2pmeuropesa.com is a scam: real MetaTrader, fake broker, suspended domain

Preliminary note: we are a law firm and we deal exclusively with online fraud and the unauthorised provision of financial services. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.

It all starts with two hundred and fifty euros. A sum anyone can afford to lose, and that is exactly why it is asked for.

Then come the daily phone calls, a trading program to install, an account that rises by itself, a two-hundred-euro withdrawal that "proves" it works, a twenty-five-thousand-euro project and, at the end, the sentence that gives everything away: you have until tomorrow.

2pmeuropesa.com is a scam, the firm has already handled this case, and this article explains why the program they make you install is genuine while the broker is not, how the handover between three different "advisers" works, and what to do when the demands turn into threats.

Why 2pmeuropesa.com is a scam: the checks

The name evokes a European public company: "2PM Europe SA". Let us start there, because that is where verification is easiest.

No authorised intermediary under that name appears in the public supervisory registers available for consultation, nor is there a VAT number, a registered office or any verifiable corporate reference. The letters "SA" in the domain name are not a legal form: they are a string of text anyone can buy along with the domain.

The registry checks are even more eloquent. The 2pmeuropesa.com domain was registered on 16 March 2026, expiring on 16 March 2027: one year, the minimum term. But above all, since 29 October 2026 the domain has been in clientHold status.

It is worth explaining what that means, because it is a fact that carries weight. clientHold is a suspension imposed by the registrar: the name remains registered but is detached from the network, and the site stops responding. It is a measure operators typically take following abuse reports. It is not a judgment, but it is external corroboration, documented and independent of the injured party's word.

The date matters: the injured party's last payment was in October 2026, and the site went dark in those same weeks. Anyone looking for 2pmeuropesa.com today would find nothing — which is why the screenshots kept at the time are worth more than any later reconstruction.

The program is real. It is everything else that is not

Here is the technical point that makes 2pmeuropesa.com so convincing, and it is worth understanding properly.

The injured party was made to download MetaTrader 4, and an account was "opened" for them on that platform. MetaTrader 4 is a genuine program, developed by a well-known software house and used by a great many regulated intermediaries worldwide. It is not a fake, it is not a virus, and whoever installs it sees a professional terminal that really works.

That is precisely the trick. MetaTrader is only the terminal: the data it displays come from the server it is connected to, and that server is chosen by whoever gave you the credentials. If the server is run by the organisation, the balance, the open positions and the profits you watch rising are numbers written by them. The program works perfectly: it is simply displaying, faithfully, an invented reality.

Hence the practical rule, which goes well beyond 2pmeuropesa.com: it is not the application that tells you whether an intermediary is authorised. The public register of the supervisory authority tells you that, and nothing else. Before paying a single euro, search for the exact company name in the register of authorised intermediaries and check that the party writing to you is the one listed. If it is not there, it does not exist.

There is also a technical detail worth noting for the complaint. The program was distributed through a dedicated installation domain, registered in March 2025 and paid up to 2027, that is, much older and much longer-lived than the commercial name used with the injured party. That is how these structures work: the brand is disposable, the delivery infrastructure is reused. We documented the same pattern writing about dsfs36.it.

The three advisers: a script, not three people

In the 2pmeuropesa.com case the injured party dealt, in sequence, with three different figures. That is not chance: it is a structure.

The first is the 2pmeuropesa.com adviser who opens the relationship. He calls every day, talks about algorithms and spreads, takes an interest in your work and your family, builds a relationship that deliberately goes beyond the professional. His job is trust.

At a certain point the first adviser disappears with an honourable excuse — in our case, a transfer abroad — and hands the client to a second, recommending blind trust. His job is to raise the stakes: the results become brilliant, the figures grow, the big project is proposed.

When the client stops and asks for the money back, the third comes on stage, and he is no longer ingratiating. He is the manager: the one who demands explanations, who recalls the commitments made, who sets a deadline.

The names used change from victim to victim and are in all likelihood false: they are not people, they are roles. Recognising the handover is useful precisely for that reason: when the adviser "is transferred" and hands you to a colleague, you are not changing interlocutor, you are moving to the next phase of the script.

The withdrawal designed to convince you

In the 2pmeuropesa.com affair the injured party really did receive money: about two hundred euros, withdrawn from a balance showing four thousand, through a procedure described as deliberately complicated, "created on purpose to stop me repeating it".

That detail is precious, because it explains the logic of the whole operation. The withdrawal is not there to pay you: it is there to prove that withdrawal is possible. And it is made laborious precisely so that it is not repeated. Two hundred euros spent to unlock twelve thousand five hundred are, from the payer's point of view, an advertising investment.

We have written about this in relation to webtrader.rdpsystem.pro too, where the small initial credit performs exactly the same function.

The "supervisory authority" documents and the project that is not a contract

In the 2pmeuropesa.com sequence the injured party was shown documents presented as coming from the Italian supervisory authority, together with an investment project file and a document on "deposit protection limits".

Two things must be said clearly about 2pmeuropesa.com.

