On 15 October 2026 Italy’s market regulator Consob ordered internet providers to block ten more websites: five offered investment services without authorisation, five offered crypto services without a licence. According to Consob, that took the number of sites it has blacked out since July 2019 to 1,848, of which 240 were crypto-related. A block covers a domain, not the people behind it.
That is the problem with fake crypto investment platforms: the site itself proves nothing. It has a live price chart, a support chat, a dashboard where your balance grows every day. In the United States, the FBI’s Internet Crime Complaint Center counted 61,559 complaints about crypto investment fraud in 2025 and $7.228 billion in reported losses, its 2025 report says, the largest single source of losses reported by Americans that year.
The short answer to “is this crypto platform legit?” is a routine, not a feeling. Before you send money, check that the exact company is on the official register of a regulator you look up yourself (the ESMA interim MiCA register in the European Union, the FCA register in the UK, the CFTC and your state regulator in the US), check that the web address matches the one on that register, and treat any request for a fee or tax before a withdrawal as the end of the conversation. The eight steps below take about fifteen minutes, and none of them depends on anything the site tells you.
The overview of every scam type is in our guide to avoiding crypto scams, and the previous lesson of this path, on pig butchering and romance scams, follows the relationship that often leads a victim to a fake trading app. This one is about the platform itself and how to test it. Facts are as of October 2026; nothing here is investment advice.
Why a fake crypto investment platform looks real: clones and borrowed faces
A fake platform is cheap to build and cheap to rebuild. On 3 April 2026 Consob ordered the blocking of 32 sites in one go, and its notice shows how the operators spread their bets: a single brand, “Oxelvian”, ran on five domains at once, ending in .it, .net, .io and .tech, plus a variant with “-it.net”. Block one and the others keep taking deposits. Consob adds that blocking can take a few days to work, because each Italian internet provider has to apply it.
Clone sites go one step further. Instead of inventing a brand, they copy a real, licensed company: its name, logo, sometimes its registration number and its address. The UK Financial Conduct Authority warns that some firms “pretend to be authorised firms”, and tells consumers to use only the contact details shown on its own Firm Checker, never the ones a caller or a website gives you. Figures released by the City of London Police, the UK’s lead force for fraud, on 7 April 2026 put investment fraud of all kinds at £879.8 million lost in 2025, across 34,673 reports, a 31% rise in reports on the year before, Police Professional reported. The force said criminals were using professional-looking websites and even cloned branding.
Even regulators get cloned. In September 2022 the French Autorité des marchés financiers (AMF) warned that domain names containing its acronym had been registered with “under construction” pages, which it read as preparation for phishing campaigns. If the watchdog’s own name can be registered by someone else, so can any broker’s.
Then come the faces. In its April 2026 notice Consob said online fraud increasingly relies on cloned emails and websites, fake profiles of politicians and celebrities, and content generated by artificial intelligence such as images, voices or videos. The FCA says crypto scams are often advertised on social media, sometimes with famous faces, and that reports to it about these scams “have more than doubled since 2020” (FCA). The FBI received more than 22,000 complaints in 2025 that mentioned AI, with adjusted losses above $893 million.
The ads are run at scale. In an operation run in two phases in October and November 2025, police in Belgium, France, Germany, Spain, Cyprus, Malta, Bulgaria and Israel went after a network that, according to Europol, processed more than 700 million euros; one target was its advertising arm, including social media campaigns that used impersonation and deepfake content, eucrim reported on 12 January 2026. A polished landing page with a famous face on it comes out of that kind of operation.
What fake platforms cost: the latest official counts
These figures come from the agencies that collect complaints. They count only what victims reported, so real losses are higher.
| Source | Period | What is counted | Figure |
|---|---|---|---|
| FBI IC3 (report of April 2026) | 2025 | All complaints / all losses | 1,008,597 / $20.877 billion |
| FBI IC3 | 2025 | Crypto-related complaints / losses | 181,565 / $11.37 billion |
| FBI IC3 | 2025 | Crypto investment fraud | 61,559 complaints / $7.228 billion |
| FBI IC3 | 2025 | Recovery scams | 10,516 complaints / $1.4 billion |
| FBI IC3 | 2025 | Complaints mentioning AI | 22,000+ / over $893 million |
| City of London Police (release of 7 April 2026) | 2025 | UK investment fraud, all types | 34,673 reports / £879.8 million |
In the IC3 data, people aged 60 and over reported $2.76 billion of the crypto investment fraud losses, across 13,685 complaints, more than any other age group.
