Theft of CSSF’s identity – increase in fraud attempts

Published on 31 July 2025 Email this Share this on LinkedIn Share this on Facebook Communiqué Theft of CSSF’s identity – increase in fraud attempts (published on 31 July 2025, examples updated on 11 August 2025) The Commission de Surveillance du Secteur Financier (CSSF) warns the public of a significant increase in fraud attempts involving the usurpation of the CSSF’s identity. Consumers are contacted by fraudsters pretending to be representatives of the CSSF in order to request tax payments, refund/recovery fees or other undue payments. The CSSF was recently informed of a number of cases in which consumers who had invested in crypto-assets were contacted by persons pretending to act in the name of the CSSF. Fraudsters mainly used the following methods to convince consumers to transfer their money to them: Account opening or account management fees: upon the initial investment of a small sum that generated significant profits, fraudsters required the transfer of a larger amount of money which was allegedly necessary to open an operational account. Payment of an insurance premium: fraudsters claimed that the payment of an insurance premium to the CSSF was required to benefit from investment loss or theft coverage. Payment of taxes: fraudsters pretended that investment profits could only be released upon the upfront payment of a fee or tax to the CSSF or other authorities. Recovery Scam: fraudsters targeted consumers who had already been scammed in the past or lost money in connection with crypto-asset investments, claiming that the CSSF recovered all or part of the lost crypto-assets or funds which would be transferred back to the victim upon the upfront payment of administrative fees or taxes to the CSSF. We reiterate that the CSSF, in its function as supervisory authority of the financial sector, never contacts consumers to ask for tax or fee payments, or any other type of payment. Moreover, the CSSF has no competence in tax matters, it does not provide fund recovery services, and it does not manage financial instruments or crypto-asset accounts on behalf of any third party. Contact: sg@cssf.lu You will find hereafter a few examples of ongoing fraud and scam attempts. 31 July 2025 - Updated on 11 August 2025 Theft of CSSF’s identity – examples Studies and reports PDF (1.06Mb) PDF (1.06Mb) PDF (1.06Mb) Main topic: About the CSSF Relevant for Consumer protection Exemples de tentatives de fraude / Examples of fraud attemps/ Beispiele von Betrugsversuchen Exemple 1 / Example 1 / Beispiel 1 : Exemple 2 / Example 2 / Beispiel 2 : Exemple 3 / Example 3 / Beispiel 3 : Exemple 4 / Example 4 / Beispiel 4 : Sehr geehrter Herr XXXXX, mein Name ist XXXXX und ich wende mich in offizieller Funktion im Namen der Commission de Surveillance du Secteur Financier (CSSF) an Sie – der zuständigen Aufsichtsbehörde für Finanzdienstleister und Zahlungsinstitute im europäischen Raum. Im Zuge mehrerer Rückerstattungsanträge aus verschiedenen Ländern hat die CSSF Untersuchungen zu Online-Finanzbetrug eingeleitet. Dabei wurden unter anderem Fälle von Geldwäsche, unautorisierter Nutzung von Kundengeldern sowie weitere Verstöße gegen geltendes Finanzrecht identifiziert. Im Rahmen dieser Ermittlungen konnte ein Betrag in Höhe von 17.203,96 USDT (ca. 15.000 EUR) festgestellt werden, der mit einer Wallet verknüpft ist, welche Ihrer Person zugeordnet wurde. Diese Mittel befinden sich aktuell in einer gesicherten blockchainbasierten Verwahrungseinheit. Um Zugang zu beantragen und Ihre Ansprüche zu verifizieren, bitten wir Sie, den untenstehenden Button zu verwenden und folgende Angaben bereitzustellen: – Vollständiger Name – Geburtsdatum – Genutzte Krypto-Börsen der letzten zwei Jahre – Bei der Registrierung verwendete E-Mail-Adresse – Namen der betrügerischen Plattform(en) Antrag stellen Zur Freigabe der Mittel kann zudem die Vorlage von Dokumenten erforderlich sein, die Ihre rechtmäßige Eigentümerschaft belegen. Zur Unterstützung des Prüfprozesses kann eine chronologische Darstellung der Ereignisse angefordert werden. Alle eingereichten Angaben werden ausschließlich zu Verifizierungszwecken verwendet und ohne Ihre ausdrückliche Zustimmung nicht in gerichtlichen Verfahren gegen Dritte genutzt. Commission de Surveillance du Secteur Financier 283, route d'Arlon – L-1150 www.cssf.lu BP : L-2991 Luxembourg TVA LU17756005 Exemple 5 / Example 5 / Beispiel 5 : Exemple 6 / Example 6 / Beispiel 6 : ----- Message transféré ----Date: XXXXXXX De: XXXXXX