Banking and crypto fraud: recovering funds between Italy and Bulgaria

Act promptly and trace the flow of funds

A withdrawal refused by a platform, a bank transfer made following a deceptive phone call or a transfer to an unknown wallet require different checks. It is necessary to establish who initiated the transaction, where the funds passed through and which party might be liable for the loss. The presence of an account or company in Bulgaria does not, by itself, establish fraud or identify the person responsible.

Stop making further payments and immediately contact the bank, payment service provider or provider holding the crypto-assets, using independently verified contact details. Give the transaction details, amounts and times; ask what measures are available to secure access, prevent further transfers and preserve data. Keep the reference number for your report and confirm it in writing. Preparing the case file must not delay these contacts.

Recalling a bank transfer and freezing crypto-assets

For a bank transfer, immediately ask whether cancellation, recall or contact with the beneficiary’s payment service provider is still possible. Recalling funds already transferred does not guarantee their return: timing, availability of the funds and the conditions of the procedure all matter. As a rule, a transfer recorded on the blockchain cannot be cancelled like an ordinary instruction that has not yet been executed.

The crypto-asset service provider may consider taking action if the recipient’s account is on its own platform, within the limits of its powers and applicable obligations. An internal freeze imposed by the provider and a seizure ordered by an authority are different measures. Do not give passwords, private keys or your wallet recovery phrase to anyone promising to trace the money.

Evidence to preserve

Prepare a chronology recording the date, the person you dealt with, the promise made, the instruction given and the amount. Preserve the original files available: a screenshot may document what appeared on the website, but it does not by itself prove that the displayed balance existed. Do not alter conversations or documents.

• Bank transfers and payments: account statements, receipts, IBANs, named beneficiaries, transaction identifiers, currency and communications from the bank.
• Crypto-assets: network used, type and quantity of tokens, wallet addresses, transaction hash, date and time, exported transaction history and account identifier with the provider.
• Relationships and contacts: contracts, terms of service, full URLs, advertisements, original emails, exported chats, telephone numbers and requests for further payments.

Unauthorised payment or payment induced by deception?

The distinction is decisive. For unauthorised transactions, PSD2 requires notification without undue delay and, normally, within thirteen months of the debit: this is not a deadline to wait for. Article 73 requires an immediate refund, no later than the end of the business day following the provider becoming aware of or being notified of the transaction, unless there are reasonable grounds to suspect fraud by the payer which are communicated in writing to the competent authority. The scope of application, national transposition and any permitted derogations for users who are not consumers must be taken into account.

Article 74 governs liability and exceptions, including fraud, intentional or grossly negligent breaches of the user’s obligations and failure to require strong customer authentication. A record of the use of the payment instrument does not necessarily, by itself, prove authorisation or gross negligence: Article 72 places specific evidential burdens on the provider.

In its judgment of 15 October 2026 in Case C-70/25, the Court of Justice clarified that gross negligence attributed to the customer does not justify refusing an immediate refund of an unauthorised transaction. Any subsequent claim by the provider seeking repayment of the sums from the payer, subject to the conditions of Article 74, remains a separate matter.

If, instead, the customer authorised the payment because they were deceived, the refund rules for unauthorised transactions do not apply automatically. Simply stating ‘I was the victim of a scam’ is therefore not enough to establish the bank’s liability. Consent, authentication, warnings received, checks required and the conduct of intermediaries must be examined. A bank transfer to a crypto service and the subsequent transfer of tokens are separate stages requiring separate assessment.

Complaints to the bank and checks on companies and platforms

An effective dispute identifies each transaction, explains how it occurred and sets out a reasoned request. In Italy, after submitting a complaint to the intermediary, an application to the Banking and Financial Ombudsman (Arbitro Bancario Finanziario) may be considered within the limits of its jurisdiction. A report to the Bank of Italy serves a different purpose and does not replace a refund claim. Obligations to verify the beneficiary must also be checked by reference to the date, intermediary and transaction.

For a platform, compare the legal name, registration number, internet domain, contact details and authorised services. Consult ESMA’s MiCA register, the relevant national authorities’ lists and warnings issued by Consob or the Bulgarian Financial Supervision Commission. A brand can be impersonated: using the name of an authorised company does not make a website authentic. The absence of a warning does not certify that an operator is trustworthy.

What changes under MiCA

Regulation (EU) 2023/1114 governs specific crypto-assets and services. The maximum transitional period for providers already operating ended on 1 July 2026; the current legal basis allowing the entity to offer that service must be checked, taking into account the provisions for certain financial entities. Previous national registration does not, by itself, amount to MiCA authorisation.

Authorisation does not guarantee returns or recovery of every loss. For custody services, Article 75 provides for liability for losses resulting from incidents attributable to the provider, subject to a limit linked to market value at the time of the loss. The service actually provided, the contract, the causes of the incident and the applicable rules must be established; not every crypto loss falls within the same protection.

Reporting the facts, identifying the debtor and interim measures

Report the facts promptly to the competent authorities, also assessing whether a formal complaint requesting prosecution (querela) is required and which time limits apply. Attaching the sequence of transfers helps direct the enquiries. Criminal investigations and compulsory orders for obtaining evidence and seizing assets are matters for the authorities: filing a report does not automatically freeze the funds. A hash documents a transaction; it does not, by itself, identify the person controlling the wallet.

The civil route requires identification of the debtor, the legal basis of the claim and assets against which enforcement can be pursued. Claims for repayment or damages against recipients, companies or intermediaries require specific legal grounds and evidence. In Italy–Bulgaria matters, jurisdiction, applicable law and service of documents must be checked. Depending on the circumstances and applicable conditions, national interim measures or the European Account Preservation Order, provided for by Regulation 655/2014 for certain cross-border disputes, may be considered. The latter concerns bank accounts; it is not a general means of freezing any crypto wallet. Even a favourable order requires further steps to obtain payment.

Avoiding a second loss and preparing for initial contact

Be wary of unexpected demands for taxes, release fees or deposits said to be necessary to recover funds already lost. Consob and European authorities warn about ‘fund recovery’ scams, including false claims to act on behalf of public authorities. Independently verify the professional’s identity and contact details, the scope of the engagement and the costs; no one can guarantee recovery merely by claiming to have traced a wallet.

For an initial discussion with the Firm, indicate the amount, dates, countries involved, payment method and reports already made. The contacts are Avv. Andrea De Amicis for Italy and Avv. Sonia Petrova for Bulgaria. Confidential documents will be requested through agreed arrangements after the initial response.