In the district of Zwickau, an elderly man transferred around 193,000 euros to accounts in Lithuania and Bulgaria after watching a video created with AI. The Zwickau Police Directorate reported this on 15 September 2026. The same release contains a further case: after an investment fraud, a man looked for a lawyer online and lost more money to a supposed law firm. Both cases follow the same sequence in three stages.
Three stages, one sequence
The cases described by police and supervisors run in a similar way: bait creates interest, a platform shows profits that do not exist, and after the loss supposed helpers come for a second round. German police crime prevention (ProPK) describes cybertrading fraud and warns that the perpetrators later get in touch as investigators or lawyers (recovery scam). The three stages are our own division.
Stage 1: the bait
The bait arrives as a video, a call or an invitation to a chat group. BaFin, the German financial supervisor, lists advertising on the internet and on social media as the first of its ten warning signs for dubious investment offers. It writes that fraudsters use the names of celebrities without their consent to recommend supposed investment systems. Unwanted calls often follow.
AI videos with familiar faces
The Zwickau Police Directorate described such a case in May 2026: a 77-year-old woman came across a video on the internet, presumably generated with AI, in which “celebrities” talked about finance. She made contact via a link, and the perpetrators then phoned her. She transferred money to foreign accounts several times and lost 50,750 euros. The voice and face in a video tell you nothing about whether the person shown knows the offer.
Supposed pre-IPO shares
Pre-IPO shares are stakes sold before a company goes public. On 22 September 2026, the Austrian platform Watchlist Internet warned about a supposed Swiss financial services provider called “Prime Equity Partners” that offered pre-IPO shares in OpenAI by phone and email for 622 euros each.According to Watchlist Internet, such shares do not exist, not even in a pre-IPO form. According to Watchlist Internet, private company stakes sold before an IPO are aimed at qualified investors. Small private investors generally have no access to them. Watchlist Internet lists further irregularities:
- Founding year and domain do not match. The website states 2015 as the founding year. The domain was registered in June 2026.
- The address is wrong. The company cannot be found at the stated address in Zurich. The legal notice lacks a company register or VAT number, and no responsible persons are named.
- The escrow account is left open. The amount is to be transferred within five banking days. Which account to use would be communicated later.
- The contract does not fit the provider. The subscription form names German law and Frankfurt am Main as place of jurisdiction, although neither the provider nor OpenAI is based in Germany.
- The form collects data. It asks for date of birth, tax identification number and bank details. ID and proof of residence are to follow later.
The German consumer advice centres describe the same scam for WhatsApp groups. There, interested people are sometimes asked to transfer directly to an IBAN that is often foreign. Regularly the shares do not exist, or no IPO takes place.If investors are told to send crypto assets to the fraudsters’ wallet, the consumer advice centres say the money is lost, because the wallet’s owner can hardly be identified.What is still possible with a card or a bank transfer is explained under Credit card and chargeback and Money transferred. Before you transfer, you can match an IBAN against reported fraud cases in our IBAN check.
Stage 2: the platform
According to police crime prevention, there is usually no trading on the platform; the software only shows fictitious transactions and profits. You are looked after by “traders” who phone from call centres and, after a first small deposit, push for larger sums. Four features recur in the warnings from police, BaFin and the consumer advice centres:
- Small profits to start. The consumer advice centres write that small profits are sometimes shown at first and in some cases even paid out. This builds trust.
- An adviser on the phone. Support runs via phone and messenger. BaFin advises against using messenger services for investments.
- Remote access to your computer. The adviser wants to help with opening the account using remote access software. According to BaFin, perpetrators can read out login details this way. In the Zwickau case from September, the money went to an account in Lithuania after such access.
- Payout only against payment. Before the payout, taxes, fees or insurance are demanded. Sometimes a money laundering suspicion is faked.
Police crime prevention advises: “Do not transfer any more money, not even for supposed fees, taxes or commissions in order to have profits paid out.” The man in his late 40s from the district of Zwickau noticed the fraud at this point, when he was asked to pay a tax on profits that had not yet been paid out.