Pour: XXXXXXX Objet: Commission de Surveillance du Secteur Financier (CSSF) Moien, XXXXXXX. Am Kader vun hirer lafender Aarbecht fir d'Iwwerwaachung vun Investitiounsplattformen an no enger detailléierter Analyse informéiert Iech d'Commission de Surveillance du Secteur Financier (CSSF) iwwer Folgendes: Mir hunn Fongen identifizéiert, déi mat Ärem Numm verbonne sinn, déi virdru verluer gaange sinn oder als Resultat vun Transaktiounen op enger bestëmmter Investitiounsplattform blockéiert goufen. Dës Verméigen goufen offiziell am Kader vum Reguléierungsprozess registréiert a kënnen elo legal zréckginn. Mir verstinn, wéi wichteg finanziell Stabilitéit fir Iech ass, a mir versécheren Iech, datt de Réckgabprozess am Aklang mam Gesetz an ënner der voller Kontroll vun der CSSF duerchgefouert gëtt, mat all Sécherheetsa Transparenzstandarden. Äntwert w.e.g. sou séier wéi méiglech op dëse Bréif, fir datt mir de Prozess fir d'Erëmbezuelung vun Äre Fongen ufänke kënnen. -XXXXXXXX Ënnersich Departement Commission de Surveillance du Secteur Financier (CSSF) 283, route d'Arlon L-1150 Luxembourg Exemple 7 / Example 7 / Beispiel 7 : Exemple 8 / Example 8 / Beispiel 8 : Exemple 9 / Example 9 / Beispiel 9 : Exemple 10 / Example 10 / Beispiel 10 : Dear, XXXXX! We are writing to you on behalf of the Commission de Surveillance des Sectors Financiers (CSSF) in relation to an earlier notification regarding the need to undergo a statutory audit as part of the asset recovery procedure. � We would like to remind you that the basic cost of the audit is EUR 2,500. However, due to non-compliance with the due date (until 16 July, 2025) and lack of receipt of funds, a penalty of EUR 500 is applied to the current amount, in accordance with CSSF administrative regulations. � Updated terms and conditions: -Total amount payable: 3,000 EUR -BTC address for payment: XXXXXXXX -Final payment deadline: 31 July, 2025 (inclusive). � Please note: If the payment is not fixed by the specified date, the refund procedure will be terminated and the status of your request will be transferred to archive. Re-activation of the process is only possible through a formal re-application and review of the application from scratch. We count on your understanding and adherence to deadlines. If necessary, our team is ready to provide you with prompt support. Regards, Commission for the Supervision of the Financial Sector (CSSF) Exemple 11 / Example 11 / Beispiel 11 : Commission de Surveillance du Secteur Financier (CSSF) Grand-Duchy of Luxembourg Official Notice of Commencement of Investigation Date: XXXXXXXX Case number: XXXXXXXX To: Subject: Suspicion of violation of the EU Market Abuse Regulation (EU MAR) - use of insider information Dear XXXXXXXX We hereby inform you that the Luxembourg Financial Sector Supervisory Commission (CSSF), in accordance with the provisions of Regulation (EU) No 596/2014 of the European Parliament and of the Council (Market Abuse Regulation), has opened a preliminary investigation regarding your possible use of insider information in the process of acquiring/selling financial instruments on the stock market. Full name: Commission de Surveillance du Secteur Financier Country: Grand Duchy of Luxembourg Official website: https://www.cssf.lu Commission de Surveillance du Secteur Financier (CSSF)Grand-Duchy of Luxembourg 283, route d’Arlon, L-1150 Luxembourg Email: XXXXXXXX Tel: +352 26 25 1 -1 OFFICIAL NOTICE OF PAYMENT REQUEST Date: XXXXXXXX File number: XXXXXXXX Addressee: XXXXXXXX As part of a preliminary administrative investigation under EU Regulation No. 596/2014 (EU MAR), you are ordered to pay a provisional security in the amount of: EUR XXXXXXXX within 3 working days of receipt of this notice. Purpose of payment: Ensuring compliance with the administrative procedure, which analyzes the sources of possible market abuse. CSSF bank details: Beneficiary: XXXXXXXX IBAN: XXXXXXXX BIC/SWIFT: XXXXXXXX Bank: XXXXXXXX Destination: XXXXXXXX Attention: Failure to receive the specified amount may be considered as evasion of cooperation with the regulator and may result in the strengthening of the sanctions regime and referral of the case to the Luxembourg prosecutor's office. For identification of the person making the transfer, it is necessary to provide: Passport data: Sender's signature: Surname First name: _____________________ Signature_________________ Gender: _____________________ Date and place of birth: _________________________ Registration at the place of residence: ______________________