Financial fraudFake CSSF intervention
This exploits the credibility of the country's financial regulator. The fraud generally happens after or alongside an initial investment/crypto fraud.
The victim is contacted by someone claiming to represent the CSSF.
The fraudster tells the victim that their funds have been:
- recovered;
- frozen;
- identified;
- protected;
- placed under regulatory supervision.
The victim is then told that they must pay something before the funds can be released.
The CSSF has specifically warned about fraudsters impersonating the CSSF and requesting payments described as taxes, insurance premiums, account-opening fees or other charges.
Concrete example
An investor has already lost money through a fraudulent investment platform. Several weeks later, they receive an email from someone claiming to be a CSSF official. The message contains the CSSF logo and refers to the victim's previous investment. The fraudster claims that the CSSF has identified €40,000 belonging to the victim and that the money can be released after payment of a €2,000 “regulatory tax”. The victim makes the payment. The fraudster subsequently demands another fee.
The amounts in this illustration are hypothetical; the fraud mechanism reflects the pattern described by Luxembourg authorities.
Red flags,
stop if
- You receive an unexpected message from someone claiming to be a CSSF official.
- The sender uses the CSSF name/logo but the email address or website cannot be independently verified as official.
- You are asked to pay a “CSSF fee”, tax, AML charge, release fee or deposit to recover or unlock your money.
- You are told that the CSSF has frozen your funds and that payment is required to release them.
- You are told that the CSSF has recovered your lost investment and you must pay before receiving it.
- You receive a “CSSF certificate”, recovery document or case number that you cannot independently verify.
- You are asked for your banking password, OTP, crypto seed phrase, private key or other sensitive credentials.
- You are asked to install remote-access software or are prevented from contacting the CSSF directly.