Step by step: how to check if a crypto platform is legit before you send money
Run these checks in order. Many fake platforms fail at step 1 or step 3, so you will rarely need all eight; a licensed company passes them without effort.
- Write down how the offer reached you. An unsolicited message, a social media ad, a celebrity video, a stranger who “made a fortune” or an adviser who found you first is already a warning, whatever the site looks like.
- Find the exact legal name of the company behind the site, its country and its licence or registration number, in the terms of service or the footer. A line saying “regulated” or “licensed” without a name and number is not evidence.
- Look that legal entity up on the official register of a regulator, opening the regulator’s site from an address you type yourself: the ESMA interim MiCA register in the EU, the FCA Firm Checker in the UK, the CFTC and your state securities regulator in the US.
- Compare the website listed on the register with the address in your browser, character by character, and use the contact details from the register, not those on the site.
- Check when the domain was registered with a registration-data lookup, and see what the site leaves out: a postal address you can verify, a named management, a complaints procedure.
- Search the name and the domain on the warning lists: the AMF blacklist, Consob’s blocked sites and warnings, the FCA Warning List, the CFTC RED List, your state regulator’s alerts and IOSCO’s I-SCAN.
- Read what the platform asks of you. Payment only in crypto, transfers to a personal wallet or a private person’s bank account, a countdown, guaranteed returns or a fee to withdraw are each enough to stop.
- If everything checks out, start small and test a withdrawal before you add anything, and never move more than you can afford to lose. A clean result on these checks is a minimum, not a recommendation to invest.
Steps 1 and 2: the origin of the offer and the name behind the brand
Where the offer came from settles most cases. The IC3 describes the standard path: contact by text message, social media, ads or dating apps, then a quick move to a messaging app, then a “platform” (IC3 2025). Real exchanges advertise, but they do not assign you a personal coach on WhatsApp who tells you where to click. If someone you have never met in person sent you the link, the check is mostly over.
Step 2 matters because a brand is not a company. Real crypto groups run several legal entities under one name, some licensed in the EU, some based elsewhere and licensed nowhere. Clones copy the brand and sometimes the legal name too. So write down the full legal name, for example a “GmbH”, “Ltd” or “S.p.A.” with a country, and the registration or licence number. If the site gives none, or gives a company registered on a small island that you cannot find on any regulator’s list, you have your answer.
Anywhere in the EU: the ESMA interim MiCA register
The EU’s transitional periods under the Markets in Crypto-Assets regulation (MiCA) ended on 1 July 2026. In a statement of 17 April 2026, ESMA had warned that after that date any entity providing crypto services to EU clients without a MiCA licence “will be in breach of EU law and must cease offering such services”. Its advice to consumers is one line: “Check that the company you are using is listed as authorised in the ESMA Interim MiCA Register before you invest or transfer funds” (ESMA, 17 April 2026). The background to the rules is in our guide to the MiCA regulation.
The register is not a search box. As of 24 October 2026, ESMA’s MiCA page publishes it as downloadable CSV files, updated weekly (last update 22 October 2026). The file that matters here is CASPS.csv, the list of authorised crypto-asset service providers; NCASP.csv lists entities flagged as non-compliant. Both open in any spreadsheet, where a text search finds a name. The CASPS file we downloaded on 24 October 2026 had 387 rows for 384 distinct legal entity identifiers, with columns for the authority, the home country, the legal name, the commercial name, the address, the website, the authorisation date, the services and the countries where the firm may operate.
Four traps catch first-time users:
- Match the legal entity and its address, not the brand. ESMA itself warns that protections apply only to “the specific authorised legal entity in the EU”, not to other companies of the same group, and that one brand may cover several companies.
- Do not trust the website column blindly. National authorities type it in, and it contains slips: the row for Coinbase Luxembourg S.A. read “https.//coinbase.com” in our copy. Use the entry to confirm the company, then confirm the domain on that company’s home regulator’s site.
- A firm licensed in one country may serve others. A reader in France or Italy can legitimately find a provider authorised in Malta, Ireland or Austria; the countries it may serve are listed in the same row.
- An authorisation is not a quality label and does not rule out a clone using the same name. That is why steps 4 and 5 exist.
For English speakers living in the EU, this register decides, whatever your nationality. ESMA’s advice if your provider is not authorised is to act promptly: move your assets to an authorised provider or to a wallet you control yourself, or consider closing your positions. If you are weighing that choice, our lesson on crypto wallets explains what self-custody involves.
