From Pyramid to Iceberg: The Invisible Scale of Investment Fraud in the Netherlands

ANALYSIS REPORT DECEMBER 2025 From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands

In short Investment fraud constitutes an urgent and growing threat to consumers and trust in financial markets. The scale of investment fraud is structurally underestimated. Taking into account fragmented registration and low willingness to report among victims, the AFM estimates the actual damage of investment fraud in the Netherlands at €750 million per year, a multiple of the €75 million registered by the police in 2024. This report provides insight into the nature, scale, and approach to investment fraud. The AFM advocates for central and uniform registration of investment fraud to gain better visibility of the growing scale and is eager to enter into dialogue with chain partners to make the fight against investment fraud even more effective.

From pyramid to iceberg: the invisible scale of investment fraud

In short xx

ANALYSIS REPORT

Damage amount registered by the police in 2024: €75 million Expected registered damage amount based on international comparison: €150 million Estimated actual damage amount corrected for reporting willingness: €750 million

The AFM estimates the actual damage of investment fraud in the Netherlands at €750 million per year, a multiple of the €75 million registered by the police in 2024.

ANALYSIS REPORT

1. Investment fraud constitutes a growing threat 4
2. The nature of investment fraud 6 2.1 Definition 6 2.2 The consequences of investment fraud 6 2.3 The evolution of investment fraud 6 2.4 Manifestations 9 2.4.1 Boilerroom fraud 9 2.4.2 Ponzi fraud 9 2.4.3 Pyramid scheme 9 2.4.4 Recovery room fraud 10 2.4.5 Pump-and-dump 10 2.4.6 Fraud with complex products 10 2.5 Specific approach: Relational investment fraud 11 2.6 Perpetrators 11 2.7 Victims 12 2.8 Facilitators 13
3. The scale of investment fraud 14 3.1 The dark number of investment fraud 14 3.2 The tip of the pyramid: registered investment fraud in the Netherlands 15 3.2.1 Authority for the Financial Markets (AFM) 17 3.2.2 Fraud Helpdesk 18 3.2.3 Police and FIOD 18 3.2.4 FIU-Netherlands 18 3.3 Registered investment fraud internationally 20 3.3.1 United States 21 3.3.2 United Kingdom 21 3.3.3 France 21 3.3.4 Germany 22 3.3.5 Italy 22 3.4 The entire pyramid in view: estimation of the expected reported damage of investment fraud in the Netherlands 22 3.5 The contours of the iceberg under the pyramid: estimation of the actual scale of investment fraud in the Netherlands 24
4. The current approach to investment fraud in the Netherlands 25 4.1 Approach and competencies per manifestation 25 4.1.1 Boilerroom fraud 25 4.1.2 Ponzi fraud 26 4.1.3 Pyramid scheme 26 4.1.4 Recovery room fraud 27 4.1.5 Pump-and-dump 27 4.1.6 Fraud with complex products 27 4.2 Approach to investment fraud within financial supervision 28 4.3 Investment fraud within criminal law 28 4.4 Prevention and information 28 4.5 International approach 29

Table of Contents

ANALYSIS REPORT

5. Appendices 30 5.1 Methodology and justification 30 5.1.1 Objective and approach 30 5.1.2 International benchmark comparison 30 5.1.3 Extrapolation based on damage per capita 35 5.1.4 Extrapolation based on GDP 36 5.1.5 Limitations 37

Table of Contents

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 4 ANALYSIS REPORT

1. Investment fraud constitutes a growing threat

Investment fraud constitutes an urgent and growing threat to consumers and trust in financial markets. Criminals mislead victims with false or dubious investment offers, often via digital channels, with the aim of depriving them of their money. The consequences of investment fraud are profound: victims suffer not only significant financial losses but also psychological impact. The proceeds disappear into criminal assets and strengthen illegal structures. This leads to a loss of investment capital in the real economy. In the Netherlands, investment fraud therefore causes significant financial damage. The registered cases form only the tip of the pyramid, but underwater lies a large iceberg of hidden damage. Moreover, there has been an upward trend for several years. The picture is also worrying internationally. The scale and increasing professionalization make this a form of criminal behavior that requires a response of equal scale.

