On Tuesday Croatia’s National CERT, the central body for protection against computer security threats operating within CARNET, published a number that could easily sit on the front page of a business section: in the first nine months of 2026, Croatia recorded 1,203 cyber incidents. Of those, 36 percent — 439 cases — were phishing, 24 percent (289) were unwanted messages, and 19 percent (224 incidents) were other kinds of financially motivated fraud. The list also includes 37 business frauds, five data thefts and three ransomware attacks. Structurally, the breakdown resembles the trading report of a well-run exchange: everything neatly categorised, no surplus emotion. The only difference is that here nobody sells anything, and yet everybody still sends an invoice.
The figure landed just ahead of October, European Cybersecurity Month, during which CARNET’s National CERT is running a public-awareness campaign called “Small habits. Big impact.” The advice sounds almost like etiquette: lock the screen when stepping away from the computer, use a password manager, check the sender of an email before clicking a link. In a world where a crypto investment scam can cost a victim several years’ worth of salary, the gap between those small habits and catastrophe really is exactly that — small habits, big impact. A single wrong click separates a pension from its conversion into USDT at an address beginning with 0x.
When the thief has a better user experience than the exchange
If the Croatian crypto scene were a league in which a handful of clubs compete every season, fraud would have clinched the title several rounds before the end. While regulated exchanges struggle with customer support and identity verification, the fraudulent side offers exactly what the market wants: zero paperwork, 24/7 support in Croatian, a personal relationship, and the promise of returns that grow every single day. It is Ocean’s Eleven, minus George Clooney’s charm and with a call centre that never sleeps.
The cases from recent weeks all fit the same picture. Brodsko-posavina police filed criminal complaints against unknown perpetrators after a 50-year-old man, convinced he was investing in cryptocurrencies, lost around EUR 140,000. In Slavonia, an 81-year-old woman believed to be investing in crypto lost EUR 34,000. Police in Koprivnica are investigating the case of a 61-year-old who, trusting promises of quick profit, made several payments — and when he tried to recover his money, he was defrauded again. There is no magic in any of it; it is a classic three-act drama in which the audience buys a ticket to the show and then leaves without either the wallet or the show.
In late September, Zadar police received two fraud reports in a single day — one involving crypto trading, the other an investment-fund scheme. That is why officers are visiting pensioners’ associations; in Kastav, a recent workshop had older citizens offering their own examples: fake SMS messages in the name of Croatian Post about an undeliverable parcel, calls from a fake “doctor” demanding an urgent payment for surgery, and investment frauds built around stocks, crypto, precious metals and oil. The method is always the same: scammers stay in touch with victims over a long period, falsely assuring them their investment is performing, while in the background the number on the screen rises only inside the app the fraudsters built themselves.
The central bank, e-Građani and a fake governor
The methods keep improving. National CERT highlights impersonation of state institutions and well-known companies, imitation of the e-Građani government portal, and the takeover of user and administrator accounts. Fraud linked to tourist bookings is on the rise, using real reservation data to push people into extra payments or into handing over card details — a seasonal business that, unlike tourism itself, does not close in October. WhatsApp scams are also multiplying, in which a stolen account is used to spread fresh attacks among the victim’s contacts. This is no longer casting hooks at random into the sea; it is fishing with a known catch.
Croatia’s central bank (HNB) has again warned about fake media articles claiming that HNB governor Ante Žigman is promoting an alleged “National Pension Savings Programme” on the mirovinsko.hr portal. “The Croatian National Bank and its officials do not participate in promoting any financial services or investments, including investments in cryptocurrencies,” the central bank said. It urged citizens to report suspicious posts to the platforms and to HNB, and to report fraud cases to the police. In translation: when a governor, a pension and crypto appear in the same sentence, the odds that it is an honest offer are roughly the odds of hitting every number in the lottery — twice in a row.
