Investment and crypto scams and how to check a firm

Key rules

• Check first: Confirm the firm's authorisation in an official list before you send any money, crypto or documents.
• Warnings lists: Not being on a warnings list does not mean a firm is legitimate, because the lists only hold cases already detected.
• Cloned firms: Scammers copy real firms, so the website, address and contact details must match the official register entry.
• Recovery fees: Never pay a fee to get lost investment money back.

The short answer

Do not send money, crypto or documents until you have confirmed in an official list that the firm is authorised. Two Spanish bodies keep those lists: the CNMV and the Banco de España. The steps are in the checklist below. This page explains what to look for and what the checks can and cannot tell you.

Red flags of a fake scheme

Most fake brokers and crypto platforms follow the same pattern. Be on guard if you see any of these:

• Big returns with little risk. Real investments never guarantee high profits.
• Pressure to act fast. "Last places", "offer ends today" and similar lines are there to stop you checking.
• Famous faces. Ads using celebrities, politicians or journalists, often on social media, are usually fake or made with deepfake video.
• Contact you did not ask for. Calls, WhatsApp or Telegram messages from a "advisor" you never contacted.
• Odd ways of paying. Crypto, transfers to foreign accounts, or a request to install remote-access software on your computer or phone.
• Fake profits, then fees. A slick dashboard shows your money growing. When you try to withdraw, you are asked for fees or taxes first. Paying them just loses more money.
• Recovery offers. Someone offers to get your lost money back for a fee. This is usually the same scammers coming back.
• Nothing you can verify. No real address, licence or contact details.

How to check a firm

CNMV. The CNMV is Spain's securities regulator. Its website has a search of registered entities and a separate list of warnings about unauthorised firms, the listado de advertencias. Search the firm's exact name and also similar spellings.

Banco de España. Its website has public registers of authorised banks, payment and e-money institutions, and crypto-asset providers. Crypto providers are registered together with the CNMV. It also publishes its own warnings about unauthorised entities. For a crypto platform, search both bodies.

Other regulators. Also look at the European ESMA warnings and the warning lists of other countries' regulators. Many scam firms operate from abroad.

Website layouts change, so use the search box on each site rather than hunting for a page.

What the checks do not tell you

• Being absent from a warnings list does not make a firm safe. The lists only include cases already found. A brand-new scam will not be on them.
• Scammers copy real firms. They use the name and details of a genuine, registered company. Compare the website, address and contact details with the official register entry. If anything differs, treat it as a fake.
• Being on the register is the test, not the reverse. If you cannot find the firm in a register, do not invest.

If you have already paid

Stop paying. Do not pay any fee to "release" your money or to get it back. Keep screenshots, messages and payment records. Contact your bank at once, and report it to the police. The decision and FAQ below cover the next steps.

Choosing between options

What should you do with an investment or crypto offer you have received?

• Walk away now: The offer promises high or guaranteed returns, pushes you to act fast, uses a celebrity ad, came from unsolicited contact, or asks for crypto, foreign transfers or remote-access software.

• Check the firm in the official lists first: None of those signs are present and you want to go ahead, so you search the CNMV and Banco de España registers and warnings before paying.

• Do not invest: The firm is not in the registers, is named on a warnings list, or has no verifiable address, licence or contact details.

Send no money until the firm's authorisation is confirmed in an official register; any red flag means you walk away.

Checklist

• Search the CNMV list of warnings about unauthorised firms (listado de advertencias) by name, and try similar spellings and variants.

• Search the Banco de España list of warnings about unauthorised entities.

• Compare the firm's website, address and contact details with its official register entry, since scammers copy the details of real firms.

• Hold back all money, crypto and personal documents until the firm's authorisation is confirmed in an official register.

What to watch out for

• Promises of high or guaranteed returns: An offer of big or guaranteed profit with little risk is the most common sign of a fake scheme, and pressure to invest fast makes it worse. Stop, take your time, and check the firm's authorisation before sending any money.

• Celebrity and public-figure ads: Ads showing celebrities, politicians or journalists backing an investment are usually fake or deepfake videos, often on social media. Ignore the endorsement and check the firm in the official registers yourself.

• Contact you did not ask for: Offers that arrive by phone, WhatsApp or Telegram from a firm you never contacted are a strong warning sign, especially if the firm is not registered. Do not reply or click links. Look the firm up yourself in the official registers.

• Remote access, crypto or foreign-account payments: Requests to install remote-access software, pay in crypto or transfer to foreign accounts let scammers take your money and your devices. Never install the software or pay this way. Hang up and end the contact.

• Fake profits and fees to withdraw: A dashboard showing growing profits is often fake. When you try to withdraw, you are asked for fees or taxes first. Stop paying anything more. Money demanded in order to release money is a sign of a scam.

• Not being on a warnings list: A firm missing from the warnings lists is not necessarily legitimate, because the lists only include cases already detected. Also confirm the firm appears in the official registers of authorised firms.

Frequently asked questions

Where do I check whether a crypto platform is registered in Spain?

Check the Banco de España register of crypto-asset providers, which works together with the CNMV (Spain's securities regulator) under the EU crypto rules. Also search the platform's name on the CNMV warnings list. A platform missing from both registers should not get your money.

Should I pay a fee to get my lost investment money back?

No, do not pay anyone a fee to recover lost investment money, because offers of recovery for a fee are a known scam in themselves. Real help does not ask for money upfront. Report what happened through the official channels instead.

What if a firm is on another country's warning list but not on a Spanish one?

Treat a firm named on another country's regulator warning list as unsafe, even if Spanish lists do not mention it. The lists only cover cases already detected, and scammers move between countries. Do not send money until you have checked the European (ESMA) warnings too.