The majority of the damage remains hidden due to the lack of central and uniform registration and a low willingness to report among victims. The police registered €75 million in damage from investment fraud in 2024: this is only the tip of the pyramid. Based on international comparisons, the entire pyramid becomes visible: the registered damage should amount to approximately €150 million. The AFM estimates the actual damage of investment fraud at €750 million per year. Assuming a reporting percentage of only 17%, as stated by the CBS for online fraud, we also see the contours of the invisible iceberg: an estimated actual damage of €750 million. Factors such as further digitalization and the cross-border nature of investment fraud offer opportunities for fraudsters and are expected to further increase this amount in the future, a worrying picture. The lack of central registration and the low willingness to report mean that the view of the problem is fragmented and the approach is hindered.

Damage amount registered by the police in 2024: €75 million Expected registered damage amount based on international comparison: €150 million Estimated actual damage amount corrected for reporting willingness: €750 million

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 5 ANALYSIS REPORT

Combating investment fraud is a chain responsibility and a core priority1 of the AFM. The AFM works together with chain partners such as the police, the Fiscal Intelligence and Investigation Service (FIOD), the Fraud Helpdesk, the Financial Intelligence Unit-Netherlands (FIU-Netherlands), the Dutch Banking Association (NVB), and a Dutch crypto service provider to improve insight into the scale and manifestations of investment fraud. This insight is crucial for determining an appropriate approach.

The AFM invites chain partners to take joint action to structurally improve the information position regarding investment fraud. Improving the reporting and registration process is an important precondition for more coordinated, powerful, and effective action within the chain. The AFM hopes that this report will give a boost to the joint combat of investment fraud. To pool forces, the AFM is eager to enter into dialogue with the chain partners on this matter.

1 Agenda

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 6 ANALYSIS REPORT

2. The nature of investment fraud

2.1 Definition Investment fraud is as old as time and has existed as long as humans have sought financial returns. Think, for example, of variants of investment fraud such as the South Sea Bubble (18th century), the original Ponzi fraud (20th century), or the large-scale scam by Bernie Madoff. The motive is greed for money. The opportunity lies in the investor's search for yield (search-for-yield), which is accompanied by a non-critical attitude. A non-rational belief that a certain asset (GameStop), development (dot.com), or manager (Madoff) yields extraordinary returns. The method is a form of deception supported by limited transparency regarding the investment or the manner in which it is invested.

The AFM uses the following definition of investment fraud: Investment fraud is a form of financial fraud in which investors are misled by providing false information, misleading promises regarding returns, or (non-existent) investment products with the aim of financial gain.

2.2 The consequences of investment fraud Investment fraud often causes serious financial losses for victims, who lose their savings, pension provisions, or other assets. In addition to the financial impact, this also leads to psychological harm. Victims experience feelings of shame, guilt, and mistrust, which lowers their willingness to report and hinders them in seeking help. This emotional burden can affect the well-being of victims and their surroundings and can undermine their trust in financial institutions and the financial market.

The proceeds from investment fraud do not flow into legitimate investments but are used to build criminal assets. Perpetrators use these funds to strengthen their position within organized networks, develop new forms of fraud, or finance other illegal activities. This increases the power of criminal organizations and makes enforcement and investigation more complex, especially when the money is smuggled away via international structures.

Because the victims' money is not actually invested, it disappears from the legitimate financial circuit. This leads to a loss of investment capital in the real economy. This undermines the confidence of consumers and investors in financial markets and institutions. When fraud occurs structurally and on a large scale, it can disrupt the functioning of markets and weaken the support for investing in general.

2.3 The evolution of investment fraud Digitalization has not only changed the form of investment fraud but also increased its scale, speed, and complexity. For example, investment fraud has shifted significantly to the online domain. This shift has expanded the reach of scammers: via social media, email, and online advertisements, they can approach potential victims from anywhere in the world at low cost. Fraudsters present themselves online with professional-looking websites and use cloned websites of reputable companies to appear credible.

The growing use of AI – such as deepfake videos or audio and the use of AI agents – will also give a boost to the further digitalization of investment fraud and the emergence of new modus operandi.

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 7 ANALYSIS REPORT

Digitalization has created new instruments for investment fraud, of which the rise of trading in crypto-assets is the most important development2. The promise of high returns and the technological innovation of crypto-assets attract investors, while the complexity and limited knowledge among investors create an information advantage for fraudsters. Crypto-assets have thus become not only a popular 'bait' but also offer fraudsters a relatively anonymous and difficult-to-trace payment method to smuggle away embezzled funds.

