I have been putting money into a trading platform for six months, the dashboard shows more than 40,000 euros of profit and now the adviser tells me that to withdraw it I first have to deposit 6,500 euros in “taxes”, is that normal? It is not, and you must not pay it, because that fee is the second stage of the same scam and every euro you deposit now is added to the loss under the offence of fraud in article 248.1 of the Spanish Criminal Code. The profit on your screen is a figure typed into a website the perpetrators control, the money you paid in left for third-party accounts from day one, and no tax authority collects tax on a gain before it is declared in the following year’s return. An online investment scam is a property offence prosecuted before the investigating court, and recovering anything depends on securing the trail of the payments before the money leaves identifiable accounts.
Do not pay the fee, export the chats and call the bank
After the tax, the next request will be a “release commission”, then an “anti-money-laundering verification” and then a “capital insurance”. None of these exist at an authorised firm. A licensed broker withholds what the law obliges it to withhold and reflects it in a tax certificate, but it never asks for a fresh deposit to release a balance. The rule that settles the doubt is simple, if you have to pay in order to be paid, you will not be paid.
There are things within your reach this afternoon that replace nobody but stop the case from getting worse.
Export the complete WhatsApp or Telegram conversations with the adviser before blocking him, because blocking first and exporting later usually leaves the chat incomplete. Keep the emails with their headers, the screenshots of the dashboard showing the balance, the platform’s web address, the names and phone numbers they used and the documents they sent you, including any contract or certificate on letterhead. Gather the receipts for every transfer and every card payment, with the date, amount, beneficiary and destination IBAN or institution. If you paid in cryptocurrency, keep the identifiers of each transaction and the address of the wallet you sent the funds to.
Call your bank to attempt a recall of the latest transfers and to block the card if you gave it to the platform. The chances of a transfer coming back fall with every hour, so that call comes before any other step.
If the adviser had you install remote-access software to “help you trade”, uninstall it, change your online banking and email passwords from a different device and check the movements on all your accounts. That access is a separate offence in itself. Do not sign any new document they send you or send another copy of your ID, because that documentation is used to open accounts in your name.
From the first call to the withdrawal screen, how the scam is built
Fake investment platforms come in variants and the pattern repeats with few changes. The hook is an advertisement on a social network with the face of a well-known presenter or businessman, a WhatsApp or Telegram contact offering a group of investment “signals”, a person who has been chatting with you for weeks on a dating app and one day explains how they make money with crypto, or a fake broker with a polished website, a European dialling code and an “account manager” who calls every day.
The first deposit is small, often 250 euros, and the dashboard shows a profit within days. Sometimes a small withdrawal is allowed, and it works, because it is the perpetrator’s investment so that the next deposit is larger. The manager then proposes “leveraged” trades and a “bonus” that is lost if you withdraw, and the balance grows with no relation to any market. When the client asks to withdraw a meaningful amount the second stage begins, the one of taxes and commissions, which can last months and extract more money than the first.
The dashboard is software. The price, the profit and the trading history are written by whoever controls the website, which is why gains appear at weekends or in products that do not trade. The real money took a single route, from your account to the accounts of individuals or companies the perpetrators use as a front, in Spain or in another State, and from there into cryptocurrency or further transfers within hours.
The unlicensed broker and the CNMV warnings
Law 6/2023 on Securities Markets and Investment Services reserves the provision of investment services in Spain to firms authorised and registered with the CNMV or passported from another European supervisor, and empowers the CNMV to publish warnings about those operating without authorisation. That list of “chiringuitos financieros”, boiler rooms, is on the supervisor’s website and is updated frequently, as are those of its European counterparts.
Checking the platform’s name there has evidential value. If the firm appears in a public warning or does not exist in any register, the complaint is stronger, because it removes any argument that there was a genuine investment that went wrong. But do not wait for it to appear before acting, websites are renamed every few months precisely to dodge those lists, and the CNMV does not recover money, its role is to supervise and sanction.
