Money laundering suspicion after crypto fraud: What to do?

One case shows how victims are drawn into the payment and wallet structures of fraudsters – and what steps are now important to take with regard to banks, police and public prosecutors.

In short: Anyone who has been a victim of crypto fraud may also come under the scrutiny of their bank or law enforcement – especially if funds belonging to someone else were deposited into their account and forwarded at the perpetrators' instructions. A suspicious activity report from the bank is not a criminal complaint, and an investigation does not necessarily mean that money laundering has actually occurred. Three things are crucial now: no further transfers, thorough preservation of evidence, and – if you are a suspect – legal counsel before making any statement.

The case: Marlene K. loses 48,000 euros – and herself becomes a suspect.

Marlene K. is convinced she was merely following instructions from the alleged trading platform. Her bank and the investigating authorities initially see the process differently: money belonging to a stranger lands in her account, is immediately exchanged for cryptocurrency, and forwarded to an external wallet. This exact pattern – receiving someone else's money, quickly exchanging it, and forwarding it to a third party – is typical of money mules.

April 7
Marlene K. becomes aware of an alleged trading platform through an online advertisement and leaves her contact details.

April 10
A personal "account manager" contacts her by phone and WhatsApp. Marlene initially transfers 5,000 euros.

April / May
The platform displays increasing profits. Marlene deposits another 43,000 euros in several steps – a total of 48,000 euros.

June 3
Marlene wants to withdraw her profits. The supposed broker explains that her bank account must be used temporarily as a "settlement account" for this purpose.

June 4
€15,000 is deposited into Marlene's account from an unknown person. Following the broker's instructions, she uses the money to buy USDT and sends the tokens to a designated wallet.

June 6
Another payment is announced. Marlene becomes suspicious and refuses to forward it.

June 10
The bank restricts the account and requests an explanation for the unusual payment transactions.

June 18
Marlene receives a letter from the police: She is being investigated on suspicion of money laundering.

Why do victims of fraud even come under suspicion of money laundering?

Banks, cryptocurrency exchanges and other obliged entities must submit a suspicious activity report to the Financial Intelligence Unit (FIU) in accordance with Section 43 Paragraph 1 of the Money Laundering Act (GwG) if there are indications that an asset originates from a criminal act or is related to money laundering or terrorist financing.

Important for classification: A report of suspected wrongdoing is not a criminal complaint or an accusation of guilt. It simply means that, from the perspective of the responsible party, an incident is suspicious enough to warrant further investigation.

The bank's suspicious activity report

Banks, cryptocurrency exchanges, and other obliged entities are required under Section 43 Paragraph 1 of the German Money Laundering Act (GwG) to submit a report to the Financial Intelligence Unit (FIU) if there are indications that an asset originates from a criminal offense or is related to money laundering or terrorist financing. This reporting obligation applies regardless of the value of the asset or the transaction amount.

Why the account is suddenly restricted

Those affected often find it incomprehensible why transfers get stuck or their account is partially blocked. Several reasons are possible:

Standstill period: According to Section 46 Paragraph 1 of the German Money Laundering Act (GwG), a reported transaction may generally only be executed if the Financial Intelligence Unit (FIU) or the public prosecutor's office has given its consent, or if the third working day after the notification has passed without the execution being prohibited. Saturdays are not considered working days.
Immediate measures by the FIU: According to Section 40 of the Money Laundering Act (GwG), the Financial Intelligence Unit (FIU) can prohibit a transaction. This measure ends no later than one month or five working days after the case is referred to the public prosecutor's office. The FIU may grant exceptions upon application for funds intended to cover living expenses.
Criminal procedural safeguards: If an investigation is already underway, the public prosecutor's office can have assets provisionally secured, for example by means of asset seizure (§ 111e StPO).
Callbacks and customer relations: In addition, the sender's bank can report suspected fraud or initiate a recovery process. If the sender's own bank cannot clarify the origin of the funds, it can also terminate the business relationship.