France: the AMF whitelist and blacklist
In France, since 1 July 2026 only crypto-asset service providers authorised under MiCA (PSCA), or financial firms that notified the AMF under the regulation’s Article 60, may serve French clients; the old PSAN registration alone no longer allows it. Providing these services without authorisation is punishable by up to two years in prison and a 30,000 euro fine, the AMF recalled on 5 February 2026. The AMF’s whitelists let you filter authorised providers (category PSCA) and download them as CSV or PDF. Check the ESMA register too: a provider authorised in another EU country can serve French clients under a passport.
The other side is the blacklist: actors named by the AMF for crypto, forex, crypto derivatives and impersonation of regulated firms. The AMF says these lists cannot be exhaustive. Its release of 8 July 2026 added 16 newly identified sites, bringing the crypto names added since January to 38.
Italy: Consob’s blocked sites, warnings and the end of the OAM register
Consob has been able to order the blocking of unauthorised investment sites since July 2019, and since MiCA it uses the same power for crypto sites. Its Occhio alle truffe section links to the lists of authorised firms and to its warnings to savers, and its information line is 06 8477611. The running total of blocked sites:
| Consob notice | Sites blocked that day | Total since July 2019 | Of which crypto-related |
|---|---|---|---|
| 3 April 2026 | 32 | 1,654 | 168 |
| 10 July 2026 | 6 | 1,769 | 219 |
| 15 October 2026 | 10 | 1,848 | 240 |
One trap is specific to Italy. Before MiCA, crypto firms registered with the OAM, the body that keeps the register of virtual-currency operators. Italy’s transition for those firms ended on 30 June 2026 at the latest, one day before the EU-wide deadline, according to Banca d’Italia. That day Consob and Banca d’Italia said nine entities were allowed to operate as Italian providers: eight authorised CASPs (CheckSig, Conio, CryptoSmart, Hercle, Hodlie, Olliv Italia, Riv Digital and Young Platform) and Banca Sella, a bank that notified. They also told savers to check “quale entità giuridica fornisce in concreto blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool diverge, compared with simply holding the same tokens in a wallet. It becomes permanent when the provider withdraws.">il servizio”, which legal entity actually provides the service (Consob). A site whose only credential is an old OAM registration is showing you something that no longer counts.
United Kingdom: the FCA Firm Checker and Warning List
The FCA asks you to type its Firm Checker address yourself rather than follow a link, search the firm, and check that the firm reference number (FRN) and contact details match what you were given. Its Warning List names firms and individuals running scams or operating without authorisation, and you can sign up for daily email alerts. Two caveats apply. The FCA says most crypto activities are not regulated in the UK, so you generally will not have access to the Financial Ombudsman Service or the FSCS compensation scheme. And a name missing from the Warning List proves little, since scam firms can change names faster than any list is updated.
United States: the CFTC RED List, state regulators and the FTC
The CFTC’s RED List names foreign entities that appear to be acting in a capacity that requires CFTC registration but are not registered. A listing, the agency stresses, “does not mean that the CFTC or a court has concluded” that a violation occurred, and a firm that is absent should still be checked for registration. It names digital currencies, forex and binary options among the areas with many complaints. The most recent entry we saw on 24 October 2026 was dated 29 May 2025, so treat the list as a reference, not a live feed.
State securities regulators often move faster. Washington’s Department of Financial Institutions publishes alerts on sites impersonating real brokers, one of which is the case study in the withdrawal-fee section below. The FTC sums up the test in six words: “Only scammers demand payment in cryptocurrency” (FTC). Before choosing any exchange, our guide to choosing a crypto exchange lists what a legitimate one discloses.
The registers and lists side by side:
| Where | Tool | What it lists | Main limit |
|---|---|---|---|
| EU | ESMA interim MiCA register (CASPS.csv, NCASP.csv) | Authorised crypto providers; non-compliant entities | CSV files, weekly; match the legal entity |
| France | AMF whitelist (PSCA) | Providers allowed in France | Not real time |
| France | AMF blacklist | Unauthorised sites, impersonators | Not exhaustive |
| Italy | Consob blocking orders and warnings | Sites blocked in Italy | Clones return on new domains |
| Italy | OAM register | Former crypto operators | No longer proof since 30 June 2026 |
| UK | FCA Firm Checker and Warning List | Authorised firms; known scams and clones | Most crypto not FCA-regulated |
| US | CFTC RED List | Unregistered foreign entities | Not a legal finding, not updated daily |
| Worldwide | IOSCO I-SCAN | Warnings from many regulators | Only what regulators have flagged |
Blacklists are always late: why a clean result proves nothing
A blacklist records the sites a regulator has already seen. A fake crypto investment platform launched last week is on none of them, and a blocked brand can reopen on a new domain, as the Oxelvian case shows. That is why the AMF and the CFTC both warn that their lists are incomplete, and why the joint ESMA leaflet on AI-driven fraud, published in Italian by Consob, sends readers to the authorisation registers as well as to I-SCAN.