Articles 248, 250 and 74, the sentence according to the total taken from you
Article 248.1 of the Criminal Code punishes as fraud the deception sufficient to lead another person to an act of disposition to their own or a third party’s detriment. The fake platform meets every element, the deception is the appearance of an investment, the disposition is each transfer and the loss is everything paid in, including the second-stage fees. The basic sentence, for losses above 400 euros, is six months to three years’ imprisonment under article 249.
Article 250 aggravates the sentence when circumstances concur that in these cases are almost the norm. Paragraph 1.5 applies if the fraud exceeds 50,000 euros or affects a large number of people, and paragraph 1.6 if there is abuse of business or professional credibility, which is exactly what a fake manager with a website, an invented licence and certificates on letterhead does. In either case the sentence becomes one to six years’ imprisonment plus a fine. If the loss exceeds 250,000 euros, paragraph 2 of the same article raises it to four to eight years.
| Amount defrauded | Provision | Sentence | Limitation period |
|---|---|---|---|
| Up to 400 euros | Art. 249 (minor offence) | Fine of one to three months | One year |
| More than 400 euros | Art. 249 | Six months to three years’ imprisonment | Five years |
| More than 50,000 euros | Art. 250.1.5 | One to six years’ imprisonment and a fine of six to twelve months | Ten years |
| More than 250,000 euros | Art. 250.2 | Four to eight years’ imprisonment and a fine of twelve to twenty-four months | Ten years |
Article 74 matters in these scams because there were several payments. For property offences, its paragraph 2 orders the sentence to be set by reference to the total loss caused, so a series of deposits of 3,000 and 5,000 euros adding up to 60,000 is tried as one fraud of 60,000 euros and not as twenty small frauds. For you this has two consequences, the aggravated classification under article 250 is reached on the sum, and the civil liability the convicted person must pay is fixed on everything that left your account.
That civil liability arising from the offence is the route by which the criminal court, in the same judgment, orders the money to be returned. No separate civil action is needed. What is needed is someone convicted and something that can be seized, and that depends on the trail of the payments having been worked from the start. At the firm we act as private prosecutor in these cases and prepare the complaint with that trail closed, as explained on the page on fraud and scams.
What the bank can contribute when you ordered the transfers yourself
You authorised the transfers to the platform, so they fall outside the refund that payment services legislation imposes on the bank for unauthorised transactions. That closes the most direct route, but not all of them. The same legislation requires institutions to exercise diligence in monitoring unusual transactions, and several Provincial Courts have held banks liable, in whole or in part, where an account with ordinary household movements started sending transfers of thousands of euros to a foreign company and nobody warned, asked or blocked.
Whether that claim is viable in your case depends on the profile of your account, the warnings the bank issued and what you answered when it did, because a customer who confirmed the transfer after the institution warned of the risk is in a very different position from one who was told nothing. How that claim is framed, with which documents and in what order relative to the criminal complaint, is the lawyer’s job. Card payments have their own route through the refund schemes of the card networks, with requirements the bank does not usually explain. The article on bank refunds after phishing sets out the difference between what the bank must refund by law and what it may be liable for through lack of diligence.
Cryptocurrency payments, the exchange and the money mule under article 301
If you bought cryptocurrency on an exchange and sent it to the wallet you were given, the offence is the same and what changes is the evidence. Every blockchain transaction is public and traceable, and exchanges operating in the European Union are subject to customer identification and, since the MiCA Regulation, to authorisation. That allows the court to require the identity of the holder of the account where the funds ended up when they passed through a regulated platform. If the perpetrators moved them to services without identification or to private wallets, the trail remains but identification becomes harder, and it is worth knowing that before spending on experts.
When the payment was a transfer to an account in Spain, the holder exists and can be located. Usually it is a person who handed over their account in exchange for a commission, the so-called mule. Article 301 of the Criminal Code punishes money laundering with six months to six years’ imprisonment and a fine of one to three times the value of the assets, and its paragraph 3 keeps the punishment, at six months to two years, when the conduct is committed through gross negligence, which is the case of someone who lent the account without knowing what money passed through it but with ample reason to suspect. That person is often the only one convicted at the end of the case and therefore the only one whose assets can be seized. If you are the one who lent an account to “receive some payments from the platform” and forward them, you are in that position and need a criminal defence now.