Stage 3: recovery scam, the second wave
A recovery scam means: after the loss, supposed law firms, investigators or authorities offer to get the money back for an advance payment. In the Zwickau case, a supposed law firm added the man to a messenger group that allegedly included other victims. There it was claimed that his money was held at an Asian casino. To get at it, he was told to pay in several times. In total he transferred around 100,000 euros to foreign accounts.
The perpetrators find their victims in two ways. They run online ads for people searching for help. And they use data from the first fraud. Olesja Jäger of the consumer advice centre of Hesse says fraudsters act “deliberately and often with data they already hold about their victims”.The centre describes a provider with a logo resembling that of an authority, fake customer reviews and a registered office in the Messeturm, a Frankfurt office tower, where the company does not exist.
Recovering money lost through fraud is not one of BaFin’s tasks. It does not commission third parties to do so either and does not approach individuals on its own initiative.
This is what BaFin writes in its consumer notice of 4 May 2026. On 15 September 2026, it additionally warned about calls made under its own phone number in which unknown persons ask for money to be transferred. Police crime prevention points out that the offers of help often come from the same group as the first fraud.
What domain age shows: 28 addresses from one BaFin warning
We counted how young the domains of such platforms are, using a current warning. On 29 September 2026, BaFin warned about a series of almost identical websites that it groups under the heading “AI trading platform”. The list contains 28 addresses. According to BaFin, they have no valid legal notice and pass the data from the contact form on to operators of unauthorised trading platforms.
On 3 October 2026 we looked up the registration date of all 28 addresses via the public registration data service (RDAP). All 28 were registered between 3 July and 23 September 2026. On the day of the warning, the oldest was 88 days old and the youngest six days. 13 of the 28 date from September. The consumer advice centre of Hesse names the same check for recovery offers: “A website that was registered only recently is a strong indication of fraud.”
Checking a platform: four lookups before the first deposit
Whether a provider is allowed to conduct financial business is recorded in the registers of the supervisory authorities.
- Look up the licence.
In Germany, banking business, financial services and crypto-asset services require authorisation from BaFin. Whether a company is authorised is shown in BaFin’s company database. For Austria, Watchlist Internet refers to the database of the Financial Market Authority FMA. In Switzerland, FINMA keeps a list of supervised institutions.
- Read the warning lists.
BaFin and FINMA publish warnings about providers without authorisation. Both point out that their lists are never complete. A missing entry therefore does not clear a provider.
- Look at the domain age.
Enter the address in our check. It shows, among other things, the domain age and whether the address is on our warning list. It does not replace the lookup with the supervisor.
- Cross-check the identity.
BaFin frequently reports identity misuse: perpetrators use the names of genuine institutions. Look up the contact details of the genuine company yourself and ask there. For law firms, the consumer advice centre of Hesse recommends a lookup in the official nationwide register of lawyers in Germany.
If you have already paid
After a payment, the order of steps matters. The following steps are based on the guidance from BaFin, police and Watchlist Internet.
- Call your bank.
Ask for a recall of the transfer and have the account blocked if someone had access to your login details. BaFin also names the German blocking hotline 116 116 for this. Details under Money transferred.
- No further payments.
No tax, fee or activation either. Every further payment increases the loss.
- Remove remote access.
Uninstall the remote access software and then change the passwords for online banking and email from a different device.
- Secure the evidence.
Screenshots of the platform and the account balance, emails, chat histories, transfer receipts. How to do this is explained under Securing evidence.
- File a police report.
Online via the police station of your German state, see Reporting offices. The process is described in the article Reporting a fake shop and applies here in the same way.
BaFin and the consumer advice centre of Hesse warn about recovery offers against an advance fee. BaFin does not recover money and does not commission anyone to do so. Police crime prevention writes (our translation): “Consumer advice centres never actively contact affected people.”You can choose a genuine lawyer yourself and look them up in the register of lawyers. If someone gets in touch unasked and demands money first, that fits the recovery scam. Which other scams are currently running is covered in our overview Current scams.
