dtw866.it is a scam: fake YouTube "likes" job and prepaid orders

Foreword: we are a law firm that deals exclusively with online scams. We have already handled the case of a person who fell into the trap of dtw866.it, and we can help anyone who has suffered the same scam: if you would like assistance, fill in the request form at the bottom of this article.

dtw866.it is a scam that gives itself away with a single sum: €9,604, paid in nine transfers over fifteen days, all to different natural persons and mostly through cash top-ups of prepaid cards, in order to "unlock" a balance that the platform showed growing with every payment (€1,941, €4,029, €8,739, finally €13,108) and that nobody ever returned. It all began on 6 March 2025 with a message from a foreign number offering remote work: clicking "likes" on YouTube videos for €3-6 each. From there, on dtw866.it, in sequence, came a "teacher", a "manager", a "CFO", "prepaid" orders in BTC/USDT to be executed in 30 or 60 seconds, an invented "error", a "repair order", a "credit score" to be bought back, an "unfreezing fee" and, when the person had nothing left to give, an "expired refund code" to be renewed with another €5,000. We examined the account written by the person and handed to the Postal Police, the formal complaint of 27 March 2025, the statement showing the first credits and the chats exported from Telegram, up to March 2026.

The conclusion is clear: dtw866.it is a scam because an account that shows nothing but a number is not an investment relationship, because no lawful operator makes the withdrawal of one's own funds conditional on paying fees that are different every time, and because the payments were directed, in full, to a network of natural persons holding prepaid cards, that is, to a mechanism for collecting and dispersing money that rules out any real commercial relationship. For those working in criminal law the dtw866.it case has a further point of interest: the complaint was filed in March 2025, the victim was over seventy, the beneficiaries of the payments are natural persons with Italian cards and accounts and, almost twenty months after the events, reconstructing the flows at the issuers is still possible. It is this combination that allows a concrete discussion of aggravating circumstances, prosecutability and the tools available to prompt the judicial authority.

How dtw866.it works: from the fake YouTube "likes" job to prepaid orders in BTC/USDT

The script of dtw866.it is that of the so-called task job. A number with an Indian prefix writes on WhatsApp; the person replies that it depends, that if it is advertising the answer is no, and declines twice; the interlocutor insists: her company supposedly works with "YouTube merchants" who pay to increase bloggers' subscriptions, the work is part-time, all you need is a smartphone, and you earn "from 50 to 400 euros a day". The first task is a €3 test: one "like" on a video and a screenshot. The second is to download Telegram, because "the company uses it to manage payments", with another €3 as a reward. This leads to a "commercial manager" and, the next day, to a "teacher" who explains how to complete the tasks.

It is a structure that supervisory authorities have described for years and that we have already analysed in our review of a fake online job built around a well-known marketplace: a training phase, a small real gain, then the invitation to "invest" in order to unlock more profitable tasks. In the dtw866.it case the person received in the first days about €150, as declared to the Postal Police, in small credits ordered from foreign accounts, as shown by the statement of movements of 6 and 7 March 2025. It is real money, and that is the point: the initial payment, technically pointless for whoever makes it, serves to make the rest credible.

On 7 March 2025 the teacher indicates the platform to use: dtw866.it. The warning that accompanies the address is revealing: "the trading system platform cannot manage any private content and any loss caused by private transactions will be at your expense". It is an exemption clause written in advance for the case, already foreseen, in which the "error" will be attributed to the victim. From that moment the "tasks" are purchase orders on BTC/USDT, with the instructions of a six-step procedure: "Home", "BTC/USDT", "Buy Up", a time of 30 seconds, the amount, confirmation. On dtw866.it the first order is €27 and yields, according to the chat, a gain of €8.10; the second is €46.

The "prepaid orders" of dtw866.it: why every payment served only to justify the next one

The second order on dtw866.it introduces the rule on which the whole scheme rests: "each order is individual and prepaid". To obtain an order with a 30% commission one has to pay in advance €12 (through an online payment service) or €35. The balance shown by dtw866.it rises immediately by the amount paid, the third order "will not appear in the system" and a "refund code" is indicated, to be given to the manager in order to get the money and the bonus back. It is the model we see every time: the starting amount is modest, the gain is declared, and the outcome is deferred to a later step that requires a new payment.

