How to spot an investment scam: check the firm, not the pitch

There’s a picture in your head of who this happens to. Someone who doesn’t know much about money, and got talked into something they never understood. Not someone a few hundred euros in and showing a profit.

The Dutch regulator has looked at who investment fraud actually happens to. Victims aren’t necessarily naive about money, the AFM found. Many have some investing experience, and they overestimate what they know ↗ (opens in new tab).

That changes the job. Judging whether the investment is any good is not how to spot an investment scam, because the investment is the one part of this you can’t get near. What you can examine is the platform, and the balance climbing on the screen. The other side built both, and owns both. That number went up because somebody typed it.

If money is already in and won’t come out, or someone’s demanding a fee before they’ll release a withdrawal, don’t pay it. CONSOB sets out what follows ↗ (opens in new tab): new commissions, improbable taxes, endless procedures, silence. Stop sending money, stop replying, block them. Then go to the end of this piece and ring your bank. Speed matters there in a way it doesn’t here.

What you can check is the firm, and who rang whom. It doesn’t much matter whether the thing in front of you calls itself a broker, a trading app, a platform or an investment academy. You check the name on it, somewhere they don’t control.

A firm telling you it’s regulated in another country may be telling the truth, and that still doesn’t close the question. There’s a second list to check, and it’s your own country’s.

Why do the usual warning signs miss modern investment scams?

Europe’s financial watchdogs, ESMA among them, list poor grammar and clumsy formatting as things to watch for. Then, in the same breath, they add that “AI may allow fraudsters to mask these flaws more effectively” ↗ (opens in new tab). CONSOB’s guidance ↗ (opens in new tab) tells Italian savers the risk isn’t limited to odd websites and badly written messages. The pitches look good. Charts, testimonials, and a name a shade off a real firm’s.

BaFin’s account of the messenger-group version runs over several weeks: an academy or a study circle, daily sessions, small prizes that do get paid out, and other members who seem pleased with their returns. Some of those members work for the people running it ↗ (opens in new tab). By the time there’s anything to check, the person you’d be checking on has spent a month being helpful.

Not all the enthusiasm is staged, which is what catches careful people. In the Ponzi shape the CNMV describes ↗ (opens in new tab), the first clients get paid out of what later ones put in. Then they tell their friends. Without knowing it, they become the bait.

You open an account with a couple of hundred euros and get an adviser assigned. Then you watch a balance grow on their dashboard. BaFin is flat about that balance. The trades and the profits are fakes, and no money is invested at all.

Real investments can fall as well as rise, and a real return does both. A line that only ever goes up is a rendering.

Then comes the step that convinces people who are hard to convince. You take a small withdrawal, to test it. It arrives. BaFin says that is designed: test trades, small withdrawals that work, then the push to send real money. A withdrawal that works tells you only that they wanted it to.

You don’t have to out-think a pro on the spot. Who started this conversation? And whose list are you checking them on?

Who started this conversation?

This one is nearly mechanical. You went looking, or they came to you. BaFin says it knows of no licensed providers who approach investors through messenger group chats. The CNMV ↗ (opens in new tab) goes further: authorised firms don’t approach non-clients with investment offers at all.

How do you check a firm is regulated?

There’s a public register of firms authorised to offer investment services in the EU, plus Norway, Iceland and Liechtenstein. ESMA, the EU’s markets regulator, keeps it. It’s free. You search it by name.

What do you search, and what should it say?

Type the firm’s name into the keyword search on the EU-wide register of investment firms ↗ (opens in new tab), which is where ESMA sends you ↗ (opens in new tab). The status column is the one that decides it, and it should say “active”.

Entity type is the column that trips people. It records what a firm may legally do, not what it calls itself, so a fund manager turns up as a UCITS management company and a crowdfunding site as a crowdfunding service provider. We counted the register’s entries by type in August 2026: more than 5,000 were fund managers. Not one of those was typed “Investment firm”.

A type you weren’t expecting means the firm is authorised for something else. It isn’t a red flag.

Now the part that turns a look-up into a check. Europe’s supervisory authorities say ↗ (opens in new tab) never to rely on the contact details the suspected fraudster gave you. In the same breath they warn that scammers may claim to be authorised, or mimic the website of an authorised company, and tell you to check whether a warning has been issued by your national financial authority or included in IOSCO’s I-SCAN list ↗ (opens in new tab).

That is where the name goes. Search your own national regulator’s register, and search its warning list, which is the list clones get named on.

Why doesn’t a match on the register rule out a clone firm?

Because a clone copies a real authorised firm’s name and address. The search finds it. Everything matches.

In August 2026 the Central Bank of Ireland named two of them: one trading as JP Morgan Asset Management ↗ (opens in new tab), which had copied the details of JP Morgan Bank (Ireland), and one wearing the Barclays Private Bank name ↗ (opens in new tab), which had copied Barclays Bank Ireland.

Neither took the exact name of the firm it was copying. Both took a near-variant, then registered lookalike domains and put their own phone numbers and their own staff email addresses on them. One of those domains was the copied bank’s own name, minus the spaces and the “plc”. The Central Bank’s warning about a firm using Investec Europe’s name ↗ (opens in new tab) is the same shape.

Which national list do you check as well?

The EU-wide register isn’t the last word, and ESMA says so: its page links out to the national registers for anything it doesn’t hold.

Check your own country’s as well.

If you’re in Slovenia, use both the ATVP’s and Banka Slovenije’s rather than assuming one covers it. A reader in the UK is outside this system altogether. We searched the EU register for UK firms in August 2026 and got almost nothing back. ESMA’s own table sends you to the FCA instead.

What if the firm says it’s regulated in another country?

A licence from another member state is ordinary and legal, so on its own it settles nothing. All it decides is which registers hold your answer, and there are two of them.