The two tools do different jobs. A whitelist or register answers the question that matters, “is this exact company allowed to serve me?”, and a yes has to be matched to the legal entity and the domain. A blacklist can only confirm a bad answer you already suspect. A hit on a blacklist ends the check; a miss on every blacklist moves you to the next step and nothing more.
Check the domain: age, spelling and what the site leaves out
A registration-data lookup (the RDAP protocol that replaced most WHOIS services, available through ICANN Lookup or the registry of each top-level domain) shows when a domain was registered and through which registrar, even when the owner’s name is hidden for privacy. We ran one on 24 October 2026: the Verisign registry gives coinbase.com a registration date of 2 July 2011. A “broker with ten years of experience” whose domain was created three weeks ago has told you something its marketing did not.
Read the result with care. The creation date belongs to the current registration, not to the business, and an old domain proves nothing: expired names are bought back and reused. Country domains such as .it or .fr are looked up on their national registry. What the lookup gives you is a contradiction test, not a certificate.
Spelling is an even cheaper check. Clone sites rely on an extra letter, a hyphen, a swapped top-level domain (.io instead of .com) or a country suffix bolted on, the way “oxelvian-it.net” sat next to “oxelvian.it”. The ESMA leaflet lists spelling errors in the address among its red flags, along with a professional-looking site that has no verifiable contact or company registration details. Once you have confirmed the real address on the regulator’s register, bookmark it and use only the bookmark, never a sponsored search result or a link in a message.
Look at what is missing, too. A licensed provider names its legal entity, its supervisor and its complaints procedure, and asks you to verify your identity before you trade (the KYC checks of any regulated exchange). A site that takes your deposit without any identity check is not behaving like a regulated provider. How a real platform holds client funds is explained in our guide to centralised exchanges.
The withdrawal fee trick, in detail
Most victims of fake crypto investment platforms find out at the same moment: when they try to take money out. Regulators on both sides of the Atlantic describe the sequence in almost the same words.
It starts with a deposit and a dashboard. The victim sends crypto or a bank transfer, and the account shows gains that look modest at first, then impressive. The IC3 says victims of crypto investment fraud are “shown fake profits and offered loans to encourage larger investments” (IC3 2025). The balance on the screen is a number in the operator’s database; nothing behind it is yours.
Then comes the request to withdraw everything, and the platform finds a reason it cannot pay yet. The label changes from case to case: a tax on profits, a commission, a verification or compliance charge, an account upgrade, a “release” of frozen funds. The amount is set so that it seems reasonable compared with the balance on screen. According to the FBI, at this stage the victims “will be charged taxes and fees as a final attempt to exploit money from the victims” before the scammers disappear with everything.
A real case shows the arithmetic. On 6 February 2026 Washington’s DFI published an alert about a site impersonating the broker Avatrade. A senior investor met a person calling herself “Olivia Harper” online, moved the conversation to WhatsApp, and was persuaded to wire $10,000 abroad and invest on the fake site. The account soon showed $35,000. To withdraw, the victim was told to pay a further $7,700 in fees, although “Harper” had said before the investment that fees would be deducted from the profits. When the victim pushed back, access to the site was cut and the contact blocked them. The DFI notes it has not verified the details and cannot help recover lost crypto.
Paying releases nothing, because there is nothing to release: the gains were never real. Each payment also shows the operator that you will pay again, so the next demand arrives under a new name. And legitimate platforms do not work this way. A real exchange takes its fees from your balance, shows them before you trade, and lets you withdraw what is in your account. In the US, tax on crypto gains is something you report to the IRS on your own return; no tax authority collects it through a trading platform’s support chat, before a withdrawal, in crypto.
The trick also has a second life after the platform vanishes. In December 2025 Consob warned about fake emails, sent from addresses using its name, that offered to recover funds lost on past investments or to release sums and crypto held in foreign accounts or wallets, in exchange for money, backed by forged Consob documents (Consob). The FTC says the same of fake investment sites in general: you may be unable to withdraw at all, “or only if you pay high fees”. A request to pay before you can withdraw your own money is the moment to stop, not to negotiate.
