How to Report Crypto Fraud in the EU (2026 Guide)

Acting quickly after a crypto loss improves your options. Reporting does not, on its own, return your money — but it creates the official record that banks, exchanges, regulators and any later civil claim all rely on, and it can be the difference between a receiving account being frozen and the funds being gone for good. This guide covers the immediate steps and where to report across the European Union.

What should I do in the first 24 hours after a crypto scam?#

In the first day, do three things and stop doing one. First, stop all contact with the suspected fraudster and send no further money — especially any "fee," "tax" or "deposit" demanded to release or recover funds, which is itself the hallmark of a second scam. Second, preserve evidence exactly as it is: transaction hashes (TXIDs), wallet addresses, the platform's URL, every message, and full-screen account screenshots — uncropped. Third, notify the institutions in the payment chain: your bank if a card or transfer was used, and the exchange you sent crypto from, so they can flag the receiving account. Then report to the authorities. Speed matters because a freeze is only possible while funds still sit at a cooperating, regulated venue.

Who do I report cryptocurrency fraud to in the EU?#

There is no single EU-wide hotline, but in almost every member state three types of body matter, and you should contact all three:

• The police / national cybercrime unit — they open the criminal case and can issue preservation or freezing requests.
• The national financial-markets regulator — they maintain public warning lists of unauthorised firms and clone websites, and your report helps protect others.
• The national Financial Intelligence Unit (FIU) — the body that receives suspicious-transaction reports and coordinates with exchanges and foreign FIUs.

For cross-border cases, EU agencies sit behind your national police: Europol supports investigations and Eurojust coordinates prosecutions across countries. Crypto fraud is overwhelmingly cross-border, so reporting locally is what plugs you into that wider network — you do not contact Europol directly as a victim.

How do I report crypto fraud in Spain, Germany, France and Italy?#

The institutions below are the established points of contact. Always reach them through contact details you find independently on their official sites — never details a "recovery agent" gives you.

• Spain: Report to the Policía Nacional or Guardia Civil (Grupo de Delitos Telemáticos). The markets regulator CNMV publishes warnings on unauthorised entities (chiringuitos financieros); INCIBE runs a free cybersecurity helpline (017); the FIU is SEPBLAC.
• Germany: File with the Polizei (the state Landeskriminalamt cybercrime units). BaFin issues investor warnings on unlicensed providers; the German FIU sits within the Customs Administration (Zoll).
• France: Use the THESEE online fraud-complaint platform and report illegal content via PHAROS. The markets regulator AMF maintains blacklists; the FIU is TRACFIN.
• Italy: Report to the Polizia Postale. The markets regulator CONSOB can order the blackout of abusive sites; the FIU is UIF, hosted at the Banca d'Italia.

In the Netherlands, the equivalents are the Politie, the AFM, and FIU-Nederland. If you are unsure who your national regulator or FIU is, your police force will direct you.

What evidence should I preserve, and how?#

Treat your case file the way an investigator would. Keep original, unedited records: a list of every wallet address and transaction hash involved (these are your strongest evidence on a public blockchain), the dates and amounts of each transfer, the platform or app name and URL, the names and phone numbers used by the fraudster, and the full message history (export it rather than screenshotting where you can). Photograph or screen-record the fake "dashboard" before it disappears. Note how you were first contacted and by whom. Do not crop or annotate originals — keep clean copies and work from duplicates. This material is what lets a forensic analyst reconstruct the flow of funds and what a bank, exchange or court will ask to see.

Does reporting still help if my money is probably gone?#

Yes — and you should report even when recovery looks unlikely. The scale alone shows why authorities need the data: the FBI's IC3 2024 report recorded USD 9.3 billion in cryptocurrency-related losses, a 66% year-on-year increase, and Europol's IOCTA 2025 assessment describes fraud schemes as the fastest-growing area of organised crime in the EU. Your individual report does several concrete things even if the cash is unrecovered: it lets the FIU and exchanges map repeat-offender networks, it supports others by feeding regulator warning lists, and it creates the documentation you need for tax loss-recognition, any insurance claim, and a future civil action. Recovery is never guaranteed, but an undocumented loss has no route to any of these outcomes. Reporting is the floor, not the ceiling.

Can the money be traced while I report?#

A forensic trace can run in parallel with reporting — the two are not alternatives. Public-blockchain transactions are permanent and visible, so a qualified analyst can often follow stolen funds from your wallet, across "hops" and chains, to the exchange or service where they are cashed out. The earlier that trace reaches a regulated, cooperating exchange, the better the prospect that the receiving account can be voluntarily frozen pending a lawful request from your authorities. This is why timing is decisive: a trace acted on within days has a materially better chance than one started months later. A legitimate firm produces the evidence; the freeze and any return run through the authorities and the exchange, which is why no honest party promises an outcome.

A note on staying safe while you report#

The single most common follow-on harm is the recovery-room scam — a "service," "law firm" or "regulator" that contacts you offering to get your money back for an up-front fee. The FBI has warned that almost all crypto investment-fraud victims are later approached this way. No legitimate firm cold-contacts victims, asks for your seed phrase or private keys, or demands payment to "unlock" funds. AssetTrace never makes unsolicited contact and never charges a release fee; every engagement begins with a free review and written terms. If someone contacts you claiming they can recover your funds, treat it as a new scam until you have verified them independently.

Sources#

• FBI IC3 — 2024 Internet Crime Report (PDF)
• FBI — Cryptocurrency and AI Scams Bilk Americans of Billions
• Europol — IOCTA 2025: "Steal, Deal and Repeat"
• Europol — IOCTA Spotlight: Online Fraud Schemes (PDF)
• FBI IC3 PSA — Fictitious Law Firms Targeting Cryptocurrency Scam Victims
• CNMV (Spain) — investor warnings
• BaFin (Germany) — consumer warnings
• AMF (France) — blacklists and warnings
• CONSOB (Italy)