BaFin Warning: What Happens When You Enter Your Data on an AI Crypto Platform

You entered your phone number and your email address into a contact form on a website because an AI-powered crypto trading platform was advertised there. In that case, in the assessment of the German financial supervisor, you very probably never contacted a trading platform at all. You filled in an advertising page whose purpose, according to BaFin's findings, is to collect contact details and pass them on to operators of unauthorized online trading platforms.

BaFin published this assessment on September 23, 2026, together with the names of 39 websites. The most important sentence in it for you is this: the damage does not begin with the first transfer, but at the moment the form is sent. From then on your record exists as tradable goods.

The short version, if you are in exactly that situation right now: pay no money. For the time being, do not take calls from unknown numbers, or end them after the first sentence. Secure the website address, the date and every message you have received. Everything else follows below, ordered by what you have already done.

What BaFin published on September 23, 2026

The Federal Financial Supervisory Authority, BaFin for short, is the German authority supervising banks, insurers and, since European crypto regulation, providers of crypto-asset services as well. The authority is allowed to issue a public warning when it suspects that someone is operating without authorization.

On September 23, 2026 it reported what it calls a platform series. In the language of supervision, a platform series is a group of near-identical websites that differ only in their name and very probably come from the same source. In this case there are 39 addresses, appearing mostly in bundles of three: the same invented name as .com, .net and .org.

The authority describes the mechanism itself as follows: interested parties "are asked to leave their data in a contact form on the websites concerned. According to BaFin's findings, the customer data is then passed on to operators of unauthorized online trading platforms that are not supervised by BaFin." The pages are therefore suspected of "primarily serving to initiate business for crypto-asset services provided without authorization."

Two further findings appear in the same notice. First, according to the supervisor the websites have no legally valid imprint. Second, BaFin points to a possible connection with further series it has already warned about. It names the operators themselves as unknown.

If you want to know what these series looked like in the summer of 2026, the background is in our article on the BaFin warnings about crypto platform series from August. The construction of the pages is known. What is new is their business model.

Why the contact form is more dangerous than the first transfer

The familiar fraud patterns in crypto almost always run through money: you pay in, you see rising gains in a customer area, and when you try to withdraw, demands for payment appear for supposed fees, taxes or releases. That is the scheme consumer advice centers and police have been describing as cybertrading fraud for years.

The series reported now starts one step earlier. On the authority's account the websites take no money at all themselves. What is generated are leads. In sales jargon a lead is a qualified contact record: name, phone number, email, often along with how much someone wants to invest. That record is worth considerably more to the buyer than any random address, because it documents a demonstrated interest in crypto investments.

Three things follow from this that make the difference to the classic scheme.

The contact comes with a delay. Days or weeks can lie between sending the form and the first call, because the record is resold first. Many of those affected therefore no longer connect the call with the page they filled in.

The record stays in circulation. It can be passed on repeatedly. A single completed form can draw calls for months, including from providers that have nothing to do with the original website.

And the page itself disappears without consequence. With no imprint, no named operator and no payment relationship, there is nobody against whom you could assert a claim. That is exactly why securing the evidence stands at the start of this article rather than the question of compensation.

BaFin classifies the approach soberly as business initiation. For you as a crypto investor that means: the valuable part of the business has already taken place before anyone has even spoken to you.

Which 39 websites BaFin names

The authority publishes the addresses with the dot in brackets so that they are not clickable. We reproduce them in the same notation. According to its own account, these are the pages known to BaFin so far:

coravelis(.)com · jorvaki(.)com · jorvaki(.)net · jorvaki(.)org · levorelio(.)com · levorelio(.)net · levorelio(.)org · lexovario(.)com · lexovario(.)net · lexovario(.)org · loravexo(.)com · loravexo(.)net · loravexo(.)org · mavriten(.)com · mavriten(.)net · mavriten(.)org · monvaret(.)com · monvaret(.)net · monvaret(.)org · natrovex(.)com · renvaki(.)com · renvaki(.)net · renvaki(.)org · semtovexo(.)org · solkrane(.)com · solkrane(.)net · solkrane(.)org · tavorello(.)com · tavorello(.)net · tavorello(.)org · varezuno(.)com · varezuno(.)net · varezuno(.)org · vordeli(.)com · vordeli(.)net · vordeli(.)org · zarevuno(.)com · zarevuno(.)net · zarevuno(.)org