Why the bank explains nothing

Section 47, paragraph 1 of the German Money Laundering Act (GwG) generally prohibits obliged entities from informing customers or third parties about an intended or submitted suspicious activity report, any resulting investigation, or a request for information from the Financial Intelligence Unit (FIU). Affected parties therefore often only notice follow-up questions, delays, or restrictions without learning the underlying reasons. This is not arbitrary, but rather a legal requirement – and all the more reason to answer bank inquiries fully and with verifiable documentation.

What Section 261 of the German Criminal Code actually requires

Section 261, paragraph 1 of the German Criminal Code (StGB) criminalizes various forms of handling objects that originate from an unlawful act – including concealing, exchanging, transferring, or transporting such objects. Initially, this is only punishable if done intentionally. However, for victims of fraud who act as unwitting money mules, Section 261, paragraph 6 of the StGB is particularly relevant: According to this section, anyone who negligently fails to recognize that the object originates from an unlawful act is also liable to prosecution. The penalty in this case is imprisonment for up to two years or a fine.

Recklessness is more than mere carelessness. It refers to grossly negligent behavior where the criminal origin was practically unmistakable. The assessment typically considers the specific circumstances: Where did the money come from? Was there a plausible explanation? Was a commission promised? How urgent and unusual were the instructions? What warning signs were present – and how did the person react to them? Whether the conditions are met in a particular case is a legal question that can only be answered based on the complete circumstances.

Two further points are little known: Section 261 Paragraph 8 of the German Criminal Code (StGB) provides for immunity from prosecution under strict conditions if the offense is voluntarily reported to the competent authority before it is discovered. Whether and how this regulation applies in a specific case should absolutely be reviewed by a lawyer. And regardless of the criminal proceedings, the sender of the forwarded money can attempt to recover the amount from the account holder through civil proceedings.

Three situations must be distinguished.

A: Only own money

The victim transfers their own money to exchanges, wallets, or alleged trading platforms.

Classification: Unusual transactions can still trigger inquiries, suspicious activity reports, or account restrictions. A suspicious activity report is not proof of guilt.

B: Foreign money is forwarded

The victim's account receives payments from third parties, which are then forwarded or exchanged for cryptocurrencies on the perpetrators' instructions.

Classification: Significantly riskier. The payment method follows the pattern of a money mule and can trigger its own investigation.

C: Account or stock exchange access is being used by perpetrators

The perpetrators open stock market accounts in the victim's name, obtain access data, or control transactions via remote maintenance software.

Classification: From the outside, the victim appears to be the active participant. Whether the victim acted themselves or the perpetrators did must be investigated using device, login, and communication data.

What those affected should do now in relation to the bank

A bank inquiry should neither be ignored nor answered hastily. What is crucial is a comprehensible and verifiable account of what actually happened.

Do not make any further payments or crypto transfers at the instruction of unknown „brokers“, „support staff“, „recovery agents“ or alleged authorities.
Do not forward any further incoming payments from third parties, nor should you unilaterally transfer them back. Instead, inform the bank immediately and arrange a reversal of the transaction through the bank. A return transfer to an account specified by the perpetrators could itself be part of the fraud.
Back up all communication: emails, WhatsApp and Telegram chats (as export, not just as screenshots), SMS, platform messages, voice messages and call logs.
Secure all bank statements and payment receipts – not only your own deposits, but also incoming payments from third parties, including sender's name, IBAN and purpose of payment.
Export your complete transaction and withdrawal history from the cryptocurrency exchange you are using. If exporting is insufficient, you can request information under Article 15 of the GDPR to obtain stored data such as login times and IP addresses.
Secure wallet addresses and complete transaction hashes without alteration. Screenshots alone are often insufficient for reliable blockchain analysis.
Create a chronological overview: Who gave which instruction and when? What payment was made immediately afterwards?
Remain objective when dealing with the bank and only state verifiable facts. Clearly identify any assumptions about perpetrators' identities or money flows as such.
If an investigation is already underway against you, coordinate any written statements to the bank with your lawyer beforehand.