On 8 March 2025 a new order appears, whose "activity code" carries, like the previous ones, an amount (A34-X0Z-135); a transfer of €135 follows, and a second one of €380 "for consulting expenses", with the payment reference chosen by the interlocutor. On 10 March the figure rises to €1,220: the person explains that transfers above €999 give them difficulty and the interlocutor adapts the request, proposing a €995 top-up at a tobacconist's and a €225 transfer to a card account, with the promise of a €2,429 refund. The "teacher" specifies that the merchant's IBAN is updated in real time and that, for each payment, the new IBAN must be requested from her.

This step deserves attention. A lawful business does not change bank details with every receipt and does not register its accounts in the names of different natural persons. The details provided appear in the chat and are deleted shortly after being sent, so that the person has to photograph or note them immediately in order to document the payments: in evidentiary terms this behaviour points to the awareness of whoever deletes them, because it removes the trace of an operation that ought to be transparent. The details, noted in this way, were later included in the complaint.

The "operational error", the "repair order" and the "credit score": the script of the obstacle built on dtw866.it

On 10 March 2025 the teacher starts an "order 3", worth €1,220: "60S", "Buy Down", and this time the written instructions change two parameters compared with the previous orders: the symbol, "BTS/USDT" instead of BTC/USDT, and the direction, "Buy Down" instead of "Buy Up", with three minutes of time. The person selects BTC and presses "Buy Up", as they had done until then, and the system replies that the account "has no balance": the funds "will be frozen" because of an "error". From the standpoint of the deception it is the decisive step: the error stems from an instruction altered at the last moment, to be carried out against the clock, and is then charged to the victim. From that point every request for money presents itself as a remedy for a personal fault.

The remedy proposed by dtw866.it has a name, "repair order", and a price to choose from: €2,300 for "manual correction" with a 40% profit, €4,500 for "automatic repair through an AI system" with a 60% profit. The person says they have only €805. The teacher answers with the most revealing advice of the whole affair: if you need to borrow money from a friend, "you should first find a reasonable and credible excuse", for example saying you want to buy furniture. It is an invitation to lie to third parties which, in an investigation, points to awareness, in whoever formulates it, of the unlawful nature of the operation.

Two payments follow, of €800 on 11 March and €700 on 12 March (the teacher had said she would put in the difference herself, but the calculation she proposes, "2300-800-800=700", still leaves €700 to be paid by the person), the second with a top-up at a tobacconist's and the instruction to photograph the shop before receiving the details. After the repair order, on dtw866.it, the "CFO" arrives, a new character. He informs the person that the "reputation score" has fallen from 100 to 90 because of the error and that, to climb back, "credit points" must be purchased: two hundred euros each, two thousand in all. To the points is added a promise: "the system will automatically reward you with a 50% commission". The payment of €2,000, in cash, takes place on 12 March with the warning to tell the counter staff that it is money for a friend.

Unfreezing fee and "expired refund code": how dtw866.it raised the balance to €13,108 without returning anything

With the score restored on dtw866.it the person is invited to withdraw "in batches": in the CFO's instructions, a first withdrawal of €50, a second of €500, then the whole balance; the "funds password" indicated by the CFO is 123456. The person obtains the first €50, attempts the second withdrawal according to the instructions, which is rejected, and the following attempt returns "insufficient balance": according to the CFO the first step should have been carried out twice, and the funds are now frozen by "risk control". Here too the error, on dtw866.it, arises from an instruction open to two readings. It is the moment when the amount requested changes nature: it is no longer the remedy for an error, but an unfreezing fee equal to 80% of the balance, that is €6,991 out of €8,739. The percentage is then reduced to 50% and becomes €4,369, with the promise that, once payment is made, the total refund will be €13,108 (8,739 plus 4,369): a figure that grows with each payment and that the person will never see.

