The European Union's digital-asset rulebook was supposed to make the market safer by pushing unlicensed operators out. It is doing that. It is also producing a steady supply of confused customers, and criminals have noticed.
Under the Markets in Crypto-Assets regulation, platforms operating without authorization have been closing accounts, delisting tokens and telling users to withdraw by a deadline. Those notices are exactly the kind of message a scammer can imitate: an urgent email about a compliance deadline, a link to a "verification portal," and a request for the credentials or seed phrase needed to move funds before they are frozen.
A second pattern targets people who have already lost money. So-called asset-recovery services claim to be acting with regulatory backing, ask for an advance fee, and disappear. National authorities in several member states have issued warnings that they never contact individuals to arrange the return of funds and never charge for it.
Compliance staff at licensed exchanges say the wind-down period is the vulnerable window, because legitimate and fraudulent messages currently look the same to an ordinary customer.
The advice from supervisors is unglamorous: verify a firm's authorization on the national register, reach the platform through an address you already had, and treat any deadline that arrives with a link as a reason to slow down rather than hurry.