Filing your own criminal complaint: early and completely

Many victims hesitate to file a report – out of shame or because they hope to recover the money themselves. Especially in situations like Marlene's, there are many reasons to file a fraud report early on. A report documents the victim's loss, provides the police with a complete account of the case from the victim's perspective, and gives a case number that can be provided to banks and stock exchanges.

If someone else's money was forwarded, this part of the incident must be included in the report – completely and without embellishment. Because this may involve personal criminal liability, the report should be discussed with a lawyer specializing in criminal law beforehand.

What happens if the police or public prosecutor's office make contact?

First, it must be clarified in what capacity the person concerned is being addressed: as a victim, witness, or accused. This role is usually stated in the summons or accompanying letter. It determines their rights and obligations.

As accused: During questioning, Section 136 of the German Code of Criminal Procedure (StPO) requires that the accused be informed of the specific offense with which they are charged. The accused must be advised that they are not obligated to make a statement and may consult a lawyer at any time. This also applies to police interrogations, as stipulated in Section 163a, Paragraph 4 of the StPO. An accused person is not required to comply with a summons from the police. However, they must comply with a summons from the public prosecutor's office (Section 163a, Paragraph 3 of the StPO), although they may remain silent in that instance as well.
As a witness: Witnesses must comply with a police summons and testify if the summons is based on an order from the public prosecutor's office (§ 163 para. 3 of the German Code of Criminal Procedure). However, according to § 55 of the German Code of Criminal Procedure, they may refuse to answer questions if doing so would expose them to the risk of prosecution. This is relevant if someone is summoned as a victim but has also received third-party funds into their account.
Access to files: The defense attorney has the right to inspect the investigation file (§ 147 of the Code of Criminal Procedure). Only then can it be assessed what information the authorities already possess and what the suspicion is specifically based on.

Important: Anyone who learns that they are under investigation for money laundering should not spontaneously attempt to explain the entire situation over the phone or in an unprepared interrogation. First, documents should be secured, and further action should be discussed with a lawyer specializing in criminal law. This does not mean refusing to cooperate with the investigating authorities. It means preparing a complete, organized, and well-documented account – usually after reviewing the case file.

Why „I am a victim myself“ is often not enough

For law enforcement, it's not just the personal statement that counts, but above all whether the alleged sequence of events is supported by objective data. Especially in the case of crypto transactions, structured documentation can make the connection between perpetrator instructions and payment movements traceable.

In the case of Marlene K., for example, the following points could be combined:

their own deposits totaling 48,000 euros as proof of the prior damage,
the receipt of the 15,000 euros in her bank account,
the immediately subsequent purchase of USDT on the cryptocurrency exchange including exchange export,
the specific transaction hash of the forwarding,
the target wallet and its further transaction history,
the WhatsApp message from the alleged broker with the payment instructions,
the temporal alignment between communication and transaction and
their refusal on June 6th to forward a further payment.

The better these elements fit together, the clearer it becomes to reconstruct how the person involved was integrated into the payment process. Exculpatory circumstances should also be documented: that no commission was promised, that the payment was presented as part of her own profit distribution, that Marlene terminated the agreement herself. The legal assessment of whether or not this constitutes a criminal offense remains the responsibility of the investigating authorities, the courts, and legal counsel.

What role can blockchain forensics and OSINT play?

Blockchain forensics cannot "prove" innocence and does not replace a defense. However, it can document technical facts that are relevant for classifying the case. Among other things, the following questions can be investigated on-chain:

Which wallet received the cryptocurrencies sent by the affected person?
Were the assets forwarded, exchanged, or bundled via intermediary wallets?
Are there any indications of cryptocurrency exchanges, swap services, bridges, or other service providers that might hold account holder data?
If funds from other victims also flow through the same wallets – an indication of a fundraising structure by the perpetrators rather than the victims' own self-interest?
How quickly were the assets transferred after receipt, and do the blockchain timestamps match the perpetrator's communication?

