Scammers are impersonating EU regulators and licensed exchanges to drain crypto from holders still moving assets after the MiCA licensing deadline passed on July 1. The scheme targets customers of firms that failed to win authorization, with fraudsters posing as staff of the regulator or the exchange itself. The French AMF, Dutch AFM and ESMA described the pattern to the Financial Times.
The impersonation playbook
Fraudsters contact customers of companies that missed the cut, pretending to be from the regulator or the exchange. They direct victims to a website or account they control, often with instructions to move funds. The regulators are blunt: they never cold-call consumers with orders to send money to a specific account. If someone claiming to be AMF or ESMA tells you to transfer crypto, it's a scam.
What the June 23 order said
ESMA's public statement on June 23 told unauthorized providers to stop onboarding new EU clients immediately. They can only sell or transfer crypto-assets, reallocate assets, or close positions. Custody can continue only for the period strictly necessary for an orderly exit. That leaves customers of those firms with a choice: move holdings to an authorized crypto-asset service provider or a self-hosted wallet. The register is the place to check.
The numbers behind the surge
As of August 4, ESMA's register lists 322 authorized providers across 26 member states. The rush to get licensed was frantic: 76 firms entered the register in June, 31 in July. OKX's European CEO Erald Ghoos predicted 80% of crypto companies would not survive MiCA. The scam surge is just as steep. Chainalysis says impersonation scams grew 1,400% year over year in 2025, with the average payment jumping from $782 to $2,764. Total crypto scam and fraud losses for the year are approaching $17 billion.
Warnings beyond the EU
It's not just the EU. CryptoPotato reported £2.1 million in Bitcoin taken from a cold wallet after a caller posed as a UK police officer. The FBI warned of a fake token with an 'FBI message' subject line on Tron designed to harvest wallet access. ESMA said national competent authorities may take coordinated action against unauthorized providers. That could mean fines or shutdowns, but for now the advice to consumers is simple: check the register, and don't take instructions from anyone who cold-calls you with a wallet address.
