Eurojust raid on fake trading platforms: more than 100 servers seized, seven arrests

Investigators from seven countries struck an alleged supplier of fake trading platforms on November 3, 2026. The authorities searched 17 locations, seized more than 100 servers and arrested seven suspects, who are to be surrendered or extradited to Germany. The case was led by the public prosecutor's office in Itzehoe. For you as an investor, one point matters most: the scam built on supposed crypto, forex and stock platforms carries on, even if part of the technology behind it has been switched off. Looking up a platform yourself before the first transfer protects your money more reliably than any raid.

The figures in this article come from the Eurojust press release of November 3, 2026. Eurojust is the EU agency for criminal justice cooperation; it coordinates cross-border proceedings between the public prosecutors of the member states. All suspects are presumed innocent until proven guilty by a final judgment.

Raid on fake trading platforms: 17 searches in seven countries

Authorities from Germany, Cyprus, Finland, Albania, Israel, Kosovo and North Macedonia took part on the action day. On the German side, Eurojust names the cybercrime unit of the public prosecutor's office at the Itzehoe regional court and the State Criminal Police Office of Schleswig-Holstein. Europol supplied analysis, cross-checked data against its own databases and sent digital forensics experts to Albania and Kosovo.

According to the agency, 17 locations were searched, including a call centre in Kosovo. Besides the more than 100 servers, investigators secured further evidence and assets. The authorities put the damage caused by the fraud system at more than four million euros. The press release does not say how many victims there are or how many of them live in Germany.

In legal terms, the cooperation ran through European Investigation Orders, European Arrest Warrants and orders to freeze assets. A European Investigation Order is a tool that lets a prosecutor request searches or interviews in another EU state without going through the slow channels of classic mutual legal assistance. Two joint investigation teams worked together via Eurojust: one with German, Polish and Albanian authorities, a second with Albanian and Kosovar ones.

Crime-as-a-service: one supplier builds scam sites for call centres

At the heart of the case is a business model that investigators call crime-as-a-service. It describes a division of labour in which one provider supplies the technology for crimes and other groups use it. According to Eurojust, a company based in Cyprus and Israel is alleged to have provided fraudulent websites to various criminal groups. Investigators identified groups in Albania, Kosovo and North Macedonia as alleged clients of this company; they are suspected of running fraudulent call centres. Eurojust does not name the company.

For investors, this division of labour matters. A platform that looks professional, with price charts, a customer account and a chat window, proves nothing about its legitimacy. If one firm supplies such interfaces as a construction kit to several gangs, many similar sites appear under changing names. When one disappears, the next is already waiting under a new name. That is why memorising individual brand names helps little; checking official registers is more reliable.

A married couple's complaint: how the case started in 2022

It all began with a criminal complaint in Germany. In 2022, a married couple had invested their savings through an online platform and were then unable to withdraw the profits shown on screen. According to Eurojust, this single complaint led to investigations that uncovered an internationally organised system with victims around the world.

A first international action day led to two arrests and the seizure of extensive evidence. While analysing it, investigators came across seven further suspects, including the alleged heads of the call centres. A second action day in 2025 brought more arrests, and the authorities secured evidence and money. Only the analysis of this second operation led investigators to the supplier of the websites, and so to the raid of November 3.

The case shows that a complaint can make a difference even when the sums are small. The couple do not automatically get their money back because of this raid. Whether and when victims are compensated depends on the frozen assets and on the further criminal proceedings, and the press release says nothing about that. Without the first complaint, however, the investigation would never have existed.

The scheme behind fake trading platforms: phantom profits and pressure on the phone

Eurojust describes the process as follows. The fraudsters promised huge profits in a short time from trading cryptocurrencies, foreign exchange and shares. After a small first deposit, victims saw heavily inflated gains in their customer account, so that the platform looked genuine. The supposed brokers then put investors under psychological pressure to transfer further large sums. Anyone who wanted to withdraw their profits was strung along with excuses. In the end, the perpetrators vanished with the money.

A phantom profit is an account balance that exists only on the screen. In reality the platform buys no coins and no shares; it simply shows you numbers that the operators set themselves. That is exactly why the start feels so convincing: the first small withdrawal sometimes even works, because it builds trust for the big transfer.

The call centres are the second building block. A friendly account manager calls every day, knows your balance and always has a new opportunity. Often the next suggestion is to install remote-access software so that he can help with the set-up. With that access, criminals can trigger transfers in your online banking or read out data. We described similar patterns in our report on Operation Herakles in September, in which investigators had the phone numbers of scam call centres shut down.

Warning signs on online trading platforms: five features of many fake sites

No single feature proves fraud. But if several of the following come together, you should not transfer another euro.