OSINT, or the analysis of publicly available sources, complements this analysis by providing information on the perpetrators' side: registration and hosting data of the platform domain, entries in warning lists of BaFin or foreign regulatory authorities, connections to other fraudulent websites, telephone numbers used, and messenger profiles. Such findings can demonstrate that the platform is part of a known fraud pattern – and thus make the victims' accounts more plausible.

A clear separation is crucial: On-chain transactions are publicly verifiable. In contrast, the attribution of an address to an exchange or service relies on analytical tools and comparative data and remains indicative until the service confirms it upon request from the authorities. Particularly in complex cases, this can lead to the development of a technical system that processes transaction hashes, wallet addresses, timestamps, and money flows in such a way that lawyers and investigative authorities can use them effectively.

Practical checklist for those affected

1. No further transfers
Do not make any more payments or crypto transfers at the instruction of the supposed broker, "support" or recovery provider.

2. Report incoming foreign visitors
Do not forward any further incoming payments from unknown sources and do not transfer them back on your own initiative, but report them to the bank immediately.

3. Secure communication
Export chats, save emails, back up voice messages and call logs. Do not delete anything.

4. Secure bank and stock exchange documents
Secure bank statements, IBANs, names of senders and recipients, booking texts and the complete stock market export.

5. Secure blockchain data
Note down wallet addresses and full transaction hashes – not just screenshots.

6. Create a timeline
Connect date, time, instruction, payment and conversation partner chronologically.

7. Clarify status
When contacting the authorities, determine whether you are listed as a victim, witness, or suspect.

8. Seek legal advice
If you are a suspect or have forwarded foreign funds, consult a criminal defense lawyer before making any statement, admission, or report.

9. File your own report
Report the fraud in full. If third-party funds were forwarded, consult a lawyer before filing the report.

10. Review forensic documentation
In the case of crypto payments, a technical reconstruction can make the actual payment paths traceable.

What those affected should avoid

Deleting chats or accounts because the communication seems embarrassing or stressful can also be a relief later.
To retrospectively „explain“ payment transactions without knowing for sure what actually happened.
Forwarding incoming third-party funds on your own initiative or "repaying" them to an account specified by a third party.
Paying money to other unknown individuals who claim to be able to unlock an account, "terminate" an FIU or money laundering check, or recover lost money.
Do not alter wallet data or hastily move assets between wallets when investigations are already underway.
Do not publicly name alleged perpetrators until their identity has been reliably established.

First victims, then suspects – the documentary decides

Crypto and investment fraudsters don't just use their victims as a source of income. They also link victims' accounts and wallets to other payment flows to obscure the origin of the funds. This creates a double burden for those affected: their own financial loss on the one hand, and the suspicion of money laundering on the other.

It is therefore crucial to stop the process early, secure all evidence, and chronologically compile bank transactions, perpetrator communications, and blockchain data. If the affected person is themselves a suspect, the strategy should be handled by a criminal defense attorney. A forensic blockchain analysis can provide the technical factual basis. However, it does not replace legal assessment or defense.

Crypto transactions in connection with suspected money laundering?

We document the technical payment methods, wallets and transaction hashes in a structured manner and prepare them for further processing by lawyers or investigative authorities.

Legal notice

This article is for general information purposes only and reflects the status of the cited regulations as of October 2026. The case presented is a study by Finanz Forensik GmbH. Finanz Forensik GmbH / Krypto Investigation does not provide legal advice or criminal defense. If you are a suspect or have forwarded third-party funds, you should seek legal counsel from a lawyer specializing in criminal law.

Sources and legal bases

Crypto transactions/IBAN transfers in connection with suspected money laundering?

We document technical payment methods, wallets and transaction hashes in a structured manner and prepare the results for further processing by lawyers or investigative authorities.

Money laundering suspicion after crypto fraud: What those affected should do now