On 12 March the person announces that they will turn to the Guardia di Finanza. The CFO's reaction is a manual of neutralisation techniques: "If you don't make money because of your own mistake, don't call it a scam"; "we are a company governed by law"; "if there had been false information, we would have been sued a long time ago"; "you can try to verify your identity here", followed by an identity verification procedure on the site that requires uploading photographs of the ID document. The person has to repeat the operation several times because the procedure does not accept the data: the verification serves to gain time and to acquire the document. Between 13 and 22 March the person gathers the sum, going into debt with third parties.

On 22 March 2025 the person pays dtw866.it the €4,369, with two top-ups of €2,369 and €2,000 on two different cards, held by two different people. The available balance immediately rises to €13,108. The withdrawal, however, fails: "reason for rejection: the refund code and the refund amount do not match; contact your teacher to obtain a new refund code". The code, according to the teacher, is "expired" because "the difference between the refund amount and the code amount is too large", and the new code can be obtained only by completing a "refund order": €5,000 with a 60% profit (and a fee of €8,000), or €8,000 with a fee of €12,800. The CFO, asked, declares that he "knows nothing about the order". The two characters pass the person back and forth: a bounce technique that recurs on almost every platform of this kind. The person refuses and observes that the rejection of the withdrawal depends on an internal inconsistency of the system and not on any conduct of theirs: the code would have expired on 22 March, whereas they had been given 24 March as the payment deadline. On 27 March they file a complaint.

Domain, .it registry and authorisations: what can really be verified about dtw866.it

On 12 November 2026 we queried the domain name system for dtw866.it: the public resolver answers NXDOMAIN, that is, the name does not appear to be delegated in the .it zone. In practical terms, dtw866.it is today unreachable: whoever controlled its content no longer has, at least for now, any online presence attributable to that name. The finding is consistent with what the person reported: on 3 March 2026, when trying to access the account, they received an error 522 message, the code with which network intermediary services signal that the origin server is not responding. We cannot say whether the dtw866.it domain was cancelled by its holder, suspended or left to expire, nor when it was registered: the holder's data for a .it domain are not normally available for consultation and, to obtain them, a request from the judicial authority to the .it Registry is needed. It is a request the Public Prosecutor's Office can make and which, in the absence of data on the holder, remains one of the few ways to close the circle on the management of dtw866.it.

As for the authorisations of dtw866.it, no licence emerges from the documents either for dtw866.it or for the parties that ran its operations. The platform offered timed operations on BTC/USDT ("Buy Up" and "Buy Down" at 30 or 60 seconds) with prepaid amounts and fixed percentage returns, that is, contracts in which the customer bets on the direction of the price over a short interval. These are structures comparable to binary options, whose marketing to retail clients has been banned since 2018 by the product intervention measures adopted at European and national level. Anyone who offers new ones in Italy without authorisation is liable for the unauthorised activity provided for by Article 166 of the Consolidated Law on Finance (TUF); the provision of services on crypto-assets also requires the authorisation provided for by Regulation (EU) 2023/1114 (MiCAR), which according to the documents has never been requested. Positive proof (a verifiable licence on the authority's register) is the only check that counts: the absence of warnings against the site, by itself, proves nothing.

Consob has the power, for sites that offer investment services without authorisation, to order the blackout of the site (Article 36, paragraph 2-terdecies, Decree-Law 179/2012). For dtw866.it no measure of this kind appears: the disappearance of the site seems to depend on its operators, not on a supervisory initiative. It is a known pattern: as soon as the flow of new payments dries up, the site vanishes and another appears, with another domain name and the same structure.

Nine payments to nine different accounts: the network of straw holders behind dtw866.it

The formal complaint of 27 March 2025 lists the operations carried out in favour of dtw866.it with date, amount and beneficiary. In chronological order: €135 on 8 March; €380 and €995 on 10 March; €225 on 10 March; €800 on 11 March; €700 and €2,000 on 12 March; €2,369 and €2,000 on 22 March. Total, €9,604. Nine operations, nine recipients: nine different natural persons, holders of prepaid cards or payment accounts, and not companies. The complaint records no payment to a business, an intermediary or a payment service provider attributable to dtw866.it.