Urgency and pressure: the script behind the clock
Fake platforms sell time pressure because checking takes time. The joint ESMA, EBA and EIOPA leaflet on financial fraud in the age of AI, published in Italian by Consob, lists “an urgent request” for money among its warning signs, along with promises that are too good to be true, payment by means that are hard to trace such as crypto or gift cards, and requests to install an app or scan a QR code (ESMA leaflet, Consob edition).
The pressure takes familiar forms. A bonus that expires at midnight. Only three places left in a “VIP” trading group. An account manager who calls every day and gets upset when you hesitate. A warning that your account will be frozen, or that you will lose your profits, or even face a fine, unless you pay today. Each of these is designed to stop you doing step 3.
The move to a private messaging app, WhatsApp in the Washington case, belongs to the same script: there, no platform moderates anything and one person controls the conversation.
Many victims never feel the pressure at all, because they trust the person applying it. Under Operation Level Up, launched in January 2024, the FBI notified 3,780 victims of crypto investment fraud in 2025, and 78% did not know they were being scammed when agents contacted them. A licensed provider can wait a day while you check it. A fake one cannot.
You already paid: what to do in the first 24 hours
Speed matters most here, because money still in the banking system can sometimes be stopped. Crypto sent on-chain to a scammer’s wallet usually cannot be pulled back, but an exchange it passed through may be able to freeze it if you report quickly.
- Stop paying, whatever the platform says about fees, penalties or deadlines, and do not install any software or give remote access to anyone who offers to help.
- Save the evidence: screenshots of the site and your balance, the chat history, the website address, wallet addresses, transaction hashes, bank references and the names and numbers used.
- Call your bank or card issuer at once through the number on your card or its official app, report the fraud and ask whether a recall of the transfer is possible.
- If the money went through an exchange, report the fraud to that exchange with the transaction details and the destination address.
- Change the passwords of your email and financial accounts, and never type your seed phrase anywhere a stranger asks for it.
- Report the scam to the police and to the regulator of your country, listed below.
The bank call is worth making even if you think it is too late. In 2025 the IC3’s Recovery Asset Team worked on 3,900 incidents involving $1.16 billion in attempted transfers and froze about $679 million, a success rate of 58%, according to its annual report. That process covers bank wires reported quickly, not crypto already sent on-chain. “Time is of the essence,” the FBI writes, and it asks victims to file at ic3.gov with full transaction details. The protection of your wallet itself is covered in our lesson on seed phrase security.
Where to report, by country. In the US: the IC3 (ic3.gov), the FTC (ReportFraud.ftc.gov), the CFTC (CFTC.gov/complaint), the SEC (sec.gov/tcr) and your state securities regulator, as the FTC lists them. In the UK: Report Fraud, which replaced Action Fraud in December 2025, on 0300 123 2040, and the FCA on 0800 111 6768. In France: the AMF’s Epargne Info Service on +33 1 53 45 62 00 (weekdays, 9:00 to 12:30), and a complaint to the police or gendarmerie. In Italy: the Polizia Postale online reporting service, Consob’s helpline on 06 8477611, and a formal complaint to the police.
The second scam: recovery services that charge up front
After a loss, a new contact often appears offering to get the money back: a “lawyer”, a “blockchain investigator”, an official from a regulator or the police. They ask for a fee first. The IC3 recorded 10,516 complaints about recovery scams in 2025 with $1.4 billion in losses, a figure that may include the earlier losses that led to the contact, and it reports fictitious law firms targeting crypto scam victims.
European regulators have published the same warning with their own names attached. On 3 February 2025 the AMF said people posing as its staff were contacting crypto scam victims, and stated that it “ne propose pas de procédure de recouvrement de fonds dérobés”: it offers no procedure to recover stolen funds, and never contacts savers on its own initiative by phone or private message (AMF). On 21 February 2025 Consob described fake lawyers using its name and logo who claimed it had hired them to recover money lost on trading sites, and who asked victims for a fee or a “tassa” before vanishing (Consob). The FCA calls the pattern a recovery room scam.
Neither the AMF nor Consob recovers money for savers, and the AMF says it never contacts them first. Seizing and returning stolen funds is work for the police and the courts, and a genuine lawyer does not cold-call victims with a guarantee. The ESMA leaflet ends its section on recovery rooms with a reminder that being scammed once does not mean it cannot happen again.