Within the chain of online investment fraud, specializations have emerged, which are offered as crimes-as-a-service (CaaS). Fraudsters no longer have to master all aspects of the fraud themselves; they use specialized services offered as CaaS. This means that criminal networks or individual providers handle separate fraud services, such as building convincing fake websites, generating false advertisements, providing stolen personal data, or facilitating anonymous crypto payments. This development lowers the barrier for new fraudsters and simultaneously increases the efficiency and professionalization of fraud practices.3

The internationalization of financial markets has increasingly given investment fraud a cross-border character. Financial markets and services are becoming increasingly cross-border, and this also applies to criminal activities. Investment fraudsters often operate without a license from abroad or target multiple countries simultaneously. Dutch investors are, for example, regularly contacted by phone by call centers abroad (such as in Eastern Europe or Southeast Asia) or come into contact with scammers via international websites or social media. This development increases the need for cross-border data exchange and coordinated supervision, because national measures are only limitedly effective in the case of international and online investment fraud.

2 Europol (2025), The changing DNA of serious and organised crime; AFM Signalenmonitor 2023 3 Europol (2023), Online fraud schemes: a web of deceit 4 Drew & Cross (2016), Fraud and its PREY: Conceptualising Social Engineering Tactics and its Impact on Financial Literacy Outcomes

Online recruitment as the engine behind investment fraud Online contact via internet platforms is a crucial driver of investment fraud. Digital channels offer fraudsters a scale advantage: they can reach a large number of potential victims with minimal effort. The contact between the consumer and the online fraudster often starts via one of the following paths or a combination thereof:

• Internet search engines and malicious advertisements Consumers searching online for ways to invest their money are lured into clicking on fraudulent offers via search results or paid advertisements. These advertisements often refer to professional-looking websites with convincing promises of high returns.

• Social media platforms Consumers end up in the web of investment fraud via malicious advertisements on social media, promotion by finfluencers, or malicious 'investment opportunities' via chat contacts.

• Dating apps Via a match on a dating platform, a consumer is lured into investing with or via a fraudulent party after intensive contact. These methods – also known as 'social engineering' – are psychologically calculated and play on emotions such as trust, hope, and greed.4 Through these online approach techniques, fraudsters can operate efficiently and constantly adapt their practices to new digital trends.

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 8 ANALYSIS REPORT

IN VIEW Different manifestations of investment fraud

Fraudsters operate from professional-looking investment platforms. Returns are paid with the investment of new participants, instead of actual profit from investments. Phone, email, websites, social media, and messaging apps High and guaranteed returns Ponzi fraud

Fraudsters push the price of stocks or crypto-assets to an artificially high level and then sell them en masse. A stock or crypto asset will rise explosively Social media, influencers, bots, messaging apps, online forums Explosive price increases Pump-and-dump

Investors

Modus operandi Offer Promise Communication Victims

Fraudsters lure investors via websites and fake reviews. Investors invest money and are rewarded for recruiting new participants. Phone, email, websites, social media, and messaging apps High and guaranteed returns Pyramid scheme

• Often trust in the professionalism and credibility of the fraudster; • Sensitive to 'social proof'; • Often looking for higher returns and the possibility to get rich quickly.

Boilerroom fraud Fraudsters approach victims aggressively from a call center ('boiler room'). Fake stocks, fraudulent bonds, non-existent crypto-assets High returns, exclusive opportunities Phone, email, websites, social media, and messaging apps

Fraudsters pose as lawyers, regulators, or specialized companies. Help in recovering lost investments Phone, email, websites, social media, and messaging apps The lost money is recovered Recovery room fraud

Victims of previous investment fraud

Fraudsters offer (help with) investments in very complex financial instruments. They pressure victims to deposit more money and trade frequently. Help in becoming a successful trader Lucrative investments Fake advertisements with famous people, phone, email, websites, social media, and messaging apps Fraud with complex products

In this form of fraud, 'pig butchering' is often involved, an approach where victims are manipulated over a longer period and financially 'fattened up' before being completely scammed.

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 9 ANALYSIS REPORT

2.4 Manifestations Investment fraud now almost always starts online: the first step is that consumers are approached via fake advertisements with high returns, via social media, chat groups, or so-called lead lists. Subsequently, persistent (often very) intensive contact (by phone or via chat) begins between the fraudster and the victim. The victim is convinced to step in with a relatively small amount, such as €250. Thereafter, the fraudster maintains intensive contact and convinces the victim to deposit more and more.

