After a fraud: freezing payments, SEPA recall and chargeback windows, Strafanzeige, BaFin complaints and avoiding recovery scams

What you will learn

• Which payments can still be stopped or recalled, and within which windows.
• The difference between an unauthorised payment and an authorised-but-deceived payment, and why it decides whether your bank must refund you.
• How to file a criminal complaint (Strafanzeige) and a BaFin complaint, and what each can and cannot achieve.
• How to recognise the "recovery room" that targets you after the first loss.

Explanation

Fraud victims lose money twice: first to the scheme, then to delay and to follow-up scams. The response below is ordered by the speed at which options expire. Lessons 1 to 6 of this course explained how the schemes work; this lesson assumes the money is gone and asks what can still be done.

Hour 0 to 24: stop what can still be stopped

Revoke pending orders. A SEPA credit transfer can be revoked only until your bank has received the order; scheduled transfers and standing orders can be cancelled until the end of the business day before execution (German Civil Code, BGB, § 675p). Instant transfers are irrevocable the moment they are sent. Cancel any standing orders or direct-debit mandates to the fraudster and block the cards you used.

Ask for a recall. For executed SEPA transfers your bank can send a recall to the receiving bank. Under the SEPA rulebook a bank-initiated recall for a duplicate, a technical error or a fraudulently originated transfer must be sent within ten banking days; a request for recall by the originator (for example "wrong IBAN" or "customer request") is possible for up to 13 months after the debit, and the receiving bank has several weeks to answer. In both cases the recipient must agree or the receiving bank must still hold the funds; a recall is a request, not a right. Fraudsters move money on within minutes, so the realistic chance falls sharply after the first day. Your bank must nevertheless make reasonable efforts to recover the money and, if that fails, give you the information needed to pursue the recipient yourself (BGB § 675y).

Card payments. Card schemes allow a chargeback for goods or services not delivered; the window is typically up to 120 days from the transaction or the promised delivery date, depending on the scheme and the reason code. Ask the card issuer for the dispute form in writing and keep screenshots of the "investment account". Debit cards are usually covered by the same scheme rules as credit cards.

Direct debits. A SEPA direct debit can be returned without reasons within 8 weeks and within 13 months if no valid mandate existed.

Crypto transfers cannot be reversed. Document the transaction identifiers and the receiving addresses; exchanges that are licensed under the EU Markets in Crypto-Assets Regulation (MiCA) can freeze funds that are still on their platform if the police ask them quickly.

Unauthorised versus authorised payments

This distinction decides whether your bank is liable. If a payment was unauthorised, for example executed by a criminal who phished your login and TAN, the bank must refund it immediately (BGB § 675u) unless it proves fraud or gross negligence on your part. If you authorised the payment yourself, even because you were deceived about the recipient, it counts as authorised and the bank is generally not liable. Since 9 October 2025 banks must run Verification of Payee, which compares the recipient name with the IBAN before a transfer and warns on a mismatch; ignoring a "no match" warning weakens your position. The forthcoming EU Payment Services Regulation, politically agreed in November 2025 and expected to apply from around 2028, adds a refund right only where the fraudster impersonated your own bank and you filed a police report, not for investment or romance scams. Check the current rule.

Day 1 to 7: criminal complaint and documentation

File a Strafanzeige for fraud (§ 263 Criminal Code, StGB). Every federal state offers an online police station (Onlinewache); the complaint is free and you can file it in any state regardless of where the fraudster is. Attach a chronology, all payment receipts, chat exports, URLs, phone numbers and wallet addresses. A police case number (Aktenzeichen) is needed for most bank and exchange requests. Also notify the receiving bank in writing yourself, quoting the case number; receiving banks can freeze an account on suspicion of money laundering. Contact the Verbraucherzentrale of your state for a low-cost legal assessment before hiring a lawyer.

Week 2 onwards: BaFin and civil options

A complaint to BaFin is useful when a licensed firm is involved; BaFin can investigate conduct and sanction the firm, but it does not award compensation and cannot recover money from unlicensed fraudsters abroad. For fake brokers it is still worth reporting, because BaFin publishes warnings that protect others. Civil recovery (unjust enrichment, BGB § 812) against a named money mule in Germany can work for amounts that justify a lawyer; abroad it is rarely economic.

The recovery scam

Within weeks of the loss, expect calls or emails from "fund recovery agencies", "blockchain forensics" firms or a "regulator" offering to retrieve your money for an upfront fee, "tax" or "release charge". The data comes from the original gang. No genuine authority charges a fee in advance, and no one can reverse a crypto transaction. Checking the BaFin and ESMA registers (lesson 3) applies here too: recovery firms are usually not registered anywhere.

Worked example

Hypothetical example: On 30 October Aylin realises that her "trading platform" is a fraud. She paid €12,000 in three parts: €5,000 by credit card 40 days ago, €4,000 by instant transfer three days ago, and €3,000 by standard SEPA transfer yesterday. A "recovery agency" has already offered to retrieve everything for a 10 % fee paid upfront.

1. Card payment: 120-day window minus 40 days leaves about 80 days to open a chargeback for services not rendered. This is her best route; she files it today.
2. Instant transfer: irrevocable; only a recall request with recipient consent remains. She asks her bank for a request for recall anyway (window 13 months) and files the police report so the receiving bank can freeze what is left.
3. Standard transfer sent yesterday: already executed; a bank recall for fraud is sent immediately within the ten-banking-day window. Chance of success depends on whether the funds are still on the account.
4. Recovery offer: 10 % × €12,000 = €1,200 upfront. Expected recovery through this "agency" is zero, so the correct expected value of accepting is −€1,200. She declines and adds the contact details to the police file.

Realistic outcome under these assumptions: up to €5,000 back via chargeback if the issuer accepts the dispute, possibly part of €3,000 if the recall is fast, almost certainly nothing of the €4,000. Her loss is between €4,000 and €12,000 depending on speed, not on how much she pays "helpers".

Common mistake

Practice activity

On paper, build a response timetable for this hypothetical case: Ben paid €2,500 by card 100 days ago, €6,000 by SEPA direct debit 5 weeks ago (he signed a mandate), and €1,500 in bitcoin yesterday. For each payment write: the instrument, the applicable window, the days remaining, the action and the responsible contact. Then answer: which of the three payments has the strongest formal refund route and why?

Key takeaways

• Order your actions by expiry: revoke, recall and chargeback first, then police, then BaFin and civil steps.
• Unauthorised payments must be refunded by the bank; authorised payments made under deception usually are not, so speed and documentation are your only levers.
• The Strafanzeige is free, can be filed online and produces the case number that banks and exchanges need.
• Any offer to recover your money for an upfront fee is a second fraud.

Next step

Not every dispute is a crime; next we cover how to resolve conflicts with legitimate brokers through complaint procedures, the Ombudsmann schemes and cross-border channels.