Two things can be read from the list that go beyond the individual case. The names are pronounceable invented words without meaning, which mean nothing in any language and can therefore be registered worldwide. And the bundles of three across .com, .net and .org are an indication that the loss of individual domains was planned for from the outset.

Important for your own check: this list is a snapshot. BaFin explicitly writes "known so far" and points to possible connections with further series. If the website you visited is not listed here, that is no clean bill of health. Conversely: if it is listed here, you hold an official assessment that you can present to a bank or the police.

Section 10(7) of the Crypto Markets Supervision Act: the legal basis of the warning

By its own account the notice rests on section 10(7) of the Crypto Markets Supervision Act, abbreviated KMAG in German. The detail looks technical, but it explains why the warning looks the way it does.

The Crypto Markets Supervision Act is the German act accompanying the European regulation on markets in crypto-assets, known as MiCA. It governs who may provide crypto-asset services in Germany and which powers the supervisor has in doing so. Those powers include informing the public about providers suspected of operating without authorization.

The logic of the wording follows from this. The authority writes "according to BaFin's findings" and "are suspected of" because a warning under this provision is not a court ruling and does not require one. What is meant is a supervisory assessment intended to protect consumers before proceedings are concluded. For you that means two things: the warning is solid enough to use towards third parties, and at the same time it is not a criminal finding against named individuals.

The reverse conclusion is what matters in practice. Banking business, financial services and crypto-asset services may only be offered in Germany with an authorization. Anyone offering crypto-asset services without that authorization is acting unlawfully, irrespective of whether anyone was harmed in the end.

How to spot a lead page before you send the form

According to the supervisor's account, the pages warned about share features that can be checked without specialist knowledge. The following points are no substitute for legal advice, but they are worked through in a few minutes.

The imprint. BaFin names the missing legally valid imprint as a shared feature of all 39 pages. A valid imprint contains a name that can be served with legal process, an address, a commercial register number and a contact option that actually works. A bare contact form is not an imprint. Nor is a mailbox address without a register entry.

The authorization status, with one important objection. Check the company name given in BaFin's company database. It shows whether a company is authorized. A hit alone is not enough, however. On its page about fraudulent trading platforms the supervisor explicitly describes how perpetrators pose as staff of reputable companies that are listed in the commercial register or supervised, misusing the names and details of uninvolved firms. From that follows the only check that holds: take the phone number and the address from the database, not the ones from the website, and ask there whether the contact was genuine.

What the page asks for. An authorized trading platform lets you open an account and then identifies you. A page that offers nothing but a contact form and no route to direct registration is collecting contacts, not trading.

The promise. Software that supposedly achieves reliable returns through artificial intelligence does not exist. Where predictable profits are advertised, caution is not an overreaction. How credibly such offers are now presented is described in our article on AI-driven crypto crime.

Where the contact came from. Did the page arrive through an advertisement on a social network, through a message in a messenger app or through a post that looked like a news report? All three routes are common with the series reported. A detailed checklist for providers is in our guide on how to check crypto providers before your first deposit.

What is actually traded on these trading platforms

Anyone who gets drawn into a conversation is rarely offered what the advertising promised. BaFin describes the typical course of these trading platforms in its consumer section, and you should know three points from it before you even think about it.

What is traded is mostly contracts for difference, not coins. A contract for difference, CFD for short, is a bet on the price movement of an underlying without you ever owning that underlying. On the supervisor's account, the supposed advisers push people into such products on commodities, equities, indices, currencies or cryptocurrencies. Anyone who believes they are buying Bitcoin is acquiring no crypto-assets in these cases.

