Home › Where to Report › European Union
How to report a crypto scam in European Union
In the European Union, report cryptocurrency fraud to your national police cybercrime unit — that is the channel that can lead to an investigation. Report the firm separately to your national financial regulator, such as BaFin in Germany, the AMF in France, CNMV in Spain, or CONSOB in Italy. Europol's reporting portal routes you to the correct national channel if you are unsure which applies to you.
Where to report, and what each channel actually does
Not every reporting channel does the same thing. Some can start an investigation; others collect intelligence and will never respond to you individually. Both are worth filing — but only one of them begins a process. File in this order.
Your national police cybercrime unit Police — can lead to an investigation
Most member states operate an online cybercrime reporting form. This is the channel that can result in an investigation. File in your own country even when the perpetrator is elsewhere.
Your national financial regulator Regulator
BaFin (DE), AMF (FR), CNMV (ES), CONSOB (IT), AFM (NL) and others accept complaints about unauthorised firms and publish warning lists. Search the list before dealing with anyone.
Europol reporting portal Intelligence only — no case response
Directs you to the right national channel for your country. Europol itself does not take individual reports.
What to include in your report
The transaction IDs are the single most important thing. A report without them is dramatically weaker, because investigators group cases by wallet address.
- Every wallet address you sent funds to
- Transaction IDs (hashes) for each transfer
- Dates, times and amounts
- Every website, app and account name used
- Full chat exports — not screenshots, which lose timestamps
- Bank statements showing money moving to the exchange
Can European courts help?
Cross-border civil recovery within the EU is more workable than in most parts of the world, thanks to mutual recognition of judgments — but it still requires an identifiable counterparty. GDPR also gives you enforceable rights over any data a firm holds about you, including the right to demand deletion, which is occasionally useful leverage with an uncooperative operator.
If a firm offers to recover your money
Expect to be approached. Victim lists are bought and sold, and recovery fraud specifically targets people who have already lost money once. Before paying anyone, ask what licence they hold, from which regulator, and what the number is.
The licence to demand in European Union
A lawyer admitted to a national bar. Ask for the bar and registration number and check the national register. MiCA has introduced authorisation requirements for crypto-asset service providers across the EU — a firm claiming to be an authorised CASP can be verified with your national regulator.
Check ESMA's warning list and your national regulator's list before any payment. Several recovery operators have been formally named by BaFin and other EU regulators.
A SAM.gov registration is not a licence. A NATO NCAGE code is not a licence. Both are free self-registrations with no vetting behind them, and both are used constantly by fraudulent operators to look official.
Check whether your case is recoverable — free
Frequently asked questions
Which country do I report in if the scammer is abroad?
Report in the country where you live. Your national police can pursue international cooperation through Europol and Eurojust; you cannot file directly with a foreign force.
Does Europol investigate my case?
No. Europol supports and coordinates national investigations but does not take individual reports or investigate individual cases.
What does MiCA mean for me?
The Markets in Crypto-Assets regulation requires crypto-asset service providers operating in the EU to be authorised. That gives you a register to check, and gives regulators a basis to act against unauthorised firms.
Can GDPR help me?
Indirectly. You can require any firm holding your personal data to disclose what it holds and to delete it. It will not recover funds, but it is a real obligation with real penalties behind it.
Are EU judgments enforceable across borders?
Within the EU, largely yes, under mutual recognition rules. That makes civil action more viable here than in many jurisdictions — provided you can identify a defendant.
Should I use a recovery firm from another country?
Tracing works from anywhere. Legal action does not — only a lawyer admitted in the relevant jurisdiction can act there. Be wary of firms that charge for both.