• Guaranteed or very high returns: Promises such as double-digit profits per month do not exist at genuine exchanges and brokers, because nobody there can promise how prices will move.
• The contact comes from outside: The first step was an advert featuring a celebrity, a messenger message or a phone call, not your own search for a provider.
• No entry in a register: The provider names no licence, or one that you cannot find in any official register.
• Withdrawal only against a fee: Before paying out, the platform suddenly asks for taxes, fees or an unlocking charge that you are supposed to transfer in advance.
• Time pressure: The adviser insists that an offer is only valid today, or warns that your account will otherwise be blocked.

The fourth sign is particularly reliable. A legitimate provider deducts fees from your balance and does not ask for a new transfer so that you can get your own money back.

MiCA licence and BaFin authorisation: how to recognise legitimate crypto providers

The Markets in Crypto-Assets Regulation, MiCA for short, is the EU regulation that makes crypto service providers subject to authorisation. Anyone who holds, exchanges or brokers crypto-assets in the EU needs a licence as a crypto-asset service provider. Forex and share trading are in any case subject to the licensing requirements of financial market law. Our overview of the obligations under the MiCA licence explains what these requirements involve in detail.

The check takes only a few minutes. In the BaFin company database you can search by company name; it shows whether a firm holds a licence from the German supervisor or may operate in Germany on the basis of a licence from another EU state. What counts is the exact name of the company in the legal notice, not the brand name on the website. If you find nothing there, or the address differs, that is a strong warning sign. BaFin also publishes warnings about providers operating without authorisation.

The reverse route is simpler: you choose your provider yourself from a list that contains only licensed firms, instead of checking a provider that approached you. Our comparison of regulated crypto exchanges lists platforms licensed in the EU, including fees and deposit protection. If you want to trade shares, ETFs and crypto together, you will find regulated alternatives in our crypto broker comparison.

How to protect yourself from fake trading platforms

What happened: On November 3, 2026, authorities from seven countries, led by the public prosecutor's office in Itzehoe, searched 17 locations, seized more than 100 servers and arrested seven suspects. According to Eurojust, the target was a company from Cyprus and Israel alleged to have supplied scam sites to call-centre gangs; the authorities estimate the damage at more than four million euros (as of November 3, 2026).

Are you affected? You may be affected if in recent years you sent money to an online platform for crypto, forex or share trading that came into play after a cold call or an advert and that delays withdrawals. The authorities have not published which sites the supplier built. If you trade with a licensed exchange or bank that you chose yourself, you are not affected by this case.

1. Check the register before transferring: Search for the company name from the legal notice in the BaFin company database before you send any money.
2. No remote access: Never install programs such as AnyDesk or TeamViewer at an account manager's request, and never pass on codes from your online banking.
3. No upfront payment for withdrawals: Never transfer fees or taxes to a platform so that it releases your balance; end the contact at that point.
4. Secure the evidence: Save bank statements, chat logs, phone numbers and screenshots of the customer account before the site goes offline.
5. Police and bank: Report the case to the police and inform your bank immediately so that it can try to recall the transfer.

Our guide How to store crypto safely explains the basics of secure storage, and our hardware wallet comparison looks at suitable devices.

Lost money to a fake platform: report to the police and recall through your bank

If you have already transferred money, every hour counts. A SEPA transfer cannot simply be reversed, but your bank can ask the receiving institution for a recall. That only works while the money is still there. If you paid by credit card, ask your card issuer about a chargeback. Payments in cryptocurrencies offer no such route; what remains is the police report with the transaction data, meaning the recipient address and the transaction ID from your wallet or exchange.

You can file a report at any police station, and in most German states also through the online police service. Take the secured evidence with you or upload it. The Itzehoe case shows that investigators can link individual reports to other cases, even over years. And if a platform showed you profits that never existed, a tax question arises too; we covered it in our piece on phantom gains from investment fraud and the tax office.

Recovery scams after the fraud: the second wave hits the same victims

After a raid like this, victims are often contacted by supposed helpers. This second scheme is known as a recovery scam: alleged law firms, detective agencies or even fake officials promise to recover the lost money and ask for an advance payment. The victims' contact details often come from the same data sets that the first gang already used.

Genuine law enforcement agencies do not ask victims for money to pay out seized assets. Eurojust explicitly warns on its own website against fraudsters posing as agency staff. Anyone who writes to you after November 3 claiming to work on this case and offering help for a fee wants to defraud you a second time. You can get information on your own case from the police station where you filed your report.

Fake trading platforms: no BaFin entry, not a single euro

The raid hit one supplier, not the whole industry of investment fraudsters. Three steps are enough to assess the next offer safely:

1. Choose your trading venue yourself from a vetted list, for example our comparison of regulated crypto exchanges, instead of following a caller.
2. For trading shares, ETFs and coins together, pick a provider from the broker comparison and check it against the BaFin register before your first deposit.
3. Do not leave larger holdings on a platform permanently; store them yourself. Our hardware wallet comparison shows which devices are suitable.

(As of November 8, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)