How the EU’s new crypto rules triggered a massive scam wave

The European Securities and Markets Authority (ESMA) confirmed it was aware of criminals misusing its identity, name, and logo, including through falsified documents, to convince users that their funds were at risk.

The Netherlands’ Authority for the Financial Markets (AFM) warned that the migration of unregulated crypto exchanges itself was the attack surface. “Fraudulent actors may indeed see an opportunity to scam retail investors who are in the process of looking for an alternative licensed provider,” the AFM told CoinDesk. It urged investors to verify any provider on the official ESMA register before transferring assets, and warned that unsolicited approaches requesting fund transfers should be treated with suspicion.

Austria’s Financial Market Authority issued a similar warning recently. telling retail crypto users that hundreds of platforms lost legal status on July 1 and urged them to verify providers against official databases before moving assets or transferring to self-hosted wallets to avoid migration traps entirely.

Regulator warnings

The scammers’ modus operandi follows a pattern regulators know all too well. The U.K.’s Financial Conduct Authority (FCA) told CoinDesk via email that it has 4,465 reports on record of fake FCA impersonations in the first half of 2025 alone, with 480 victims tricked into handing over money.