From article 259 to article 110 of the Criminal Procedure Act, what follows the complaint and how long you have to file it
Anyone can file the complaint at a police station, with the Guardia Civil or directly with the court, and article 259 of the Criminal Procedure Act turns into a duty what for you is above all a necessity. Article 13 allows the investigating judge to adopt from the outset measures to protect the injured party and secure the proceeds of the offence, which in these cases means freezing the receiving accounts and exchange balances. That freeze only works if it is requested before the money leaves, which is why a generic complaint filed a week later, without destination IBANs or transaction identifiers, reaches a court with nobody to serve.
Article 110 allows you to join the proceedings as private prosecutor up to the indictment stage. Without that, you are a witness, you receive notice of the dismissal and little else. With it you can propose investigative steps, appeal the dismissal, request seizure and claim civil liability. A criminal complaint drafted by a lawyer and court agent does the same from day one with the legal classification already in place. Which is advisable in each case depends on the amount and on whether there are accounts in Spain or the European Union that can be reached.
As for the court, a broker claiming to be based in Cyprus or Estonia does not shift jurisdiction. In distance frauds the Supreme Court applies the ubiquity doctrine, so the competent court is that of the place where the victim made the disposition, normally their home town. A person in A Coruña files in A Coruña even if the destination account is in Lithuania and the website sits on a server in Singapore. Pursuing those outside Spain goes through the European Investigation Order within the Union and letters rogatory outside it, slow but real instruments, and in many cases the conviction reaches only the mules located in Spain.
The limitation period runs from the last payment. Article 131 of the Criminal Code sets five years for basic fraud and ten for the aggravated offence under article 250, as shown in the table above. There is time to file a complaint, but not to secure the money, which is a matter of days.
When the court dismisses and months later a firm calls promising to recover your money
Provisional dismissal because the perpetrators are unidentified is common and does not close the case, which can be reopened if new information appears while the offence has not become time-barred. What does end with the dismissal are the precautionary measures, so what was not frozen before will not be frozen afterwards.
Months after the dismissal, or even before, a call or email usually arrives from a supposed fund-recovery firm, an “international law firm”, a “cybersecurity agency” or someone claiming to speak for the CNMV, the police or your own bank, with the news that your money has been located and that an advance payment is needed to release it, as a fee, a bond or a verification. This is the third stage. Victims’ data are resold between groups, and the caller knows how much you lost and on which platform precisely because that is where they come from. No public body charges to return money, no court asks for a bond by bank transfer and no lawyer charges a fee to “unlock” funds before seeing the file. The article on bank impersonation scams covers the version where the caller pretends to be your bank. Anyone who has already paid a recovery agent has a second fraud to report, under the same articles.
Frequently asked questions
Can I recover the money I lost in a fake online investment, and when is that realistic?
Yes, and it is realistic when the money is still in identifiable accounts or exchanges when the freeze is requested, when the holder of the receiving account can be located and has assets, or when the bank breached its duty of diligence over unusual transfers. Hiring a lawyer is not worth it for a few hundred euros sent in cryptocurrency to a private wallet; there, the sensible course is to report it and spend no more.
How long do I have to report an investment scam?
Five years from the last payment for basic fraud and ten years for the aggravated offence under article 250, which is the usual one for exceeding 50,000 euros or abuse of professional credibility, because article 131 of the Criminal Code sets the limitation period by the maximum sentence. That period is for reporting; securing the money requires requesting a freeze on the receiving accounts within the first days.
The complaint with the money trail, the first thing to file and who drafts it
The step to take now is a complaint identifying each payment, its destination account and the identifiers of the cryptocurrency transactions, with a request to freeze those accounts and to join as private prosecutor, filed before the money stops being where it is. That is drafted by the lawyer who will conduct the case, because how it is framed determines whether the court has anyone to serve and whether the claim against the bank does not collide with what has been reported. At Perseus & RC Abogados we act as private prosecutor in investment scams and prepare that complaint together with the claim against the bank where it is viable. You can see how we work on the cybercrime page and write to us through contact or call +34 677 841 007.