We have already handled this case. They had already set the date of the "last payment": it is not a deadline, it is the next demand. If you are still in contact you are in the best position, not the worst. If you have suffered the same scam, we can help you: fill in the form at the bottom of this page.
A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.
This file has a feature that makes it different from almost every other one we publish: it is not over. When the injured party contacted us he was still in touch with the people who had defrauded him, and he had a precise date in hand — the day on which he was supposed to make "the last payment".
He decided not to make it. And that decision, together with the choice to act at once, is why this case has better prospects than many others.
a.holdhands.vip is a scam, our firm has already handled this case, and this article explains what to do when the fraud is still under way — because that is the situation in which most can be done, and almost nobody knows it.
Why a.holdhands.vip is a scam: the domain data
Let us start with the checks, which anybody can repeat.
The name on which a.holdhands.vip runs is registered on 8 September 2026, for one year, with a foreign registrar, behind a service that masks the origin server and with no mail record configured. The injured party's payments continue into November 2026, and the domain's registry record was updated a few days before this article was written: the structure is alive now.
A domain like a.holdhands.vip's, a few weeks old, with an annual registration and no corporate mail, is not a platform: it is a tool designed for one season.
That dot before the name
There is a detail in the address a.holdhands.vip that is worth explaining, because it confuses a great many people.
In a.holdhands.vip, the actual domain name is holdhands.vip. The "a." in front is a subdomain: a label that the domain's owner can create freely, at any time, without asking anyone's permission and with no check of any kind.
This means two things. First: whoever controls holdhands.vip can generate dozens of different addresses in seconds — a., b., login., app., vip. — each of which looks like a site in its own right. Second, and more important for anyone verifying: when you check an address, the part that counts is the one immediately before the final extension. Everything to the left of it, separated by dots, is chosen by whoever owns the domain and guarantees nothing.
The same goes for the extension: ".vip" means nothing. It is not a quality mark or a controlled category; it is simply one of the many extensions anybody can buy.
As for the substantive checks, the result is the usual one: behind a.holdhands.vip there is no identifiable company, no VAT number, no registered office and no authorisation number. Anyone collecting money presenting it as an investment must be authorised and entered in the relevant registers.
The scheme: from the dating site to trading
In the a.holdhands.vip file the first contact arises on a dating site.
The scheme of a.holdhands.vip is the now recurrent one, and the romantic part is not background: it is the engine. For weeks there is no talk of money. A relationship is built, habit and trust are created. Then, quite naturally, comes the mention of an investment that is "going well", followed by the offer to help the other person do the same.
Legally the point must be set out clearly in the filing: the relationship built to order is itself the artifice referred to in article 640 of the criminal code. It is not the victim's naivety; it is the machinery of the deception, designed and run by several people.
In the a.holdhands.vip file the total sum is around ten thousand euro, paid over a few weeks.
Payments by prepaid card
In the a.holdhands.vip file the payments were made by topping up a prepaid card in favour of a party presenting itself as a company.
It must be said, because many injured parties blame themselves for it: the prepaid card is proposed precisely because it is simple and immediate, and because it feels like a top-up rather than a transfer. But from an investigative point of view it is good news: a prepaid card issued in Italy is in a named person's name, is issued by an Italian operator subject to anti-money-laundering rules, and every top-up leaves a trace with date, amount and operation identifier.
Concretely: the operator knows the holder of the destination card, keeps the data for ten years, and is reachable with an order of the Italian judicial authority within a short time. There is no foreign platform to chase.
Two practical points. First: the receipts for every top-up must be kept — not screenshots of the app but the official documentation, which is requested from the operator. Second: the holder of that card is almost always a front man, and must not be contacted — it recovers nothing, it puts them on alert and it exposes you.
The part that matters: the fraud is still under way
Here lies the value of the a.holdhands.vip file, and the reason it is worth reading to the end.
