Where to report a scam in Germany — there is no single hotline, and no automatic refund. Here is the actual map.
Germany has one of the largest fraud problems in Europe and one of the most fragmented ways of reporting it. There is no national "report fraud" front door — policing is split across the 16 states — and there is no UK-style rule forcing banks to refund victims. If you live in Germany and search how to report a scam, the honest answer is a short list of the right doors and the order to knock on them. This is that list, in English, for 2026.
131,391
Cybercrime cases in Germany 2024 (BKA)
€178.6B
Digital-attack damage 2024 (Bitkom, via BKA)
116 116
Free card-blocking hotline (Sperr-Notruf)
116 006
Free victim-support line (Weisser Ring)
The short answer
Germany's official routes in 2026: file a criminal complaint (Strafanzeige) at your federal state's online police station (Online-Wache), or call 110 in an emergency; forward phishing emails to the Verbraucherzentrale's Phishing-Radar at phishing@verbraucherzentrale.nrw; check and report investment firms via BaFin's company database; report nuisance calls and fraudulent SMS to the Bundesnetzagentur; block a compromised card free on 116 116; and get free victim support from Weisser Ring on 116 006. Crucially, unlike the UK there is no mandatory-reimbursement rule: under §675u BGB your bank must refund an unauthorized transaction, but money you transferred yourself under deception is generally not refundable — which is why speed and documentation matter so much.
"Cyberangriffe besitzen ein enormes Schadenspotenzial und sind eine Bedrohung für Wirtschaft, Staat und Gesellschaft."
If you have been scammed in Germany, two things matter most in the first 24 hours: stopping any further loss and creating a record while the evidence still exists. Everything downstream of that — which agency, which form, which refund argument — depends on getting those two right. The complication unique to Germany is that there is no single place to report, so the order below is built to be the fastest path through a deliberately decentralised system.
If you are reading this with a recent transaction you regret, skip to if money has already moved. The first hour is the only window where a bank-side recall reliably works.
The hard truth first: Germany refunds the hack, not the con
This is the most important section, because it sets your expectations correctly before you spend a week chasing the wrong outcome.
German law draws a sharp line between two kinds of loss. Under §675u of the German Civil Code (BGB), an unauthorized payment — someone used your card or got into your account without permission — must be refunded by your bank, and §675v generally caps your own liability at €50 unless you were grossly negligent. That is the German implementation of the EU Payment Services Directive, and it works reasonably well.
But if you authorized the payment yourself because you were deceived — you logged in and sent the transfer because a convincing "bank officer" or "investment adviser" told you to — that is legally an authorized transaction, and §675u does not apply. There is no German equivalent of the UK rule that forces banks to reimburse this kind of authorised-push-payment fraud.
This is the same gap that strands scam victims in the United States under Regulation E — and the opposite of the position in Britain. The UK's Payment Systems Regulator now requires banks to refund deception-based transfers up to £85,000, as we covered in the UK reporting guide. Germany has no such rule. Brussels is debating tighter EU-wide protection, but as of 2026 nothing comparable is in force here. So in Germany the realistic recovery levers for a deception transfer are speed (a same-day bank recall), the free banking ombudsman, or a civil claim — not an automatic refund.
There is no single front door — start at your state's Online-Wache
Because Germany polices through its 16 federal states, a criminal complaint (Strafanzeige) goes to your state's police, not to a national hotline. Most states let you file online through an "Online-Wache" or "Internetwache" — an online police station that accepts fraud, theft, and property-crime reports without a trip to a station.
—What you can file. A full Strafanzeige for online fraud, theft, and related offences. The form asks what happened, when and how, who was harmed, the amount of damage, and any detail you have on the offender.
