Remove “European Data Protection Supervisor” email scam

The “European Data Protection Supervisor” email is a fake email from supposedly the European Data Protection Supervisor. The email has a file attached to it that claims an investigation by Europol has been launched against the recipient, supposedly because of “potential illegal activities involving the use of computer networks”. Specifically, illegal activities involving possession and dissemination of child abuse material, and presumption of involvement in criminal activities and pedophilia. The contents of both the email and the attachment are completely fake and can be ignored. The email is likely either phishing for personal information or wants to trick recipients into paying cybercriminals money.

 

 

The email is supposedly sent by the European Data Protection Supervisor and informs recipients that they have received a postal letter concerning the recipient (referenced EDPS2025-0454). The email explains that there is an official response issued by the European Data Protection Supervisor attached to the email. The email claims that recipients must read the document carefully and provide a response within the specified timeframe (72 hours in this case).

The email has an EDPS2025-0454 file attached to it. Users should never open unsolicited email attachments without first scanning them with an anti-malware program or VirusTotal to check for malware. However, this file is not malicious, even if its contents are completely fake.

If you receive this “European Data Protection Supervisor” email, you can completely ignore it.

The full contents of the “European Data Protection Supervisor” email scam:

Subject: Newsletter Nr. 471 vom 18. Mai 2025

Dear Sir or Madam,

We acknowledge receipt of a postal letter concerning you, referenced EDPS2025-0454. Please find attached the official response issued by the European Data Protection Supervisor.

We invite you to read it carefully and provide your response within the specified timeframe, exclusively to the following address: edps.europol@europe.com

We thank you in advance for your diligence and cooperation.

European Data Protection Supervisor
Office address: Rue Montoyer 30, B-1000 Brussels

————-

Sehr geehrte Damen und Herren,

Wir bestätigen den Erhalt eines Sie betreffenden Postschreibens mit der Nummer EDPS2025-0454. Anbei finden Sie die offizielle Antwort des Europäischen Datenschutzbeauftragten.

Wir bitten Sie, es sorgfältig durchzulesen und Ihre Antwort innerhalb der vorgegebenen Frist ausschließlich an die folgende Adresse zu senden: edps.europol@europe.com

Wir danken Ihnen im Voraus für Ihre Sorgfalt und Mitarbeit.

Europäischer Datenschutzbeauftragter
Büroadresse: Rue Montoyer 30, B-1000 Brüssel

The email contains an attachment, an official-looking document with EPPO (European Public Prosecutor’s Office) and Europol’s logos. The attachment is written in quite a convincing way, with mostly correct grammar, and certain laws and regulations mentioned in relevant parts. The text informs users that a Europol investigation has uncovered the recipient’s potential involvement in criminal activities. According to the fake documents, recipients have received the email following a “cyber surveillance and computer seizure operation in the context of a cyber-infiltration”.

The recipient is suspected of having committed several serious crimes and will be prosecuted for possession and dissemination of illegal digital child sexual abuse material, participation in illegal online platforms, presumption of involvement in criminal activities and pedophilia, and unauthorized dissemination of online exhibitionism. The document claims that Europol has evidence to support these allegations, and threatens that recipients are facing 5 to 10 years in prison, and a fine between €4,500 and €76,000. The document also claims that recipients have 72 hours to respond.

The contents of the email and its attached documents are complete nonsense. That is not how the law works. No one about to be prosecuted for crimes like child abuse and pedophilia will receive an email from Europol saying that. They would be detained and questioned by the police. These types of scams are usually after either personal information or money. If recipients interact with the email, they would likely be asked to send their personal information, including their full name, phone number, home address, etc. Recipients may also be asked to pay fines to avoid being arrested for the alleged crimes. Both scenarios make very little sense if one takes the time to consider the situation with a clear head.

Unfortunately, you receiving these types of spam emails means your email address has been leaked. You can check on HaveIBeenPwned which database your email address appears in. There’s nothing you can do about that but you can at least be very vigilant with unsolicited emails and take them all with a grain of salt.