BaFin Warns of Identity Theft Involving FxPro Names and Fraudulent Emails from Gmail Account

Key Takeaways

• BaFin has issued a warning about unauthorized financial and securities services offered through emails from a Gmail address (herrywhite569@gmail[.]com) whose operator falsely claims to be FxPro UK Limited.
• Two legitimate firms, one FCA-authorized and one CySEC-regulated, are victims of identity theft and have no connection to the sender.
• Compliance teams should treat this as a fraud typology and impersonation alert and update their screening, monitoring, and customer-awareness controls.

Deep Dive

BaFin has issued a warning about unauthorized financial and securities services offered through emails from a Gmail address (herrywhite569@gmail[.]com) whose operator falsely claims to be FxPro UK Limited. Two legitimate firms, one FCA-authorized and one CySEC-regulated, are victims of identity theft and have no connection to the sender. Compliance teams should treat this as a fraud typology and impersonation alert and update their screening, monitoring, and customer-awareness controls.

No new requirements, deadlines, or compliance dates are introduced. The underlying obligation is unchanged: anyone providing financial or securities services in Germany needs BaFin authorization. BaFin, the Federal Criminal Police Office (BKA), and the state criminal police offices are jointly cautioning consumers about online investment fraud. Firms can verify a company's authorization status through BaFin's company database.

For compliance teams, the main exposure is impersonation-based fraud. Retail clients, and potentially counterparties, may be deceived by emails that borrow the credentials of genuine, regulated firms. Because the fraudulent email address is a free webmail account, the case is a useful example of the red flags to include in training: unsolicited offers, mismatched sender domains, and regulated-firm branding paired with generic email addresses. Firms that are FxPro affiliates or that deal with them should consider the reputational and customer-harm risks.

Recommended actions:
- Add the sender address to email filtering, blocklists, and threat intelligence feeds.
- Run adverse media and name screening against the identifiers in the warning.
- Alert fraud, KYC, and customer-service teams so they can spot related payment requests or client inquiries.
- Review any customer transactions or onboarding applications that reference the sender or the impersonated entities, and escalate suspicious activity through the SAR/STR process where appropriate.
- Reinforce customer communications on verifying authorization through the BaFin database and on BaFin's "Recognizing Financial Fraud" resources.
- Where a firm is itself impersonated, document the incident, notify the relevant regulators and law enforcement, and consider domain takedown and brand-protection measures.

The impact is low for most institutions but meaningful for firms exposed to retail investor fraud, brand impersonation, or fraud-related payment flows. Similar warnings are issued often, so the case supports ongoing monitoring of regulator warning lists as an input to fraud and financial crime controls.

Source: Federal Financial Supervisory Authority