It is the most important feature of the case, and it must be read rigorously. A network of nine holders like that of dtw866.it, used in rotation to collect sums between €135 and €2,369, whose availability is organised through cash top-ups at tobacconists and post-office counters, is not the channel of a commercial business: it is a collection network. The holders are, depending on the case, knowing accomplices (complicity in fraud, Articles 110 and 640 of the Criminal Code), persons who receive and make the money disappear (money laundering, Article 648-bis of the Criminal Code, or receiving stolen goods, Article 648), or people who were themselves deceived, recruited with the promise of a fee (an "intermediation" "job") or victims of identity theft. The defence of the unaware "straw holder" is the commonest and must be dismantled with concrete evidence: how the card was issued, how promptly the money was withdrawn or transferred, the presence of the same names in other files. The more victims report payments to the same card, the more the picture of an organised structure (Article 416 of the Criminal Code) gains evidential weight.

One operational detail, for those who want to understand how these payments were orchestrated: the person is told to make the top-ups in cash, photographing the money and the shop, and to tell staff that they are transferring money "to a friend". The instruction is explicit and has no lawful justification: it serves to evade the anti-money-laundering checks of whoever receives the payment. Those checks, however, were triggered: the person reports that the post office started anti-money-laundering verifications, and top-up operations are normally recorded at the merchant and at the card issuer, with the data of the payer and of the receiving card. It is the kind of information that the public prosecutor can obtain quickly and that the injured party must ask to have obtained.

Fraud or extortion? The criminal classification of the dtw866.it facts, the aggravating circumstance of diminished defence and prosecutability

In the chats with dtw866.it's contacts, the person repeatedly calls the conduct "blackmail" and "extortion". It is an understandable but technically inaccurate remark. In extortion (Article 629 of the Criminal Code) the victim's will is coerced by violence or threat; in fraud (Article 640) it is vitiated by artifice and deception. The "freezing of funds" threatened by dtw866.it is not a threat of an unjust harm, but the representation of a fictitious event: the balance was not frozen because it did not exist. Consent to the payment, therefore, is consent obtained by deceit, and the offence remains fraud. The classification matters, because it determines the penalty, prosecutability and the proof of intent.

The artifices and deceptions of dtw866.it are, in this case, all reconstructible: the fake job that gives credibility to the proposal, the initial payments that feign the existence of a business, the dtw866.it platform with balances and "orders" set up by the operators, the fake error, the fake credit score, the expired codes, the characters (teacher, manager, CFO) who pass the victim back and forth. The unjust profit is the money paid to the card accounts, the damage is €9,604. The Court of Cassation gave this reconstruction a reading criterion in judgment no. 5191/2026 (hearing of 13 January 2026): fraud is "of prolonged consummation" when the deceptive activity continues in order to create the reliance needed to obtain further profits. The nine payments are therefore to be read as a single course of events and not as nine frauds: the practical consequence is that, for every purpose of classification and of determining the profit, the damage is unitary.

As for aggravating circumstances and prosecutability, the rules are those introduced by Law 90/2024 and by Decree-Law 48/2025, converted by Law 80/2025. Article 640, second paragraph, no. 2-ter, of the Criminal Code provides an aggravating circumstance for the offence committed remotely by means of computer or telematic tools capable of hindering the identification of the perpetrator. The Court of Cassation, in judgment no. 27907/2026 (hearing of 14 July 2026), clarified that it concerns the manner of execution and that fraud so aggravated is prosecutable on complaint by virtue of the derogation introduced by Decree-Law 48/2025; in judgment no. 18913/2026 (hearing of 26 March 2026) it restated that proceedings are on complaint if no. 2-ter applies and ex officio if Article 61, no. 5, of the Criminal Code applies.