They have an answer ready for the check you just did. “We’re regulated in Cyprus, that’s why we’re not on your national list.”

The irritating part is that this is true of thousands of legitimate firms. Under the EU’s investment-services rules ↗ (opens in new tab), a firm authorised in one member state may serve customers in another. It doesn’t have to open anything there.

The home country authorises and supervises it. Yours gets told.

A foreign address isn’t evidence of fraud, then. What it changes is less than people picture. Under the EU rules on which court hears a cross-border dispute ↗ (opens in new tab), a firm authorised in another member state and marketing into yours can sue a private customer only in that customer’s own courts, and can be sued there too. Your courts, either way. If the terms you ticked name a court in the firm’s home country, that clause was agreed before there was anything to argue about, and it doesn’t take this away.

Dull reading, and it is on your side.

The register won’t settle it for you either. We went and read the Cyprus records in August 2026, expecting the host country to be listed somewhere on them. It isn’t. The records carry the home state and, where a firm has a branch, that branch’s country. A firm serving you from abroad without a branch left no trace of the host country on any record we sampled. Its entry shows the Cyprus authorisation and nothing at all about you.

That is neither good news nor bad. It is silence.

Your own regulator holds the other half. Firms that start working in Germany from abroad go into BaFin’s public company database ↗ (opens in new tab), the German regulator says. Read the small print on that database and you find BaFin taking no liability for how complete or accurate it is ↗ (opens in new tab).

Publishes the list, tells you to search it, won’t stand behind it. Search it anyway. There isn’t a better one.

What happens to your money if the firm was never authorised?

The investor-compensation scheme pays out when a firm that was authorised, and that was holding your money or your investments, fails and cannot give them back.

It is not a refund for being lied to. And it does not stand behind a firm that was never authorised.

It all turns on one word. Authorised.

ESMA’s wording is less gentle ↗ (opens in new tab).

“Unauthorised firms try to avoid complying with the controls that legal, authorised entities are subject to, leaving investors totally unprotected.”

The EU-wide minimum is €20,000 ↗ (opens in new tab). That is a floor every member state must at least provide, not a sum you’re owed. Cover can be partial below it too: in Ireland the Central Bank puts the scheme at 90% of your net loss, up to a maximum of €20,000 ↗ (opens in new tab). Run a €30,000 loss through that and the answer is €20,000, not €27,000.

The cap bites before the percentage does.

All of that is an EU scheme, so a UK reader sits outside it. Protection there comes from UK rules that work differently. It is also a separate thing from the deposit guarantee on your bank account, and which of the two stands behind an ETF is the same question over again.

One more thing travels with a firm’s home country. Each country’s compensation scheme covers the firms its own regulator authorised. On deposits, BaFin steers German savers to the scheme in the country where the money sits ↗ (opens in new tab), since the cover there can differ from the German rules. For a firm based elsewhere, only that country’s own scheme can tell you anything solid.

So if the firm is authorised in Cyprus, the scheme that would pay is the Cypriot one, claimed in a country you’ve never been to.

None of which means somebody who has already paid has nothing. It means the compensation scheme isn’t the thing that helps. The police and your own regulator are what’s left, and sometimes, if the money moved recently, your bank.

What do you do if you have already paid?

Ring your bank now, on the number printed on your card. Europe’s financial watchdogs ↗ (opens in new tab) put that call, made through official channels, among the first things to do. The point is to see whether payments can be frozen or reversed, and speed matters for a practical reason. Money still sitting in the receiving account can sometimes be stopped; money that has moved on is much harder to reach.

Be careful what you expect from that call. The payment protections most people have heard of ↗ (opens in new tab) are built around payments you did not authorise. A payment you were talked into making yourself is treated differently. What can be clawed back also depends on how you paid, so ask that on the same call.

Who do you report an investment scam to?

Then report it, to your national regulator and to the police. This is the step that gets skipped, and a European Commission survey of consumer fraud, run between August and October 2019 ↗ (opens in new tab), is clear about why. Among everyone exposed to a scam of any kind, 23% of those who didn’t report it thought it would make no difference, and knowing who to tell decided it for 13% on each side, the ones who reported and the ones who didn’t. The second one is the easy fix. Whoever licenses investment firms in your country is the one you tell.

Reports are also what produce the warning lists. As the CNMV’s guide has it, a report is what lets the authorities publish a warning, and that warning is what the next person searching the name will find.

People aren’t always aware they’re victims, the AFM notes, which is what the dashboard is for. Where shame turns up in investment fraud, the AFM finds it after the money has gone, in the version where the victim thought there was a real relationship. This was designed and rehearsed by people who do it for a living.

Is someone offering to help you recover the money?

Some weeks later, somebody helpful gets in touch. The AFM records ↗ (opens in new tab) that fraudsters often come back posing as lawyers. Europe’s supervisory authorities add people claiming to be the police, offering to get the money back for a fee.

IOSCO’s global alert list ↗ (opens in new tab) has a whole category for people posing as regulators. Not a footnote. A category. Somebody had to create it, presumably once enough of it had happened.

ESMA is direct about its own name being used this way ↗ (opens in new tab). It will never approach you asking for personal details on the pretext of helping you get money back, and it never asks for a fee. Its emails only ever end @esma.europa.eu, and the organisation sits in Paris and nowhere else, so its phone numbers start +33. France’s AMF warns about the same callers ↗ (opens in new tab). That is where the watchdogs leave it: being scammed once does not prevent you from being scammed again.

The register is open now, and it’s free. Nobody has to know you looked. If the name isn’t there, you’ve found that out while the money is still yours. If it is there, all the list has told you is that a firm of that name is authorised, and nothing at all about whoever contacted you. Your regulator’s warning list is the second search, and it is the one that names clones.