The EU study on online financial scams: the map that anticipates the DSA benchmark
The European Commission has published a study — procured in 2025 from Open Evidence and Spark Legal and Policy Consulting, manuscript completed in August 2026 — mapping six types of online financial scam and four families of countermeasures, to support supervision and enforcement under the Digital Services Act (DSA).
The starting point, stated explicitly by both official sources — the Commission's presentation page and the study's executive summary — is what this work does not do: it does not assess or evaluate the compliance of any individual very large online platform (VLOP) or very large online search engine (VLOSE) with their DSA obligations. It is a reference map, not a report card — but it is a map that will predictably become the yardstick Brussels uses to look at platforms.
The study in brief: what it is for, and what it is not
The study supports the systemic risk assessment required under Articles 34 and 35 of the DSA and, in the executive summary, is also linked to Article 38 of the EU Charter of Fundamental Rights on consumer protection. It covers all online intermediary service providers where financial scams occur, but the enhanced systemic-risk obligations (Arts. 34-35) apply only to designated VLOPs and VLOSEs: the report itself notes, regarding e-commerce scams, that much of the ecosystem remains subject to more limited oversight because it falls outside that perimeter.
The six types of online financial scam
The report (370 pages, section 2, «Typological mapping») lists six types, each with detailed sub-categories:
- Investment scams — including both traditional investment and crypto variants.
- Romance scams — from traditional forms to «romance baiting» and sextortion.
- E-commerce scams — the category with the most documented sub-variants (nine).
- Employment and collaboration scams — fake job ads, «money mule» schemes, bots proposing collaborations via direct message.
- Unexpected gain scams — the classic unexpected-winnings or inheritance messages.
- Charity and disaster relief scams — including fraudulent crowdfunding.
The two official sources do not fully agree on which types are growing fastest: the Commission's presentation page names investment scams and romance scams as the most common and fastest-growing; the executive summary — the technical text signed by the authors — instead names investment scams and e-commerce scams, describing romance scams as «notable» but not in the same top pair. There is no single ranking to rely on: we report both sources here, without naming a single type as «the fastest-growing».
The four families of countermeasures
The report (section 5, pp. 149-211) organises reference countermeasures into four families, with official names:
- Access and gatekeeping measures — identity requirements for personal accounts, KYBC (know-your-business-customer) requirements for business accounts, ad placement requirements, labelling of AI-generated content. Note: KYBC is a measure within this family, not its name — worth keeping straight before citing it in a compliance conversation.
- Detection and removal measures — automated detection, human review, account removal and suspension, detection of coordinated scam networks, recommender system protection.
- User-facing protection measures — reporting tools, information on redress, friction tools.
- Structural level governance and policies — platform-level policies, cooperation with third parties.
What this means for VLOPs and VLOSEs
The study does not announce any formal follow-up: no guidelines or audits are declared as a direct consequence of this work. In the section on cooperation, the report cites the forthcoming «EU Action Plan against Online Fraud» as a related but distinct initiative — not as a step that follows from this study. DSA compliance teams should not expect an implementing act in the short term, but they should not discount the signal either: a study commissioned directly by the Commission, with a 370-page report and such a detailed countermeasure architecture, is the most predictable basis on which the next phase of systemic-risk and financial-scam supervision will be built.
The practical take-away — and here it is Tomato's editorial reading, not a Commission statement — is that compliance and legal teams at a VLOP or VLOSE would do well to benchmark their current controls against the four families listed today, in particular checking whether they already have KYBC requirements for business accounts and not just identity verification for individual users, before that map effectively becomes the benchmark supervisors use to judge the adequacy of adopted measures.
Sources
- European Commission — DSA study: financial scams on online platforms and ways to counter them (presentation page).
- Spark Legal and Policy Consulting & Open Evidence, Support contract on financial scams Study — Final Report (European Commission, DG CONNECT, 2026) — Publications Office of the EU (full report, 370 pages).
- Idem, Executive Summary (EN/FR) — Publications Office of the EU.