The money runs through a wallet that is not yours. For payment processing, according to BaFin, those affected are told to set up an account at an online trading venue; the money paid in is converted into Bitcoin, and the coins then end up in the criminals' wallet. Sometimes the payment destination given is the account of a private individual who receives the money and forwards it. For that person the process has legal consequences of its own, because anyone making their account available comes under suspicion of money laundering. Never let your account be used for third-party payments, not even for a commission.

Remote access is the point at which it becomes expensive. The offer to support you through the process by remote maintenance software leads, according to the supervisor, all the way to access to your online banking and the opening of accounts and wallets in your name. There is no reason to share your screen with a provider. An authorized exchange never asks for it.

The practical counter-test is simple and works in every one of these cases: demand the wallet address on which your crypto-assets are supposed to sit, and check it in a blockchain explorer. Without verifiable transaction data on a blockchain there are no coins, only a display on a website. The details are with the supervisor itself: a warning about fraudulent trading platforms.

Already entered your data? These five steps count now

If no money has changed hands, your position is considerably better than it feels. The most likely damage is a record in circulation, and something can be done about that.

First: document before anything disappears. Note the full website address, the date and time of your entry and the details you gave. Make a screenshot of the page while it is still reachable. This evidence can neither be obtained nor reconstructed later.

Second: submit nothing further. Send no copy of your ID, no bank details, no wallet addresses and no screen sharing. The request to install remote maintenance software for "verification" is a known pattern and leads to direct access to your devices.

Third: handle calls in a controlled way. You do not have to pick up. If you do pick up, say nothing about your financial circumstances and confirm no data, not even apparently harmless details such as your date of birth. A simple "not interested" and hanging up is entirely sufficient.

Fourth: separate your credentials. If you set a password on the page that you also use elsewhere, change it everywhere immediately. Activate two-factor authentication on your exchange and email accounts, preferably through an app rather than by text message.

Fifth: report the warning. If the website is not on the list, you can report it to BaFin through its contact channels. It costs nothing and is the route by which further series come to light in the first place.

What you do not need in this situation are paid recovery services. As long as no money has changed hands, there is nothing to recover.

The callback: what happens on the phone and what you do not say

The call is the actual sales process, and it follows a recognizable course. Knowing it takes the pressure out of it.

At the start there is almost always a friendly stocktaking: how much experience do you have, what amount could you commit, which cryptocurrencies interest you? These questions feel like advice and are an assessment. The answers decide how intensively the contact is pursued.

Then comes a small entry amount, often in the region of 250 euros, combined with the promise that you can withdraw at any time. The sum is deliberately low, because it lowers the inhibition threshold while establishing a payment relationship.

In the third step a customer area displays gains. That display is a representation on a website and no evidence of actual crypto transactions. Anyone who wants to know whether trading really took place needs verifiable transaction data on a blockchain, that is, wallet addresses that can be checked independently.

Finally comes the point at which the withdrawal fails and demands for payment appear: supposed fees, supposed taxes, supposed release amounts. From here on, police and consumer advice centers describe the process consistently as investment fraud.

Three sentences are enough for the entire conversation. You name no amounts. You confirm no data. You hang up. No reputable provider loses a customer that way, and an unauthorized provider loses access.

A postscript on the second wave: after a loss, supposed recovery services, law firms or consumer advocates often get in touch, offering to retrieve the money. These callers draw their contacts from the same lists. An advance payment for a recovery is as a rule the second loss.

What rights the General Data Protection Regulation gives you against unknown operators

Formally you hold the rights under the General Data Protection Regulation against anyone who processes your personal data. In practice the position with these pages is uncomfortable, and it is fairer to say so openly.

The right of access under Article 15 GDPR obliges a controller to tell you which data it processes about you and to whom it has passed the data on. The right to erasure under Article 17 GDPR obliges it to delete the data when there is no longer a legal basis. Consent once given can be withdrawn at any time.

Both presuppose that a reachable controller exists. With websites that have no legally valid imprint and unknown operators, that is precisely what is missing. A request for access sent to a contact address on these pages leads nowhere at best, and at worst confirms that a reachable person sits behind the address.