When the fraud is still open — you are still in contact, there is a pending demand, perhaps with a date already set — the injured party's position is much stronger than that of somebody arriving two years later. The channels are active, all the data exist, the money moved recently.
Here is what to do, in order, if you are still inside an affair like the a.holdhands.vip one.
Do not pay the sum demanded by a.holdhands.vip. Whatever it is called — last payment, balance, tax, unlocking fee, penalty — and whatever figure is promised in return. It is not the end: it is the next demand.
Do not block and do not delete before exporting everything. It is the most common and most costly mistake. Closing the chat abruptly destroys in an instant the best evidence you have. First export the entire conversation in native format, with dates and times, then consider whether and when to cut contact.
Note down numbers, profiles and addresses. Every contact detail used by the other side is a channel that is live today, and investigatively it is worth far more than a site that will be switched off in three months.
Document the pending demand. The message setting the last payment, with its date, is a valuable document: it shows the conduct is ongoing and is the element on which a charge of extortion, including attempted extortion under article 629, may rest where the demand is accompanied by pressure or threats.
File at once, and in any event before the date set. A filing made while the channels are active allows requests that later make no sense: enquiries into the contact details in use, into the destination accounts and cards, into the domain while it is still live.
Notify your bank or card issuer in writing, asking them not to act on further debits or top-ups referable to those beneficiaries.
The documents handed over
In the a.holdhands.vip file an identity document, contact details, utility bills as proof of residence and a facial recognition check were handed over.
Biometric facial data is not a document like the others: it is personal data of a special category under article 9 of the European data protection regulation, and it is the key many platforms use to verify identity remotely when an account is opened. Whoever holds your document and a facial verification of you has the material to open accounts in your name.
The filing must therefore include a precise list of everything handed over, with dates and channels, and an express, dated declaration of disavowal of any account opened with those documents. And no further photograph or facial verification must be sent, for any reason.
The legal framework
The a.holdhands.vip facts date from autumn 2026, and therefore come after law 90/2024: article 640 paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator.
Alongside it come diminished defence under article 61 no. 5, recalled by article 640 paragraph 2 no. 2-bis, and damage of particular seriousness under article 61 no. 7, to be assessed on the facts. Also relevant are impersonation under article 494 for the use of fictitious identities and of another person's documents, unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion, money laundering under article 648-bis for whoever moved the sums, and, for the still-pending demand accompanied by pressure, attempted extortion under article 629.
On the time limit: simple fraud is prosecutable on complaint within three months of learning of the facts, and with payments in November 2026 the deadline falls in February 2027. The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion in any event — but here time matters for another, far more concrete reason: the channels are active now.
What to secure immediately
Anyone who paid money to a.holdhands.vip must obtain: the official documentation of all top-ups and payments, with date, amount, operation identifier and the beneficiary's details; the native export of all conversations, including those on the dating site; the profiles, numbers and addresses used by the other side; the screenshots of the platform and the exact address, subdomain included; the list of documents and biometric data handed over; and the message setting the last payment demand.
And the warning that always applies: anyone who contacts you promising to recover the sums on advance payment is the second scam, built on the lists of the victims of the first.
Similar cases already handled by the firm
Anyone who crossed paths with a.holdhands.vip will find useful our analysis of tiktok yalmy.shop, where romance baiting is combined with the same use of a subdomain; of m.hashvalueks.com, with the same handing over of facial recognition and a guide to transaction identifiers; and of bgc4invests.com on transfers stopped by the bank.
If you are paying money to a.holdhands.vip: what to do now
This is the picture. a.holdhands.vip is a scam: a subdomain of a name registered on 8 September 2026 with a one-year term, behind a service that masks its server, with no mail and with no identifiable company or authorisation.
If they have already given you a date for "the last payment", that date closes nothing: it is simply the next demand.
And if you are still in contact, you are not late: you are in the best position. Export everything before blocking, note every contact detail, and file before the date they have set for you.
Our firm has already handled this case. You can submit your position to us for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