—Which states offer it online. Most of them — including Baden-Württemberg, Bavaria, Berlin, Brandenburg, Bremen, Hamburg, Hesse, Mecklenburg-Vorpommern, Lower Saxony, North Rhine-Westphalia, Rhineland-Palatinate, Saxony, Saxony-Anhalt and Schleswig-Holstein. Find your state's portal via the police gateway at polizei.de. North Rhine-Westphalia's Internetwache even offers an English-language version.
—What you get back. A file number (Aktenzeichen). The report is routed to the responsible local station for processing. Keep the number — your bank or the ombudsman may ask for it.
—The deadline that catches people out. For certain offences that require a formal complaint (Antragsdelikte), you must file within three months of learning of the offence and the offender. When in doubt, file early; it costs nothing.
—In an emergency, call 110. If a crime is in progress, you are in danger, or money is moving right now, the police emergency number 110 works everywhere in Germany.
The full German reporting directory, by scam type
Different scams route to different specialist bodies. Using the right one matters more than carpet-bombing all of them.
—Any fraud where you lost money. File a Strafanzeige at your state's Online-Wache (or in person at any station; 110 in an emergency). This is the criminal-side report and the foundation for everything else.
—A phishing email or fake bank/government SMS. Forward it unchanged to phishing@verbraucherzentrale.nrw — the Verbraucherzentrale NRW Phishing-Radar, which evaluates reports and publishes daily public warnings. Tell your bank too if it impersonated them.
—Investment, crypto, or fake-broker fraud. BaFin (the financial regulator). Check the company database (Unternehmensdatenbank) and warning list before investing; report an unlicensed provider as an 'unerlaubtes Geschäft'. BaFin cannot recover funds but its warnings flag the operation publicly.
—Nuisance calls and fraudulent SMS senders. Bundesnetzagentur (the Federal Network Agency) handles number misuse, spam calls, and fraudulent SMS. File a complaint at bundesnetzagentur.de if a German number or sender is involved.
—Misuse of your personal data. A data-protection breach can be reported to your state data-protection authority or the federal BfDI. For broader cyber-threat warnings, the BSI's Bürger-CERT service publishes consumer alerts.
—Identity theft. File the Strafanzeige, and consider asking SCHUFA and your bank to flag your records for additional checks. Monitor your accounts and credit profile for new activity you did not initiate.
—A scam you spotted but did not fall for. Still report it — to the Online-Wache, to the Phishing-Radar for emails, to BaFin for fake investment offers. No-loss reports still build the intelligence picture that targets the operators.
—You need a human to talk to. Weisser Ring, Germany's nationwide victim-support charity, on 116 006 (free, daily 7am-10pm, English available). For consumer and contract disputes, the Verbraucherzentrale in your state.
If money has already moved — the first 24 hours
Speed is the whole game, especially in Germany where there is no automatic refund to fall back on. A same-day bank recall is sometimes the only thing that works. This is the maximum-recovery order:
1Block the card on 116 116 if your card or online-banking access may be compromised — free, around the clock. Then call your bank's fraud line. If the transaction was unauthorized (you did not make it), say clearly you are disputing it under §675u BGB and want it refunded, and ask them to attempt a recall of any transfer. Get a reference in writing.
2File a Strafanzeige at your federal state's Online-Wache, reachable via polizei.de, or in person at any police station. In an emergency, 110. You will receive a file number — keep it.
3Document everything in one place. Screenshot the conversation, the scammer's numbers, emails and fake websites, the transaction details (date, time, amount, recipient name and IBAN), and any names or company names used. Save it as a single PDF before the accounts vanish.
4Forward any phishing email, unchanged, to phishing@verbraucherzentrale.nrw (the Phishing-Radar), and tell your bank if the message impersonated it.
5If it was investment fraud, check the firm in BaFin's company database and report an unlicensed provider to BaFin. Report fraudulent callers or SMS senders to the Bundesnetzagentur.
6Block the scammer everywhere and stop engaging. Any "recovery" offer that follows — a lawyer, an agency, someone claiming to be the police or BaFin — is the second scam. We covered the pattern in the recovery-scams piece.