Within investment fraud, a number of different manifestations can be distinguished, which have been relatively stable over time. However, the modus operandi within these manifestations is subject to change under the influence of further digitalization and internationalization, but also because fraudsters cleverly play on current events.

2.4.1 Boilerroom fraud Boilerroom fraud is a form of investment fraud in which fraudsters, often from call centers (so-called boiler rooms), aggressively approach potential investors and persuade them to invest in worthless or non-existent financial products.

Boiler rooms often use fake stocks, fraudulent bonds, or non-existent crypto-assets. The fraudsters present themselves as reputable investment advisors and use convincing sales techniques. Thus, they pressure victims, often with promises of high returns and exclusive opportunities made visible via dashboards with fake overviews. Ultimately, the victims lose (mostly) the invested capital, and the perpetrators are no longer reachable. Boiler rooms usually operate from non-existent entities and often change their name and website. The physical location is often unclear, and they victimize people in different countries. This concealment of identity, the elusiveness, and the international component make investigation very difficult.

2.4.2 Ponzi fraud Ponzi fraud is a form of investment fraud in which returns to earlier investors are paid with the investment of new participants, instead of with actual profit from investments.

Thus, an illusion of profitability is created (sometimes by misleading victims via fake dashboards), while in reality there is little or no legitimate income stream. Ponzi fraud is usually carried out via professional-looking investment platforms and personal networks. Modern Ponzi schemes operate online via websites and social media, where scammers offer investments with promises of high, guaranteed returns. As long as enough new investors join, the fraudster can continue to make payments and build trust. This can go on for a long time but eventually collapses when the inflow of new capital dries up or when too many investors want to withdraw their money simultaneously.

The term "Ponzi fraud" is named after Charles Ponzi, who became famous in the 1920s with a fraudulent stamp trading scheme. One of the most famous modern cases is that of Bernie Madoff, who carried out a large-scale Ponzi fraud for years with total damage estimated at $65 billion, thereby seriously undermining trust in financial institutions worldwide.

2.4.3 Pyramid scheme A pyramid scheme is a form of investment fraud in which participants invest money and are rewarded for recruiting new participants. The structure resembles a pyramid: the first investors receive payments from the investment of newly recruited members, while most participants at the bottom ultimately lose their money. Sometimes some investment is made, but not enough to pay returns to all participants. As with Ponzi fraud, it can take a long time for a pyramid scheme to be discovered, because investors receive 'returns' as long as new participants join, making the fraud not immediately visible.

Pyramid schemes are executed in various ways, both online and via personal approaches. Nowadays, it happens mainly via social media and messaging apps, where scammers lure investors with success stories and exclusive investment groups. Also,

From pyramid to iceberg: the invisible scale of investment fraud in the Netherlands 10 ANALYSIS REPORT

email campaigns and online advertisements are used to tempt people with promises of high returns. Often, fake reviews and professional-looking websites are used to project legitimacy. Additionally, telephone recruitment is applied, where fraudsters, similar to boilerroom fraud, use aggressive sales techniques to pressure victims.

2.4.4 Recovery room fraud In recovery room fraud, victims of previous investment fraud are approached again by fraudsters posing as lawyers, regulators (such as the AFM or ESMA), or specialized companies that can recover lost investments. The scammers claim that they can recover the money against payment of legal fees, administrative costs, or taxes. Often, the fraudsters have detailed information about previous losses, because victims end up on lead lists, which are then traded on the internet. Public complaints about fraud are also consulted. Because the fraudsters possess this information, they are able to present a credible story and thus gain the trust of their victims. In reality, the transferred money disappears, leaving victims who have lost their money again and empty-handed.

2.4.5 Pump-and-dump Pump-and-dump fraud is a manipulative trading strategy in which scammers push the price of, for example, a stock or crypto-asset to an artificially high level and then sell it en masse.

This can, for example, involve the use of misleading information, false rumors, or organized buying campaigns. This often happens via social media, finfluencers, bots, messaging apps, and online forums, where it is easy to spread false analyses, fake news, and hyped messages, and where fraudsters lure investors with promises of explosive price increases. Consumers are thus tempted to buy the relevant stock or crypt