If you have lost money in a fake cryptocurrency investment and are now contacted by a law firm, a so-called recovery agency, or a supposed police officer promising to return your funds in exchange for a commission or advance taxes, it is almost certainly another scam. The CNMV, the Bank of Spain, the National Police, the Civil Guard, and European supervisors all describe the same pattern. Here is how it works and how to check in minutes whether the person contacting you is authorized.
- Advance-fee fraud: Victims are asked to pay fees or taxes upfront before any refund, which never materializes.
- Impersonation of authorities: Scammers pose as police, tax officials, or financial supervisors, sometimes using the CNMV’s name.
- Verification is key: Always check official registers (CNMV, Bank of Spain, ESMA, IOSCO) before handing over any money.
This fraud has a name: recovery room. The CNMV defines it in its 2023 guide Estafas y fraudes as companies that contact victims of financial scams, supposedly to manage the recovery of their losses or to buy back securities purchased from unauthorized entities. The supervisor sums it up with a phrase that is hard to improve: it is a fraud built on a previous deception, often committed by the same entity or the same people.
My reading is that it is one of the cruellest scams in the catalogue, because it exploits not greed but the desperation of someone who has already lost money and is hoping for news.
How does the recovery room scam work?
It works by charging upfront for a refund that never arrives. Contact comes by phone, email, social media, or messaging, sometimes with details of what you lost, because, according to the CNMV, these scams may come from the same fraudulent outfit that tricked you or from third parties who have bought lists of affected people.
The script is repeated across official sources:
- They ask for money before returning anything. The CNMV notes that an advance payment in the form of fees or taxes, as a prerequisite for recovering a failed investment, is a sign that you are dealing with a recovery room. Its recommendation is blunt: never make an advance payment for this type of service.
- They impersonate an authority. The three European supervisory authorities (EBA, EIOPA, and ESMA) warn in their fact sheet on crypto-asset fraud, published on 15 December 2025, that the scammer may present themselves as police, a tax authority, or a financial supervisor and offer a refund in exchange for a commission. They add a reminder worth reading twice: having been scammed does not prevent you from being scammed again.
- They use the CNMV’s name. The supervisor insists that it never contacts potential victims directly nor authorizes anyone to use its identity or corporate image to recover losses.
The mechanism is illustrated by the Ministry of the Interior, which on 7 April 2025 announced a joint operation by the National Police and the Civil Guard against an organization accused of having scammed more than 19 million euros from 208 victims through fake cryptocurrency investments. According to the statement, first came ads with celebrities manipulated by AI; when the victim wanted to withdraw the money, they were told it was blocked and that another deposit was needed to release it; and finally, those who had already reported the crime received a communication from fake Europol agents or fake UK lawyers claiming they had recovered the money and that only the taxes of the country where it was held remained to be paid.
The six detainees were charged with fraud, money laundering, and document forgery within a criminal organization, and a court in Alicante remanded the alleged leader of the group in provisional prison. These were charges at the investigation stage, not convictions: all those under investigation are presumed innocent.
How do I check if the person contacting me is authorized?
Verify the entity in official registers, not on the website sent by the interested party. The CNMV recalls that you should never give money to an intermediary without checking that they appear in the registers of the CNMV, the Bank of Spain, or the Directorate-General for Insurance and Pension Funds, and that you should also check whether the supervisor has published a warning about them.
The specific steps:
- Search for the entity in the CNMV register and pay attention to its corporate name, web domain, address, and registration number. The CNMV warns that some companies and websites appear in its register with the word clone, because they impersonate authorized entities with almost identical URLs.
- Call the CNMV investor helpline on 900 535 015, which according to its guide provides information on whether an entity is authorized to provide investment services and which still appears on its inquiries page as of November 2026.
- If crypto-assets are mentioned, consult the ESMA register. The European authorities refer to the European Securities and Markets Authority register to check whether a crypto-asset provider is authorized in the EU. ESMA publishes a provisional MiCA register with a specific file of crypto-asset service providers, updated weekly; in early November 2026, the latest update was from 30 October.
- Check the international alert list. The European fact sheet also cites I-SCAN, IOSCO’s alert network where supervisors from different countries publish warnings about suspicious entities.
If the company does not appear, appears as a clone, or has a warning against it, you already have your answer. We have already covered how to perform this same check when faced with ads featuring celebrities who “recommend” investing, which are often the first link in the chain.
What to do instead of paying a recovery agent
The alternative is not magic, but it does not cost you more money. The CNMV guide admits that if you have already given money to a fraudulent outfit, it will not always be possible to recover it, and therefore insists on two things: report the facts to the supervisor and file a complaint with the Police, the Civil Guard, or the court, providing all documentation that proves the services contracted and the amounts. Such complaints, it adds, enable warnings that protect other investors.
The European fact sheet adds, for cryptocurrencies:
- Cut off contact with the scammers, ignore their calls, and block the sender.
- Change the passwords for all your accounts, not just one, because leaked credentials are bought and tested across multiple services.
- Revoke permissions from suspicious smart contracts on your wallet and, if it is compromised, move whatever remains to a new one.
- Notify your crypto-asset provider through its official channels. The authorities acknowledge that in most cases the blockchain transaction cannot be reversed, but the provider could freeze the scammer’s account if it is on their platform.
The CNMV says it bluntly for the case of the fraudulent outfit that asks for more money after supposed losses: what is really dangerous is continuing to make contributions, because that capital will not be recovered either. The logic is the same as in the WhatsApp task scam or in romance scams on dating apps: every new payment they ask you for to “release” the previous one is money you are also going to lose.
A rule for the fridge door: no Spanish or European authority will call you to return money in exchange for you paying first. The CNMV does not seek out victims, and a supposed Europol agent asking you to pay taxes to release your money is exactly the script described by the National Police and the Civil Guard in 2025. If someone offers to recover what you lost and the first step is a transfer, you are not looking at a rescue but at the second chapter of the same scam. It is worth telling today to anyone you know who has already fallen once.