Skip to content
Scammers.com
ImpersonationReviewed

BaFin warns of fixed-deposit offers emailed from @santander-finance-europe.de posing as Santander

Germany's financial regulator BaFin published a warning dated 11 November 2026 about fixed-term and overnight deposit offers sent from email addresses with the domain @santander-finance-europe.de. BaFin suspects the u…

First reported
Reports
1

Source: bafin.de · published

Illustration: Impersonation scams

What happened

Germany's financial regulator BaFin published a warning dated 11 November 2026 about fixed-term and overnight deposit offers sent from email addresses with the domain @santander-finance-europe.de. BaFin suspects the unknown operators conduct banking business or provide financial services without permission. The senders claim the offer comes from Santander Consumer Bank S.A. or Openbank Deutschland AG; BaFin says these claims are untrue and amount to identity misuse. The domain santander-finance-europe.de is the one named by BaFin as used by the senders. BaFin says information on whether a company is authorised can be checked in its company database, and that the warning is based on section 37(4) of the German Banking Act (KWG).

How the scam works

Unlicensed investment, deposit and loan websites, and emails that misuse a real bank's name, are designed to look like ordinary financial products. Once money is sent, it is often moved quickly and is difficult to recover. BaFin's warning means the named site or sender is not authorised to offer those services in Germany. A UK or other company number, a professional looking site or a familiar bank brand in an email address is not a licence. Check a firm in BaFin's company database, and do not send money, documents or login details in response to this kind of approach.

BaFin warns about fixed-term and overnight-deposit offers emailed from addresses at santander-finance-europe.de. It suspects the unknown operators are conducting banking business or financial services without permission, and says they claim the offer comes from Santander Consumer Bank S.A. or Openbank Deutschland AG. Those claims are false: it is identity misuse, and Santander and Openbank are not involved. BaFin issued several other unauthorised-offer warnings on the same day, including lilac-holdings.com, davoripro.com, hanseanlage.com / hanseartesep.com and kapitum.com.

Source

German Federal Financial Supervisory Authority (BaFin) warning, 11 November 2026: https://www.bafin.de/SharedDocs/Veroeffentlichungen/DE/Verbrauchermitteilung/unerlaubte/2026/meldung_2026_11_11_santander-finance-europe.html

Red flags

  • An investment, deposit or loan offer from a site or email domain that is not in BaFin's company database.
  • A familiar bank or company name in an email address or imprint that does not match the real firm's official domain.
  • Pressure to send money, documents or login details quickly to secure a rate or a 'private' product.
  • A UK or foreign company number used as if it were a German licence.

If you were targeted

  1. 1Do not send money, documents or login details in response to this offer.
  2. 2Check the firm in BaFin's company database and through any other regulator that covers you.
  3. 3Contact the real bank or firm only through a number or address you already have, not one in the email.
  4. 4If you already paid, tell your bank and report the approach to the police and to BaFin.

BaFin warns davoripro.com (Davori Global LLC) offers financial and crypto services without permission

Germany's financial regulator BaFin published a warning dated 11 November 2026 about the website davoripro.com. BaFin says financial, securities and crypto-asset services are offered there without the required permiss…

  • davoripro.com
  • BaFin warning 11 Nov 2026; operator names Davori (haftungsbeschränkt) / Davori Global LLC
  • BaFin warning, 11 November 2026
Reported Nov 11, 20261 report

BaFin warns lilac-holdings.com offers unlicensed financial and crypto services, suspected identity theft

Germany's financial regulator BaFin published a warning dated 11 November 2026 about the website lilac-holdings.com. BaFin says the site offers financial, securities and crypto-asset services without the required perm…

  • lilac-holdings.com
  • BaFin warning dated 11 Nov 2026; operator names Lilac Capital Limited / LLC (Manchester)
  • BaFin warning, 11 November 2026
Reported Nov 11, 20261 report

Android malware posing as FamilyMart spread via hanwgsercassa.eu.cc

Security researcher @masaomi346 posted on X on 11 November 2026 about Android malware impersonating FamilyMart (ファミリーマート), the Japanese convenience store chain, distributed from hxxps://hanwgsercassa.eu[.]cc/, tagged…

  • hanwgsercassa.eu.cc
  • Android malware (APK)
  • eu.cc fine/malware smishing cluster (12 Nov 2026)
Reported Nov 11, 20261 report