone and pose as experts. According to the police, in many cases no trading takes place at all; the platform’s software merely shows invented transactions and profits. BaFin adds that victims are told to set up a wallet at a crypto trading platform to pay. The money is exchanged for bitcoin but ends up in the criminals’ wallet.
With investment fraud via WhatsApp and Telegram, BaFin says the offenders build trust over weeks. They advertise groups with names such as “School” or “Academy”, show forged licence documents and let demo accounts make small payouts. The consumer advice centre names an initial deposit of 250 euros as the typical entry, followed by pressure to pay larger amounts.
- 1ContactAdvert with celebrities or a message in a messenger.
- 2TrustGroup, demo account, small payout.
- 3DepositThe amount goes to the offenders’ wallet.
- 4Fake profitChart rises, withdrawal needs a fee or tax.
- 5Recovery agentsSecond wave: money is found, advance needed.
Typical course according to descriptions by BaFin, the police and the consumer advice centre. The order can differ in individual cases.
Sources: BaFin: Fraudulent trading platforms; BaFin: Investment fraud via WhatsApp and Telegram; Police crime prevention: Recognising and avoiding cybertrading fraud
How to recognise a platform that does not pay out
The clearest sign appears when you ask for a withdrawal. The consumer advice centre writes that you are then told a capital loss has supposedly occurred, or that the payout depends on further payments: profit taxes, administration fees or a security deposit against money laundering. BaFin also names the “mirror transaction”, where you are to transfer an amount in advance to link accounts, and the “proof of liquidity”.
- Contact you did not ask for. BaFin and the police name cold calling, group invitations and adverts with misused celebrity images or AI content as features.
- High profits for a small stake. The police point out that high profit chances always come with high risk.
- Pressure towards crypto and quick decisions. According to BaFin, payments often go through crypto wallets or private individuals’ accounts.
- Remote access. BaFin and the police advise never installing remote maintenance software or allowing remote access.
- Incomplete imprint, young domain. BaFin advises asking for a complete imprint and checking the domain’s age with a WHOIS lookup.
Before you send more money, you can have the recipient account checked in the IBAN check on onlinebetrug.ai. The message check looks at a message from a messenger. An unremarkable result is no guarantee. It only shows that nothing stood out in the features checked.
Check the licence: BaFin database and ESMA register
The police recommend looking providers up in the BaFin database before registering and before any transfer, and they advise against sending money to providers without a BaFin licence. Anyone providing crypto-asset services needs authorisation under Regulation (EU) 2023/1114 (MiCAR). According to BaFin, once granted it is published in the Federal Gazette, in the BaFin company database and in ESMA’s interim MiCAR register.
This also applies to custody. According to the BaFin guidance notice, custody and administration means the safekeeping or control of crypto-assets, or of the means of access to them, on behalf of clients, and corresponds to the former crypto custody business under the German Banking Act. Carrying it out on a commercial basis requires authorisation even if it is directed across borders at customers in Germany.
On the current position: the MiCA transitional period ended on 1 July 2026. On 23 June 2026 ESMA stated that clients of unauthorised providers do not benefit from MiCA safeguards, including protection of client assets. It invites clients to check in the ESMA register whether their provider is authorised. A missing entry is a warning sign. An existing entry says nothing about whether someone writing to you in a chat is acting for that provider, because according to BaFin the offenders also misuse the names and data of uninvolved companies. So ask through the contact details in the register, not through the number in the message.
Already paid in: what to document and do
The police list five steps after a fraud. According to the consumer advice centre and BaFin, the chances of getting money back are very low, because the offenders operate internationally and are hard to trace. The sooner your bank and the police know, the more likely an option stays open.
- Stop further payments.
Do not pay any fee, tax or security deposit for the withdrawal.
- Break off contact and inform your bank.
Ask whether a transfer can still be recalled and have your account or card blocked if necessary.
- Keep evidence.
Screenshots of the platform, chat histories, payment receipts, the advisers’ names and phone numbers, wallet addresses and transaction numbers. More under Already paid?.
- File a police report.
At a local station or online. Your state’s online police station is listed under Where to report it.
- Inform the financial authorities.
The consumer advice centre also advises reporting the case to the responsible financial authorities.
How did you pay?
Bank transfer
- Call the bank at once, ask for a recall.
- Then file a police report.
Credit card
- Ask the card bank about a chargeback.
- Fees may apply.
- Then file a police report.
Crypto wallet
- Secure wallet addresses and transactions.
- Then file a police report.
Whether money can be recovered depends on the payment method. According to the consumer advice centre, a transfer your bank has already executed cannot be reversed.
Sources: Consumer advice centre: Internet fraud, how you can try to get your money back (as of 3 Aug 2026); Police crime prevention: Recognising and avoiding cybertrading fraud
The consumer advice centre describes the options by payment method like this: a transfer your bank has already executed cannot be reversed. For credit cards there is the chargeback procedure through the issuing bank, with possible processing fees. For SEPA direct debits it names 8 weeks for authorised and up to 13 months for unauthorised debits. The page gives no deadline for chargebacks, so get in touch without delay. A guide for your case is under Already paid?.
Why recovery offers are a scam themselves
After a loss, helpers often appear. The police describe how fraudsters contact victims again as investigators or lawyers and promise, for a fee, to recover the money. The consumer advice centre also warns about recovery agents who demand an advance payment. BaFin writes that the offenders often claim years later that the money has been found or secured, and again demand fees for it.
On 4 May 2026 BaFin also warned about a website that supposedly helps recover fraud money, and urgently advises against responding to such offers. It recommends declining contact and reporting to the police or the public prosecutor’s office. If someone phones in the name of an authority or a law firm, you can have the number checked in the phone number check.
Further reading
If someone gives you a new account number for the fee, the guide New bank details on an invoice helps. Current cases are collected on the warnings page.