7If the bank wrongly refuses to refund an unauthorized payment, escalate free of charge to the banking ombudsman (Schlichtungsstelle) for your bank's association, and file a complaint with BaFin's consumer-protection unit. For deception-based transfers, the ombudsman and, if needed, a civil claim are the realistic routes.
8Call Weisser Ring on 116 006 for free, confidential victim support (daily 7am-10pm, English available). A good first human call if the process feels overwhelming, and see the honest recovery odds by payment method for what realistically works.
Within days of any public post or report about your loss, "recovery scammers" will find you. They will claim to be a law firm, a recovery service, a Rückbuchung specialist, or even the police or BaFin themselves, and they will ask for an upfront fee or your banking details. Real German channels — your bank, the police, BaFin, the banking ombudsman, Weisser Ring — never charge upfront to recover money, and the police never cold-call demanding payment. See the recovery-scams piece for the full pattern.
The German numbers, for context
The BKA's Bundeslagebild Cybercrime 2024, published on 3 June 2025, is the most recent national picture. The headline figures, all from named sources:
—131,391 cybercrime cases were recorded in Germany in 2024. Counted in the Police Crime Statistics (PKS) as offences committed within Germany.
—A further 201,877 offences were attributed to perpetrators abroad or in unknown locations. Cross-border crime is now a large share of the total — and the part hardest to prosecute.
—An estimated €178.6 billion in damage from digital attacks in 2024. This is the Bitkom industry-association estimate cited in the BKA report — up €30.4 billion on 2023. It spans the whole economy, not just consumer fraud, but it is the scale Germany is operating against.
—950 companies and institutions reported ransomware to police in 2024. BKA President Holger Münch noted that two to three serious ransomware attacks are reported to German police every day.
—The recorded cases are only the reported ones. As everywhere, the true figure is higher — many victims, especially of smaller online-shopping and phishing scams, never file at all. That under-reporting is exactly why the Strafanzeige matters: unreported fraud is invisible fraud.
The habits that keep you out of the reporting machinery entirely
Reporting is downstream. Prevention is upstream, and three habits stop most German scams cold:
—Never transfer money or read out a TAN because of a call you did not initiate. Real banks, the real police, and real prosecutors never phone to demand an urgent transfer to a 'safe account' or a TAN to 'secure' your money. Hang up and call the institution back on the number from your card or its official site.
—Treat the 'falsche Polizei' and Europol scripts as automatic red flags. A caller claiming to be police, a prosecutor, Europol, or a bank's fraud team, pressuring you to move money or hand over codes, is running a known script. The same voice-and-pressure playbook drives the family-imposter and shock-call scams covered in the family-impersonation piece.
—Treat any money conversation that moves onto a messaging app as hostile until verified. Investment 'advisers', recruiters, and romance contacts in Germany overwhelmingly pivot to WhatsApp or Telegram. The move off a verifiable platform onto a private chat is the single most reliable scam signal.
If you are unsure whether something is a scam before any money moves, the fastest second opinion is the Scam Checker on this site, or our free case review. Both are read by a human and answered within 24 hours.
From the field. The most common serious German case we see in 2026 is the Schockanruf and its close cousin, the falsche-Polizei call. An older person gets a call: a relative has caused a fatal accident and needs bail immediately, or a "police officer" warns that burglars are active and their savings must be moved to a "secure" account or handed to a courier. Every element is staged — the urgency, the authority, the demand to keep it secret from the bank. Because the victim hands over the money themselves, German banks usually treat it as an authorized transaction and decline to refund. That legal reality is precisely why the prevention rule below matters more in Germany than almost anywhere: once the transfer leaves, the law is rarely on your side.
One rule, end to end
If you take one habit from this piece, take this: any unsolicited call, message, or email that pressures you to move money or share a code is a scam until you have hung up and verified it by calling the institution back on a number you already trust. In a country with no automatic refund, that one pause is worth more than the entire reporting machinery downstream of it.