First: the supervisory authority does not issue individual savers guarantee documents, deposit-protection certificates or project certifications. What the authority does, and anyone can consult it free of charge, is keep public registers of authorised intermediaries and publish warnings and blocking orders against unlawful sites. If someone sends you a "document from the authority", that document must be checked against the authority's official site, not against the reassurances of whoever sent it.

Second: what was signed was not an investment contract but a "request to join a project", accompanied by a copy of the identity document. That difference works in the injured party's favour, not against: a party without authorisation cannot provide investment services, and relationships built in breach of the rules on form and authorisation do not produce the effects the organisation claims to enforce. No one can demand the "balance" of a commitment made to an intermediary that does not exist.

When the demand becomes a threat

This is the step that characterises the final phase of 2pmeuropesa.com in criminal terms.

When the injured party asked 2pmeuropesa.com for their money back, expressly giving up the "profits" shown on the platform, the answer was not a refund: it was a demand to pay more, as a condition for recovering what had already been paid. And when they refused, a deadline arrived, with an "otherwise" deliberately left hanging.

An unjust harm held out in order to obtain a payment is extortion under Article 629 of the Italian Criminal Code, completed if you pay, attempted if you do not. It is not a commercial negotiation gone wrong: it is a separate offence, more serious than fraud, and it must be pleaded as such.

Anyone at this stage with 2pmeuropesa.com must do three things: do not pay, do not argue about the accusation or the commitment being thrown back at you, and keep everything, including calls received from different numbers, noting the date and time of each. Blocking the numbers is not enough, because whoever is calling has others: what is needed is the log, not silence.

Where the money went

In the 2pmeuropesa.com case the payments were requested partly by bank transfer and partly onto an Italian prepaid card held by a natural person, presented as the company's "accountant".

That person's name is not published here and must not be contacted: often these are people who have themselves been recruited, or identities used without their knowledge, and a private initiative only risks compromising the investigation.

It must be said, however, that in the 2pmeuropesa.com case this is paradoxically a favourable element. An Italian prepaid card is issued by an Italian intermediary, subject to customer due diligence and to the ten-year retention duties laid down by anti-money-laundering rules. That means that behind that card there is an identification and a documentary trail, and that the Italian judicial authority can obtain them within a reasonable time. It is a concrete lead, and it must be set out precisely in the complaint.

The legal framework

The 2pmeuropesa.com facts date from autumn 2026, and are therefore subsequent to Law 90/2024: Article 640(2-ter) of the Italian Criminal Code applies, aggravating fraud committed remotely by means of computer tools capable of obstructing identification of the perpetrator.

The aggravating circumstances of diminished capacity to defend oneself (Article 61(5)), particularly evident in a relationship built on daily contact over months, and of particularly serious financial loss (Article 61(7)) also apply. The repeated payments amount to a continuing offence (Article 81(2)).

The final phase amounts to extortion (Article 629), completed or attempted. Offering investment services without authorisation falls under Article 166 of the Italian Consolidated Law on Finance, prosecuted ex officio; anyone presenting themselves as a financial adviser without being one is also liable for the unlawful exercise of a profession (Article 348) and for impersonation (Article 494). The use of documents invoking a public authority must also be assessed as forgery. The subsequent movement of the sums is relevant as money laundering (Article 648-bis).

Finally, the computer-related aspect linked to the remote-control program installed on the computer must be considered, on which we refer to what we have written about axi24-cfd.com.

The aggravating circumstances of the second paragraph of Article 640, the extortion and Article 166 make the matter prosecutable ex officio.

What to secure immediately

Anyone who has paid money to 2pmeuropesa.com should obtain: the complete bank advices for all transfers and top-ups, with destination IBAN or card number, holder, value date and reference; the screenshots of the terminal showing balance, positions and account number, because the server can no longer be reached; the project file and every document received, in the original; the native export of the conversations, done with the application's own function; the complete list of telephone numbers used to call, with dates and times; the name of any remote-control program installed; and the complete banking documentation in official form, invoking Article 119(4) of the Italian Consolidated Banking Act, which gives the right to a copy of the documentation of transactions over the last ten years.

The complaint must contain the application for preventive seizure (Article 321 of the Code of Criminal Procedure), the request for information on registration under Article 335 and the request for notice in the event of a request to shelve the case under Article 408(2).

Similar cases already handled by the firm

Anyone who has come across 2pmeuropesa.com will also find useful our analysis of veneziace.com on the staircase of payments that never ends, and that of hmrevenue-agency.com, on people who pay several times to "unlock".

If they are asking you to pay again: stop

The picture is this. 2pmeuropesa.com is a scam: a domain registered in March 2026 for a single year and suspended by the registrar at the end of October 2026, behind which there is no authorised intermediary, which used a genuine trading program connected to its own server in order to display non-existent profits.

If you have been given a deadline to pay, that deadline is not an obligation: it is a threat, and as such it belongs in a criminal complaint. Do not pay, do not argue, keep everything.

The firm has already handled this case. You can submit your situation for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.