axi24-cfd.com is a scam: the fake broker, the EUR 30,000 unlocking email and the remote-control software

Please note: we are a law firm that deals exclusively with online investment fraud and unauthorised financial activity. This article is based on a real case handled by the firm and is published in anonymised form as regards the victim, in the public interest. If you recognise your own situation in what follows, you can submit your case using the form at the bottom of this page.

There is an arithmetic that dismantles axi24 on its own. On 13 March 2025 the axi24 victim receives an email officially confirming the "unlocking procedure" for his account, which "currently holds total assets of EUR 360,151.65". To complete the process, it says, "a payment of EUR 30,000 is required". And at the end of the same email: once the account is unlocked, "the residual sum of EUR 30,000 will be credited". He must pay thirty thousand euros in order to be credited thirty thousand euros, on a balance of three hundred and sixty thousand he will never see. axi24-cfd.com is a scam, and that email is its confession.

Why axi24-cfd.com is a scam: both domains are now dead

The axi24 file turns on two domain names, axi24-cfd.com and tradingconsult24.com, used together: the first as the platform, the second as the domain from which the self-styled advisers sent their communications. Both axi24 domains are dead today — but in two different ways, and the difference matters operationally.

A registry query for axi24-cfd.com returns a 404: the domain is not registered. The axi24 platform domain is not suspended, not parked: it has been released. DNS queries return no records at all.

tradingconsult24.com tells a more useful story. The domain was registered on 13 September 2022, expiring on 13 September 2026. Its registry status reads "redemption period" and its nameservers are those typical of expired domains. It was not renewed at expiry and has entered the recovery phase that precedes final deletion.

Here is a point worth more than much commentary, and it makes this file urgent in a way the others are not: during the redemption period the registrar still holds the registrant's data. Once the domain is deleted and becomes available again, that avenue closes. A request from the judicial authority to the registrar made now can still capture the account details, the payment method and the management IP addresses used to register and renew tradingconsult24.com for four years. In a few weeks, in all probability, it will no longer be possible.

Anyone looking today for confirmation that axi24 is a scam will not find the site: they will find it switched off. That is the normal life cycle of these structures, and it is why the evidence must be built on money flows and on the documents the victim kept, not on the website.

A name that echoes an authorised broker

The second element concerns the axi24 name, and introduces a category of fraud worth knowing: the clone firm.

"Axi" is the brand of a genuinely existing, authorised intermediary, long active in contracts for difference. "axi24", and the domain axi24-cfd.com, echo that name with a numeric suffix and the product abbreviation. This is not a lexical coincidence: it is a technique.

The clone firm scheme, which axi24 reproduces, consists in appropriating the name — and often the licence number — of an authorised operator, in order to survive the superficial check a prudent investor performs. The victim searches the name, finds a real regulated intermediary, and concludes that is who they are dealing with. It is not.

The correct check does not go through the axi24 name but through three things a clone cannot replicate: the exact domain the communication comes from, the licence number checked against the supervisor's register, and above all the destination bank details. An authorised intermediary never asks for transfers to accounts held by parties other than itself, and does not operate through a second contact domain such as tradingconsult24.com.

In criminal terms, using an authorised operator's name to induce error constitutes, besides fraud, impersonation under art. 494 of the Italian Criminal Code, and supports unauthorised financial activity under art. 166 TUF, with the reservation on taking deposits protected by art. 130 TUB.

The unlocking email: where the fraud reveals itself

The central document in the axi24 file is the March 2025 communication, and it deserves to be read for what it does, not only for what it says.

The axi24 email comes from an address on the tradingconsult24.com domain and takes the form of an official communication from an intermediary. It confirms "officially the unlocking procedure" for a numbered account, certifies assets of EUR 360,151.65 and requires a payment of EUR 30,000 to obtain "full operation of the account".

Then comes the part that characterises the whole conduct. The email lists what it calls "legal and operational guarantees": regulatory compliance, because "the unlocking procedure is governed by current banking and financial regulations"; the right of withdrawal, because once unlocked the account will be "free of restrictions"; legal protection, because "the entire operation is guaranteed by the client protection principles laid down in banking regulation".

None of these axi24 statements has a real referent. There is no "unlocking procedure" provided for by banking regulation. There is no legal institution under which a client must pay money to access their own. Invoking regulation as a guarantee of the operation is not rhetorical ornament: it is the artifice, because the victim is not induced into error by the promise of a profit — by then he believes he already has it — but by the representation of a legal obligation that does not exist.

As to classification, this is fraud under art. 640 of the Criminal Code in its clearest form: artifices consisting in the representation of non-existent facts (the balance, the procedure, the regulatory guarantee), inducement into error, an act of disposition, unjust profit and loss.

And one detail is worth isolating for anyone who recognises themselves here: the balance displayed on screen is the bait, not the prize. The higher the number, the more proportionate and bearable the unlocking demand appears. Thirty thousand to release three hundred and sixty thousand looks like a bargain. That is exactly the calculation the structure wants you to make.