Here the dtw866.it case has a feature that shifts the discussion: the victim was over seventy, stated their age in the very first exchange of messages and repeated several times that they were retired and without other income. Advanced age, known to the perpetrator and exploited, is an element of diminished defence (Article 61, no. 5, of the Criminal Code) and, within the framework drawn by judgment no. 18913/2026, may move the proceedings towards prosecution ex officio. Caution is needed, however: the events date from March 2025, therefore before the entry into force of Decree-Law 48/2025, and the relationship between the regime in force at the time of the offence and the later one (Article 2 of the Criminal Code) must be checked against the file. The complaint, in any case, was filed on 27 March 2025, within three months of the moment when the person understood they had been deceived (Article 124 of the Criminal Code).

Complaint filed, investigations stalled: the tools to prompt the Public Prosecutor's Office

The record of 27 March 2025 is the starting point of the dtw866.it proceedings, not their result. The injured party stated that they wanted proceedings to be brought, elected domicile, reserved the appointment of counsel and received the notice provided for by Articles 90-bis and 101 of the Code of Criminal Procedure. From the file we examined there is no news of any follow-up. It is a condition frequently encountered: the complaint is taken by the judicial police, transmitted to the public prosecutor's office, registered, and then stalls because nobody has indicated which inquiries to carry out. After more than nineteen months, the injured party has tools to reactivate the file.

The first is the request for information on the state of the proceedings and on the entries in the register of criminal reports, which Article 335, paragraphs 1, 2 and 3-ter, of the Code of Criminal Procedure grants to the injured party; it is a written application addressed to the registry of the Public Prosecutor's Office, which makes it possible to know whether the file exists, to which office it is assigned and whether it contains entries against known persons. The second is the appointment of counsel and the filing of a brief with investigative requests (Article 367 of the Code of Criminal Procedure): obtaining the identification data of the nine card holders and the movements, preventive seizure of the remaining sums (Article 321), a request to the merchant and to the issuer for the top-up data, a request to the .it Registry for the data of the domain holder, obtaining, through the Guardia di Finanza and the Financial Intelligence Unit, any suspicious transaction reports generated by the anti-money-laundering checks (Article 35 of Legislative Decree 231/2007), within the confidentiality limits set by law. The third is the link with other pending proceedings concerning the same cards or the same dtw866.it domain: the identity of one holder in several complaints changes the jurisdiction, the seriousness of the picture and the possibility of obtaining seizures.

On territorial jurisdiction in cases like that of dtw866.it, the case law of the Court of Cassation tends to locate fraud, when payment is made by top-up or transfer to a card or an account, in the place where the profit is obtained, that is, where the credit is made: a point that affects the proceedings and must be checked, because the nine holders may have different residences and places of issue, and with them different competent offices. If the Public Prosecutor requests dismissal (Articles 408 and 410 of the Code of Criminal Procedure), the injured party who has asked to be informed must be notified and may lodge an objection indicating the inquiries to be carried out. On recovering the sums see our analysis of recovery of undue payments after an online scam, and on confiscation our in-depth study of confiscation of equivalent value in online scams.

The second act: the "forced refund" addressed to Telegram and the €500 management fee

The second part of the dtw866.it case begins in mid-August 2025 and reveals that the dtw866.it network does not stop at the first victimisation. A new contact from the dtw866.it group, "Valentina", approached on the recommendation of the previous "teacher", proposes the "forced refund" procedure: the person has to fill in a form with the amount ("€17,927"), the refund platform account, the "name of the refunder" and the reason, and sign it. The request, already drafted by the interlocutor, is addressed to Telegram, which has no role in the relationship: it is an invented procedure, a document that the person fills in, signs with their own electronic signature (SPID) and attaches together with the identity card as a PDF. Then, when the interlocutor asks not to receive PDFs any more but screenshots, the person sends them, together with their name, IBAN, bank and telephone number.

At that point the request for money re-emerges in the form of a €500 "management fee", "not deducted from the account", with a deadline (31 August 2025 at 20:00) and a fictitious scarcity ("the remaining number of refunds is 2 people"). The person replies that they do not even have one euro; the interlocutor says she cannot help. The exchanges continue, with letters of guarantee and requests to "improve the document", until March 2026, when the person writes that they can no longer access the account and asks whom to turn to in order to obtain the €13,108 refund; nobody replies.