In Germany and not sure where to start? Let's look at it together.
Describe the message, the call, the transaction. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.
Common questions about reporting a scam in Germany
Is there one place to report all scams in Germany?
No — and this is the single most confusing thing about reporting fraud in Germany. There is no national equivalent of the UK's Report Fraud or America's IC3. Policing is organised by the 16 federal states (Länder), so a criminal complaint (Strafanzeige) goes to your state police, in most states through an online police station (Online-Wache). On top of that, specific scam types route to specialist federal bodies: phishing to the Verbraucherzentrale, investment fraud to BaFin, nuisance calls and SMS to the Bundesnetzagentur. The practical rule: file the Strafanzeige at your state's Online-Wache first, then add the specialist report that matches the scam type.
Will my German bank refund money I lost to a scam?
It depends entirely on one distinction. Under §675u of the German Civil Code (BGB), if the transaction was unauthorized — someone used your card or accessed your account without permission — your bank must refund it, and §675v generally caps your own liability at €50 unless you acted with gross negligence. But if you authorized the payment yourself because you were deceived (you logged in and sent the transfer), that is legally an authorized transaction and §675u does not apply. Germany has no equivalent to the UK's mandatory APP-fraud reimbursement rule, so for deception-based transfers you are largely reliant on the bank's goodwill, the banking ombudsman, or a civil claim. Report it anyway — speed still matters for any chance of a recall.
How do I report a phishing email or fake SMS in Germany?
Forward the suspicious email, unchanged, to phishing@verbraucherzentrale.nrw — the Verbraucherzentrale NRW runs the national Phishing-Radar, evaluates incoming reports (anonymising your personal data), and publishes daily warnings about live scams. If the phishing impersonated your bank, also tell your bank directly so they can flag the campaign. The BSI (Federal Office for Information Security) publishes consumer warnings via its Bürger-CERT service. If you actually entered any data or clicked through and lost money, treat it as a successful attack and file a Strafanzeige at your state's Online-Wache as well.
How do I check whether an investment platform is legitimate in Germany?
Use BaFin, the Federal Financial Supervisory Authority. Before you send any money, search BaFin's company database (Unternehmensdatenbank) to confirm the firm is actually licensed to offer financial services in Germany, and check BaFin's warning list of unauthorized providers. If a platform is operating without a licence, you can report it to BaFin as an 'unerlaubtes Geschäft' (unauthorized business). BaFin cannot recover your money, but its warnings are how a lot of fake-broker and crypto-platform operations get publicly flagged. Fake cryptocurrency platforms, cloned versions of real brokers, and 'guaranteed return' tips are the dominant German investment-fraud patterns.
What number do I call to block a stolen or compromised card in Germany?
116 116 — the central card-blocking hotline (Sperr-Notruf). It is free, runs around the clock, and blocks German bank cards, credit cards, and more in one call. From outside Germany, dial +49 116 116. Do this first if your card details or online-banking access may have been compromised, before you do anything else — blocking the card is the one action that reliably stops further loss. Note that blocking the card does not by itself reverse transactions that already happened; for those you still raise an unauthorized-transaction claim with the bank.
Where can a scam victim get free human help in Germany?
Weisser Ring is Germany's only nationwide victim-support organisation, founded in 1976, with around 3,200 trained volunteers across 420 local branches. Its free victims helpline is 116 006, open daily from 7am to 10pm, and it offers support in English. Weisser Ring helps with the emotional aftermath, points you to the right reporting channel, and can accompany victims through the process. For consumer and contract questions — chargebacks, disputed subscriptions, dodgy online shops — the Verbraucherzentrale in your state provides paid and free advice. Neither will ever charge an upfront fee to 'recover' your money.
Sources & further reading
Every figure in this piece is drawn from these authorities. Click any of them to verify.