Remote control: when the fraudster gets into your computer

There is an element in the axi24 file that sets it apart from most cases we handle, and that must come first in the filing: the victim was made to install remote control software.

It is common practice in fake-broker frauds like axi24. The operator offers to "assist you with the setup", to "help you complete the operation", to "show you how it is done". The result is that a third party gains control of the keyboard and screen of the victim's device, often while the online banking session is open.

There are three legal consequences in the axi24 case, none of them marginal.

First: access to another person's device, even where consent was obtained for different purposes and in any event exceeded the limits for which it was given, constitutes unauthorised access to a computer system under art. 615-ter of the Criminal Code, an autonomous offence punished more severely in its aggravated forms. Any acquisition of credentials is also relevant under art. 615-quater.

Second, and this is a technical point we have made the other way round elsewhere on this blog: in ordinary fake-investment cases art. 640-ter, computer fraud, does not apply, because the deception operates on the person and not on the machine. Here the assessment changes. If the operator, through remote control, intervened directly on the victim's computer system — placing operations, altering data, operating on the account — then the intervention "without right on data, information or programs contained in a computer system" required by art. 640-ter does occur, and the offence must be charged concurrently. It is a distinction to be argued on the facts, not presumed, but wherever there has been a remote-control session it must always be checked.

Third is evidential, and the most valuable. The remote control software used on the axi24 victim logs its sessions: date, time, duration and, above all, the identifier of the remote device that connected. Those logs sit on the victim's device and, in part, with the service provider. In a file where the domains are switched off and the accounts are abroad, the remote connection identifier is often the only element pointing directly at a physical device used by the perpetrators.

Hence the most important operational warning in this article: do not format the computer, do not uninstall the software, do not "clean up" the device. It is the first thing instinct suggests after discovering the fraud, and it is a mistake that destroys the best evidence. The device must be set aside, switched off, and subjected to technical examination, if appropriate in the form of a non-repeatable technical assessment under art. 360 of the Code of Criminal Procedure.

Facial recognition and documents: the identity theft that comes afterwards

The victim sent the axi24 structure an identity document, a tax code and facial recognition verification. That last element deserves separate attention.

A biometric video check handed to axi24, combined with the document, is precisely the package required by the remote onboarding procedures of payment institutions and exchanges. Whoever holds it can open accounts in the victim's name. This is not a theoretical risk: it is the typical use of that material.

The consequences are impersonation under art. 494 and, above all, the risk that funds from other frauds will pass through accounts opened in the victim's name, with the paradoxical outcome of facing a money-laundering allegation under art. 648-bis. On the data protection side, biometric images fall within the special categories of art. 9 of the European regulation, with reinforced protection to be invoked in erasure requests.

In these cases the filing does not merely ask for someone to be punished: it serves to date the loss of control over one's own data, recording when and to whom they were handed over.

Having convinced an acquaintance: the most delicate position in the file

This is the point that, in the axi24 file, requires the greatest care, and it is also what most often keeps people away from a lawyer.

The victim, convinced of the merits of the axi24 operation, persuaded an acquaintance to do the same. That acquaintance lost money and has taken legal action against him.

It must be said plainly, because it is why many victims do not come forward: someone who introduces another person to an investment that turns out to be fraudulent is not, for that reason alone, a fraudster. Fraud requires intent, that is awareness and will to induce error. Someone who was himself deceived, and who invested and lost his own money in the same structure, lacks the subjective element: he was an unwitting instrument, not an accomplice.

But that is not an automatic conclusion, and it is established in the proceedings. The supporting elements must be documented, and they are largely the same ones that establish the status of victim: the size of his own payments, their timing, the absence of any commission or economic benefit from the other person's participation, and the continuation of his own payments after theirs.

Two practical corollaries, valid for anyone who introduced others to axi24.

First: whoever is in this position must file their own complaint, and as soon as possible. Being formally a victim in criminal proceedings concerning the same facts is the strongest thing that can be set against a civil claim, because it moves the matter from individual responsibility to a fraud suffered by both. Standing still, in the belief that moving would attract attention, produces the opposite effect.

Second: art. 63 of the Code of Criminal Procedure applies in full. If during an interview evidence of the declarant's own criminal involvement emerges, the authority must stop the examination, warn them and invite them to appoint counsel, and statements already made cannot be used against them; if they should have been heard as a suspect from the outset, those statements are wholly unusable.

Classification and intertemporal law: paragraph 2-ter applies only in part

The axi24 facts fall between 2024 and early 2026, in a sequence that requires a distinction most complaints do not draw.