On the other side of the fence: a licence, a tax number and supervision
There is also that other Croatian crypto scene — the boring, tidy and regulated one. Since 1 July 2026, crypto-asset service providers in Croatia may operate only with a domestic licence from HANFA or a licence from another EU member state. By September, HANFA had authorised five domestic providers, among them Electrocoin and Bitcoin Store. There are 161 foreign providers that have notified HANFA, and according to the ESMA register updated on 22 September, 175 of its 362 entries are permitted to operate in Croatia. Binance, for instance, is not on that list — a neat illustration that “a familiar name” and “a Croatian licence” are not the same thing.
Alongside exchanges, a network of physical machines for buying and selling crypto assets for cash is growing. One example is Kriptomat.hr, a brand of the Zagreb company Bitblock d.o.o., which has been building a network of such devices across the country for years. Under that model, purchased assets are not held by the provider but go directly into the user’s own wallet. Tax does not depend on where trading happens: gains from selling crypto for euros are taxed at 12 percent, with an exemption after two years of holding, while crypto-to-crypto swaps are not taxed. A regulated provider has an address, a tax number and supervision; a fraudster has a Telegram profile and, at best, a convincing profile photo.
Hanfa’s fortress and the quantum threat
While the public focuses on fraud, the regulator is building a defence. In early October, Zagreb hosted the third “DORA and Digital Resilience” conference, gathering more than 200 representatives of the financial industry, supervisory bodies and cybersecurity experts. The central theme was the impact of artificial intelligence on financial-sector security — both its benefits for risk management and incident detection, and the entirely new attack possibilities such technology brings. “Digital resilience is not a one-off project, but a lasting ability to adapt to new technologies and ever more complex threats,” said Martina Verić, a member of HANFA’s Management Board.
The event also covered quantum computing and preparation for so-called post-quantum security, while a representative of the National Cyber Security Centre (NCSC-HR) presented the current threat landscape in Croatia. The message is clear: defence against fraud is no longer the job of an individual who clicks wisely, but of a system that must stay one step ahead. In that race, regulators, banks and exchanges run like Olympic athletes — except that the criminals run without a load and without a conscience, and the finish line keeps moving on its own.
A bull market is the best fertiliser for fraud
The backdrop does not help. In early October, Bitcoin held between USD 83,000 and 86,000, and local outlets reported it had broken an important technical level with a weekly close at USD 81,159, the first time since November 2025. One detail for the history books: Bitcoin’s all-time high of USD 126,080 was recorded on 6 October 2025, so this autumn marks the anniversary of a peak from which the price has since fallen by almost a third. When prices rise, everyone is briefly a genius — and that is precisely when the genre that promises a “safe” ten percent a month flourishes. A bull market is the best fertiliser for fraud: while everything is green, nobody asks why their money ended up in someone else’s wallet. Winter usually arrives later, in the company of a police report.
The conclusion is almost dull, but the statistics repeat it relentlessly. The most successful Croatian crypto platform of 2026 needs no licence, has no bad review on review sites because nobody gets the chance to leave one, and offers 24/7 customer support in Croatian. Its name, depending on the week, is different. And the only “analysis” that truly works in that world is the one police repeated in Kastav: if something does not sound true in the real world, it will not become true in the virtual one either.
Market context
- Bitcoin (BTC): ~USD 83,771 | 24h: −2.6% | market cap: ~USD 1.68 trillion | 24h volume: ~USD 35.3 billion | ATH: USD 126,080 (6 Oct 2025) | ATL: USD 67.81
- Ethereum (ETH): ~USD 2,595 | 24h: −4.2% | market cap: ~USD 317 billion | 24h volume: ~USD 16.5 billion
- Regulatory framework: MiCA (fully applicable in Croatia since 1 July 2026) | HANFA: 5 authorised domestic providers | Capital gains tax: 12%
Disclaimer: This article is for informational purposes only and does not constitute investment advice or a recommendation to buy or sell crypto assets. Crypto assets are highly risky, are not insured like a bank deposit, and their value can fluctuate significantly. Invest only what you can afford to lose. If you suspect fraud, report the case to the competent police administration.