The most delicate aspect of this phase of dtw866.it is not the €500 request, which was never paid, but what the person handed over: a copy of the identity document, the certified electronic signature and the bank details, to anonymous interlocutors. It is a fact that adds an independent risk (unlawful use of identity, opening of accounts or cards in the victim's name, use of their signature) and that should be reported in the complaint, with a request for checks. Our examination of fake recovery services, in particular in a review of a fund recovery company, shows how the "refund" phase is often run by the same groups.

What to do if you have lost money with a platform like dtw866.it

If you have paid money to dtw866.it or to a platform that asked you to pay for an "order", an "unfreezing fee" or to "repair" an error, these are the steps we recommend, in order of urgency:

• do not pay any more money to anyone, for any reason: not to "repair" an error, not to "restore" a score, not to obtain a new "refund code";
• keep everything: top-up and transfer receipts with the holder's name and the card number or IBAN, screenshots of the account, of the balances and of the withdrawal rejection messages, the full chats with every interlocutor, telephone numbers, Telegram profiles and activity codes;
• export the chats using the messaging app's export function, before the interlocutor deletes them or closes the account;
• note down immediately the details that are shown to you in the chat, because they are deleted after a few minutes;
• file a complaint with the Public Prosecutor's Office or a judicial police office within three months of realising the deception, indicating for each payment the date, amount and recipient, and report the case to the Postal Police;
• if you have sent an identity document, electronic signature or bank details, state it in the complaint, notify your bank and consider appropriate checks on the use of your data;
• after the complaint, request information on the state of the proceedings (Article 335 of the Code of Criminal Procedure) and, with the help of counsel, file a brief with investigative requests;
• distrust anyone who, after the loss, offers to recover the funds by asking for an advance, a fee or the opening of an account.

How to recognise a fake job like that of dtw866.it before paying

Some signs, in the dtw866.it case, were visible before the first payment and recur in almost all scams of the same kind:

• an unsolicited message from a foreign number offering work from home paid for every "like", "review" or "task", with earnings of hundreds of euros a day;
• the quick move to Telegram, as in the dtw866.it case, with "managers", "teachers" and "CFOs" taking turns and a technical, bureaucratic language (activity codes, refund codes, credit scores);
• a small, real initial gain, paid from foreign accounts, to show that "the money arrives";
• "orders" like those of dtw866.it, to be executed in 30 or 60 seconds, preceded by the payment of a "prepaid" sum, and a balance that grows with every payment;
• an "error" blamed on the person and a paid remedy, followed by another penalty, another fee, another code to renew;
• the invitation to lie to a friend, to the bank or at the counter in order to obtain the money, or to declare that you are transferring money "to a friend";
• payments requested to natural persons, with prepaid card top-ups or IBANs changed with every operation, and details deleted from the chat right after being sent;
• the passing of responsibility between interlocutors, as in dtw866.it's "refund order", and, after the loss, someone proposing the "forced refund" with yet another fee.

dtw866.it is a scam: the closing warning

The elements examined lead to a conclusion that, in the absence of evidence to the contrary, we consider well founded: dtw866.it is a scam, in the criminal-law sense of the term. A platform that hands out orders to be executed within a limit of three minutes, that blames the error on the victim, that makes withdrawal conditional on buying credit points and ever new fees, that collects only on prepaid cards held by natural persons and that disappears after the victim has run out of means is not a trading platform: it is a machine for generating payments. What the file lacks, almost two years after the complaint, is not proof of the deception, but the identification of whoever collected the money: an identification made possible, in this case, by the fact that the recipients of the payments are nine natural persons with Italian cards and accounts.

If you have lost money with dtw866.it or with a fake refund service, time is not on your side: the funds leave the cards, top-up data do not remain available forever and platforms change name. If you have suffered the same scam, we can help you.