Victims who already lost money to a trading desk are prime targets for a second act: a solemn letter from something that sounds like a financial supervisor. Sometimes it clones a real body — the European Securities and Markets Authority (ESMA) has published clear guidance that genuine mail ends in @esma.europa.eu, phones start with France’s +33, and the only website is esma.europa.eu. Sometimes the brand is invented entirely: a “global coalition”, a private “licensing entity”, or a “financial commission” with a freemail inbox and a WhatsApp inspector.
The ask is almost always the same. Pay a tax, unlock fee, AML clearance or “apostille” in crypto; open an account on a lookalike foreign bank site; join a “secure” group chat with supposed officials. Real supervisors do not cold-message you to recover funds for a fee, and they do not partner with random Telegram lawyers. Domains that paste regulator initials onto odd TLDs (-uk.net, -certify.org, .icu mail hosts) are a tell. So are staff handles that add an extra letter to a famous acronym.
Check the organisation through its published website and national directories — not through a link in the chat that drained you. For the broader pattern see fake financial regulators and lookalike regulator domains. Save the headers, do not pay the “case fee”, and report through ordinary police and banking channels.
If this sounds familiar, start at Get help. If someone is already selling a paid “fix”, read Fake recovery before you send another fee.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.