Two routes remain worthwhile nonetheless. The first runs through the data protection authority of your federal state, where you can file a complaint. That body has investigative powers you do not have. The second concerns the companies that contact you afterwards: whoever calls you and gives a company name is a tangible controller. Against that caller you can object to the processing, demand information about the origin of your data and require erasure. It is precisely that information which makes the chain of transfers visible.

Record the outcome in writing. A documented refusal can be used by the supervisory authority; a phone call without a note cannot.

Money has changed hands: criminal complaint, bank and complaint to BaFin

If payment has already been made, the order changes. Then speed counts, and the first hours are the most valuable.

Turn first to your bank or payment service provider. With card payments and direct debits there are recovery options tied to short deadlines. With bank transfers the bank can attempt a recall as long as the amount has not yet left the recipient account. Banks look closely at crypto transactions in any case, which works in your favor here.

Then file a criminal complaint with the police, online or at a station. Bring everything you have secured: addresses of the website, names and phone numbers of the callers, payment receipts, screenshots of the customer area and, if available, the wallet addresses to which crypto-assets have gone. Those addresses are often the most solid trail for investigators, because transactions on a blockchain remain permanently traceable.

Report the matter to BaFin as well. The supervisor will not get your money back for you, but tips from the public are the basis for warnings like the one of September 23. The report runs through the authority's contact channels and costs nothing.

To the tax office, because the scheme works with exactly that. One of the most frequent demands before a supposed payout is that a tax must be paid first. That is in no case how it works in Germany. Taxes on investment income or private disposal transactions are settled with the tax office through your tax return, never as an advance payment to a trading platform. No authority and no bank demands money so that a balance is released. Whether and how fictitious gains and actual losses from a fraud case have tax effects is a separate question, which we have covered in our article on phantom gains in crypto investment fraud. Settle it with a tax adviser, not with the caller.

And once more, because it is the most expensive mistake after the first one: pay nothing in order to obtain a payout. No commission, no release fee, no advance tax payment. A demand of this kind is not an obstacle on the way to your money, it is the point of the whole exercise.

Where to buy instead: MiCA authorization and the company database

The practical consequence of a warning like this is not to avoid cryptocurrencies. What makes sense is to check the provider before the first click, and since European regulation there is a solid basis for that.

A company that provides crypto-asset services in the European Union needs an authorization for it. Authorized providers appear in public registers, are subject to requirements on the custody of customer assets and have a complaints office that can be reached. A company listed there may still charge fees you dislike. But there is a company with an address, a register entry and a supervisor.

Three checks are enough in practice. Does the exact company name appear in BaFin's company database or in the register of the competent European supervisor? Does the imprint lead to an address that can be served with legal process, with a commercial register number? And are you identified before you can trade? Anyone answering yes to all three questions has passed the basic check. An orderly comparison is in our overview of regulated crypto exchanges.

The second part concerns custody. If you want to hold Bitcoin for longer, the question of where the keys sit is more important than any fee table. How the price has developed and which assessments are circulating is set out in our Bitcoin price prediction. How to secure holdings independently of an exchange is shown by the hardware wallet comparison. A provider without authorization can offer you neither, because in case of doubt it does not trade at all.

BaFin warning on the AI crypto platform: what to take away

1. Check the provider before you enter anything. An imprint with an address that can be served with legal process, the exact company name in the company database, identification before the first trade. If you are looking for regulated points of contact, you will find them in the comparison of regulated crypto exchanges.
2. If you have already left data, secure the evidence and submit nothing further. Website address, date, screenshot. After that no copy of your ID, no bank details, no remote access, no payment. Which features unauthorized providers share is set out in the guide to checking crypto providers.
3. Separate custody and trading. What you hold long term does not belong permanently in an account whose operator you cannot identify. The options for that are in the hardware wallet comparison.

The full notice with all 39 addresses is with the supervisor itself: BaFin warns about the platform series "AI-powered crypto trading platform".

(As of September 25, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)