Germany Scams: Online, Investment & Phishing Fraud Guide
Common scams in Germany and how to report to the BSI, state police, and your bank.
Emergency number: 110 (police), 112 (emergency) — verify on official sources.
Last reviewed: 1 August 2026
Germany experiences significant online fraud including phishing, fake online shops, investment scams, and parcel-fee smishing. The Federal Office for Information Security (BSI) provides consumer guidance and a public cybercrime awareness resource, while actual crime reports should be filed with the state police via their online Onlinewache portals. Investment and crypto fraud can be reported to BaFin (the financial regulator), and the consumer centres (Verbraucherzentralen) maintain a well-known 'Phishing-Radar' cataloguing the fake bank, Sparkasse, DHL, and streaming-service messages currently circulating.
Some scams here have their own household names. The 'Enkeltrick' (grandchild trick) and its modern WhatsApp variant — a message starting 'Hallo Mama, mein Handy ist kaputt' from a 'new number' — extract urgent transfers for a supposed family emergency. 'Falsche Polizeibeamte' (fake police officers) phone elderly residents, sometimes with 110 spoofed on the display, claiming burglars are targeting their savings and that valuables must be handed to a plainclothes 'officer' for safekeeping. Shock calls ('Schockanrufe') about a relative who caused a fatal accident and needs bail follow the same template. Real German police never collect money or valuables and never call from 110.
Online, marketplace fraud on Kleinanzeigen is endemic — fake buyers send phishing links disguised as the platform's 'secure payment' pages, and fake sellers vanish after a Vorkasse (prepayment) transfer. Fake webshops with prices slightly below market collect payment and deliver nothing, and subscription traps convert 'free' offers into recurring charges. Triangle fraud (Dreiecksbetrug) can even entangle innocent buyers in stolen-goods disputes. For investments, cold calls and social ads push clone brokers and crypto platforms; check BaFin's warnings before transferring. When money has moved, call your bank first — SEPA recalls work best within hours — then file with the Onlinewache of your state.
Common scams
- Phishing emails and fake banking portals
- Parcel-fee smishing (fake DHL, DPD texts)
- Investment and crypto fraud
- Online marketplace non-delivery
Tourist-specific scams
- Overcharging unlicensed taxis
- Ticket resale scams for events
- Shell-game and petition hustles around major stations and sights
Online shopping scams
- Fake online shops
- Phishing targeting bank accounts and email credentials
- Subscription trap websites
- Kleinanzeigen 'secure payment' link fraud against sellers
Job scams
- Task scams via messaging apps
- Fake remote-work and data-entry scams
- Money-mule recruitment via 'financial agent' job ads
Romance scams
- Dating-app romance and crypto investment grooming
- WhatsApp 'Hallo Mama' child-impersonation messages
- Long-distance partners with escalating emergencies
Investment scams
- Fake trading platforms and clone firms impersonating licensed brokers
- Crypto and 'AI bot' investment schemes
How to report a scam here
- Contact your bank immediately if money was transferred
- File a cybercrime report with your state police via the Onlinewache portal
- Report cybersecurity issues and get guidance from BSI at bsi.bund.de
- Report investment fraud to BaFin at bafin.de
Local reporting & protection links
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Bank & payment guidance
Contact your bank immediately to attempt to halt or recall a fraudulent transfer; German banks have SEPA recall procedures that are most effective within the first few hours, and an instant transfer (Echtzeitüberweisung) makes speed even more critical. Use the number on your card or the official banking app, never one from the email, text, or caller involved. State clearly that you were deceived into authorising the payment, ask for the receiving account to be reported, and note the reference. Never share TANs or banking credentials - no legitimate bank asks for a pushTAN confirmation or photoTAN by phone or email, and approving a TAN under a caller's guidance counts as authorising the payment, which complicates reimbursement. If you did share anything, change your online banking access from a clean device, have the card blocked via the central blocking service, and file an Onlinewache report so the bank has a case number to work with.
Evidence to preserve
- Screenshot all messages, profiles, websites and payment pages
- Save transaction references, account numbers and crypto wallet addresses
- Keep emails with full headers where possible
- Note dates, times, names and phone numbers used
Frequently asked questions
How do I report cybercrime in Germany?
File a report with your state police via their Onlinewache online reporting portal. The BSI (bsi.bund.de) provides guidance for consumers. For investment fraud, contact BaFin.
What is the Onlinewache?
It is the online police reporting portal operated by each German state police force, allowing victims to file reports for cybercrimes, fraud, and other offences online without attending a station.
What is the 'Enkeltrick'?
The 'grandchild trick' is a long-running German scam where callers or messengers pose as a grandchild or child in sudden trouble — a broken phone, an accident, an urgent bill — and ask for money. The WhatsApp 'Hallo Mama/Papa' variant is its modern form. Always verify by calling the relative's known number before paying anything.
Sources
- National police and cybercrime portals (verify on official sites)
- FTC / Action Fraud / Scamwatch consumer guidance