Online Scams Are Wreaking Havoc Across Europe… Why Is No One Responsible?

You receive a message about a promising investment opportunity. It seems credible. A friendly “adviser” guides you patiently through the process, answers your questions, and gains your trust. You transfer the money. You withdraw “your earnings” and invest some more, again.

For a while, everything appears normal… until you try to withdraw all your money and realise you can’t. Then the platform disappears. You have lost €37,000.

You call your bank, contact the police, and search for someone to hold accountable, but there is no clear answer. The scammer operated outside the financial system. The platform was hosted abroad, the advert appeared on social media, and it vanished before anyone could stop it.

You feel ashamed, isolated and desperate. But you are far from alone. According to the European Commission’s survey on scams and fraud, 56% of European adults have faced at least one scam or fraud attempt in the past two years, and 39% have suffered financial loss.

And the rules meant to protect you are not keeping pace.

Investment scams do not target a specific kind of person. They are not reserved for the naïve, the elderly, or the greedy. Anyone with a phone and a bank account is a potential target.

The latest joint report by the European Central Bank and the European Banking Authority puts payment fraud losses in the European Economic Area at €4.2 billion in 2024.

These figures only capture part of the picture. They exclude pyramid schemes, land banking, misrepresented investments in rare assets, and most crypto scams that operate outside traditional payment systems.

The Financial Services and Markets Authority, the Belgian financial regulator, received 1,289 reports of investment fraud in the first half of 2025. Total reported losses reached €15 million. Eighty per cent of the losses came from fake crypto trading platforms. Another €1.2 million came from so-called recovery scams, where fraudsters target people who have already been defrauded once.

Across Europe, only one in five fraud victims reports the incident to an official authority. The true scale of investment scams is therefore hidden behind a wall of silence.

The word “scam” is used loosely. In practice, fraud and scams are either unauthorised transactions, such as hacks to your accounts, or to authorised transactions induced by deception. In the context of investments, the distinction matters: victims may have approved the transfer, but not the fraud behind it.

For example, when a licensed bank, broker, or fund manager mis-sells a product or breaches its duties, the consumer has clear options. National competent authorities and the European Supervisory Authorities (ESMA, EBA, EIOPA) supervise the firm and set the standards. Civil liability rules apply, investor compensation and deposit guarantee schemes step in if the firm fails, and an ombudsman can mediate disputes. The system is far from perfect, but it exists.

An investment scam is something else entirely. It is the provision of (fake) investment services by an actor with no licence, no supervision, and no obligation to the client. The counterparty operates outside the financial regulatory perimeter. When the money disappears, none of the protections above applies.

Scammers rely on a handful of recurring techniques, such as:

• Clone firms and impersonation – Fraudsters copy the name, branding, and registration details of a legitimate firm. For example, the Federal Financial Supervisory Authority recently warned about a website posing as “Quantum Banc UK”, which falsely used an FCA registration number belonging to an unrelated firm, Saxo Capital Markets UK Ltd.

• Fake trading platforms – Unregulated platforms promote “high-risk products” such as Forex, derivatives, or crypto-assets. They mimic regulated brokers and even simulate appropriateness assessments to seem compliant.

• WhatsApp groups and messaging schemes – Fraudsters approach victims on WhatsApp, posing as a licensed firm. BaFin has flagged the “B2 Akademie” scheme, which lures investors with free stock tips before pressuring them onto a trading platform. Trust is built over weeks, and small withdrawals are allowed early to build credibility. Once larger sums are deposited, withdrawal conditions become impossible.

• Misleading copy trading and “communities” – Investors are drawn into groups claiming to share trading signals. The reality is often a pump-and-dump scheme, a rug pull, or a Ponzi structure.

• Social engineering and phishing – Fake advertisements, emails, and websites extract personal or financial information, which is then used to access accounts or tailor a more convincing fraud.

• Recovery scams – After someone has been defrauded, a second scammer makes contact. They pose as a lawyer, regulator, or investigator and offer to recover the lost funds for a fee. The victim, already vulnerable, pays twice.

• Celebrity and finfluencer endorsements – Fraudsters use the likeness of well-known figures without their knowledge to lend credibility. They also work with online personalities who promote investment opportunities to their followers, often without a licence.

What unites these tactics is the exploitation of emotion. Fraudsters trigger fear of missing out, promise unrealistic returns, and create urgency.

The rules governing payments, online platforms, and financial services were not designed with investment scams in mind. Today’s scams cut across all three layers at once, but the legal framework still treats them as separate problems.

Payment Services Directive 2 was a useful step. But the directive leaves payment service providers significant discretion and few hard obligations. It allows liability to shift to the consumer in cases of “gross negligence”, a notion that is poorly defined and frequently used to deny reimbursement.

In parallel, the arrival of instant payments has made matters worse. Execution is now measured in seconds, leaving providers almost no window to detect fraud before the money is gone.

The Digital Services Act imposes obligations on platforms, but significant loopholes remain. Platforms can retain “safe harbour” protections even while carrying systematic deceptive advertising. There is no hard obligation to pre-screen financial promotions or to integrate the warning lists that national regulators already publish.

The Markets in Crypto-Assets Regulation captures issuers and exchanges, but scam tokens and off-platform promotions sit outside its scope. The Artificial Intelligence Act is not consumer-oriented. It relies on ex-post risk management, leaving consumers exposed during the first, and most damaging, wave of misuse.

Data is fragmented too. National authorities collect information inconsistently. Warning lists from ESMA and national regulators are not operationalised, and their uptake by search engines is voluntary.

The result is a system in silos. Scammers operate across all of them at once. No one is responsible because the law was enacted before the problem took its current form.

Progress is being made. The proposed Payment Services Regulation and PSD3 introduce stronger duties on payment providers to detect, block, and refund certain authorised push payment scams. Reimbursement timelines are fixed at ten business days. The Instant Payments Regulation has recently mandated further IBAN-name verification.

These are meaningful steps, yet not enough. The UK and Italy already do more. The Financial Conduct Authority requires only authorised firms to advertise financial services online. Commissione Nazionale per le Società e la Borsa has secured the rapid removal of unauthorised activity from search engines. Both models work. Yet rules are under finalisation, and improvements are where details matter. BETTER FINANCE calls for shared liability between platforms and banks. This way, the ecosystem is overall safer, and it is not to the consumer to bear the risk of navigating online or initiate a payment in good faith.

To understand what needs to be done, the EU should focus on calling for accountability of banks and online platforms such as search engines and social media, and on stricter rules for financial content.

The advertisement should never have run without verification that the advertiser was authorised. Any search result should have carried an automatic warning drawn from regulator lists already in the public domain, as well as the platforms should react faster in removing fake/fraudulent content).

When banks and platforms are accountable, passive monitoring turns into proactive blocking, stronger warnings, and faster intervention.

Furthermore, Finfluencers operating as de facto investment promoters should not sit outside the MiFID perimeter. The payment should have paused long enough for a plain-language warning to appear. A shared EU database of fraudulent IBANs, wallets, and domains would have flagged the recipient before the transfer cleared. When prevention fails, a clear EU-wide alternative dispute resolution mechanism would give victims a single point of contact, not a maze of five jurisdictions.