Art. 640(2-ter), which aggravates fraud committed remotely through computer or telematic means capable of hindering identification, was introduced by law 90/2024, in force from July 2024. Under art. 2 of the Criminal Code the circumstance cannot be pleaded for conduct before that date, while it can and must be for conduct after it — and in this file the later conduct is not marginal: it includes the unlocking demand and payments continuing into early 2026.

Since there are multiple acts of disposition at different times, the complaint must set out the chronology precisely, giving the date of each payment, so that the prosecutor can attach the circumstance only to the conduct that allows it.

Also to be pleaded: impaired defence under art. 61 no. 5, incorporated by art. 640(2)(2-bis), structural in a wholly remote relationship, and substantial financial loss under art. 61 no. 7, fully sustainable against an exposure of this size.

The systemic point applies here in earnest: the six-year statutory maximum of the 2-ter circumstance, counted under art. 4 of the Code of Criminal Procedure as a circumstance with special effect, places the offence above the interception threshold in art. 266(1)(a), which simple fraud does not reach.

Complaint deadline, limitation and prosecutability

The last payment to axi24 falls in early 2026 and awareness of the fraud matured during that year. The three-month period under art. 124 must be checked precisely against the moment the victim actually learned of the facts, which in online fraud coincides with the definitive refusal of a withdrawal or the disappearance of the contact, not with the first transfer.

In any event, pleading the circumstances in art. 640(2) makes the offence prosecutable ex officio, and unauthorised financial activity under art. 166 TUF is so by nature, subject to no complaint deadline. Aggravated unauthorised access under art. 615-ter is likewise prosecuted ex officio.

As to limitation, the period under art. 157 is not less than six years from completion of each episode. With the last payment in early 2026, time is not the main enemy. Dispersal of the funds is.

Foreign transfers: identify the jurisdiction before drafting

The payments to axi24 were made abroad. Italian jurisdiction exists in any event under art. 6 of the Criminal Code, because in fraud the depletion of assets occurs with the debit ordered in Italy.

On cooperation, the instrument depends on the axi24 beneficiary's jurisdiction: towards EU Member States, the European Investigation Order under legislative decree 108/2017; towards third countries, conventional mutual assistance, with considerably longer timescales. The complaint must therefore list the beneficiaries one by one, with IBAN, BIC and country, and identify the correct instrument for each.

The attachment tool remains preventive seizure under art. 321 with a view to confiscation, with evidentiary seizure under art. 253 for the banking documentation and, where the proceeds can no longer be traced, value confiscation.

What to secure immediately if you paid axi24

The list is operational and must be carried out in the order given.

The device first, because it is the only element of axi24 that remains physically in your possession: the computer on which the remote control software was installed must be isolated and no longer used for banking, without deleting anything. The remote session logs, with the identifiers of incoming connections, must be extracted.

Then: every email received from the self-styled axi24 advisers, in original format with complete technical headers, because that is where the routing data of the sending domain lives; not a screenshot, but the message file. Records of every transfer, with complete beneficiary details, IBAN, BIC, country and reference. Screenshots of the member area with the displayed balances and every refused or unanswered withdrawal request. The chats with the operators, exported natively. The list of telephone numbers used. A copy of everything sent to the structure for identity verification, to date the handover of the data. Registry attestations for both domains, with their current status.

On that basis a complaint is drafted pleading aggravated fraud under art. 640(2)(2-bis) — and (2-ter) for conduct after July 2024 only — with the circumstances of art. 61 nos. 5 and 7, unauthorised access under art. 615-ter, where applicable computer fraud under art. 640-ter, impersonation under art. 494 and unauthorised financial activity under art. 166 TUF. With applications for banking enquiries, for seizure under arts. 253 and 321, for urgent acquisition of the registrant data from the registrar of tradingconsult24.com while the domain is still in redemption, and a request to be notified of any application to shelve the case under art. 408(2).

Related cases handled by the firm

Readers who recognise their own case may find useful our analyses of cryptoledgerx.top and the blocked balance, EliteClouds and the unlocking fees on a non-existent prize, dam.w24platform.com and fake debt recovery and sistemascientifico.com.

If you invested through axi24-cfd.com: what to do now

The picture is this. axi24-cfd.com is a scam of the fake-broker type: a name echoing a genuinely authorised intermediary, a second contact domain for communications, an on-screen balance corresponding to nothing, a payment demand presented as an "unlocking procedure" guaranteed by banking regulation, and remote control software installed on the victim's device. Both domains are now inactive, and one of them is still, briefly, in a phase that allows the registrant to be traced.

If you paid money to axi24, if you were asked for a payment to "unlock" a balance, if you had remote assistance software installed on your computer, or if you introduced the platform to an acquaintance and now have a position to explain, time is the only variable working against you.

Our firm has already handled this case. You can submit your position for a preliminary assessment: we will tell you which documents are usable, which aggravating circumstances can be pleaded for each period, how the device must be handled and whether the conditions for a seizure application are met.

If you have suffered the same fraud, we can help you. Fill in the form at the bottom of this page.