ecommbx.group scam: the located amount that does not exist

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

The sentence that did the most damage in this file did not promise profits. It said: "we have located your money, it is ready to be credited back to you".

Somebody who had already lost twenty thousand euro on a trading platform was not trying to get rich. They were trying to put things right. And that is what the second scam works on: not greed, but hope — which is a far more durable material.

ecommbx.group is a scam, our firm has already handled this case, and this article describes how a fake fund recovery company really works: the located amount, the months of daily contact, and why — paradoxically — this is the most attackable part of the affair.

Why ecommbx.group is a scam: a rotation every two weeks

Let us start with the public registries, which anybody can consult.

ecommbx.group is registered on 10 February 2026, for one year, with a foreign registrar, resting on parking name servers and with no mail at all. Today it is suspended by its registrar: a state imposed by the provider to stop the name working, which in practice follows abuse reports.

But the really interesting datum emerges when the three domains used in the same affair, all built on the same name, are lined up:

ecommbx.group registered on 10 February 2026; the second name on 27 February 2026; the third on 13 March 2026. A rotation roughly every two weeks, with a one-year term and the same provider for all three. And all three suspended today.

This is not disorganisation: ecommbx.group was part of a programmed replacement cycle. You register, you use it while it lasts, you abandon it as soon as the reports start, you move on to the next. The site's name is a consumable.

The name, moreover, is not invented: it is the name of a genuine, authorised payment institution, with the final extension changed. Changing the extension — .group, .online, .co, .vip — requires no authorisation and certifies nothing. The authentic institution has nothing to do with any of this: it is authorised and supervised, its domain has been registered since 2016 and paid up to 2033, and it is itself an injured party of the improper use of its own name.

A methodological clarification, because wrong arguments circulate about such links: the three domains share name servers, but these are the provider's default parking name servers, common to an enormous number of unrelated customers. On their own they prove nothing. What binds them is the same usurped name, the same provider, consecutive dates, the same term, the same outcome — and the documented fact that the same person was taken onto all three.

The located amount

Every fake recovery like the ecommbx.group one has the same structure, and recognising it helps more than anything else.

First: the located sum is always a little larger than the sum lost. On ecommbx.group it was exactly so. It is not a detail: it makes the operation feel as though it has already succeeded, and makes giving up more painful.

Second: the sum is always "blocked". It never simply arrives. There is a formal obstacle — a verification, a tax, a transfer fee, a security deposit, a regulatory adjustment — that requires a payment from the injured party.

Third: every payment opens another one. Once the first obstacle is cleared, a second appears, then a third. That is the engine of the fraud: every sum already paid makes stopping harder.

Fourth: the figures displayed are only text on a page. In the ecommbx.group file, as in dozens of others, the "recovered balance" corresponded to nothing. It was not blocked: it did not exist.

The practical rule is one and it has no exceptions: recovering money does not cost money up front. A professional invoices for their own work; they do not ask you to pay sums to third parties to release a credit. And an Italian lawyer is entered in a Bar roll, an entry publicly verifiable in two minutes — a check to be made always, with us too.

The months of daily contact

There is an aspect of the ecommbx.group file that deserves telling, because it is the most underestimated and the most effective.

With ecommbx.group the relationship did not last one phone call. It lasted months, with daily messages: good morning in the morning, greetings at the holidays, questions about how they were, "I'll call you in ten minutes". A relationship, to all intents and purposes.

And around that relationship revolves a small cast, always composed in the same way, in a precise scale:

The consultant, friendly, available, the one you speak to every day. The figure who builds trust and who is "on your side" against the bureaucratic obstacles.

The lawyer, who appears at a certain point to lend technical authority and confirm that the procedure is regular.

The authority, which arrives at the end, when pressure is needed: a communication in institutional tones, with deadlines and consequences.

Recognising the scale of figures is recognising the script. And one thing must be said, because it matters: in the ecommbx.group file the injured party thanked his contact and offered to reward him for his help. There is nothing to be ashamed of. It is the measure of the effectiveness of a manipulation built over months by professionals, not of the victim's naivety. Shame, in these cases, is the fraudsters' most useful ally: it is what stops people talking about it and filing in time.

Why the second scam is the most attackable

It sounds counter-intuitive, but it is so, and in the ecommbx.group file it is clearly visible.

It is more recent. The payments to ecommbx.group and its twin domains come later, often by months or years: the banking data are all still available and the more recent flows are the easiest to reconstruct.

It goes through ordinary banking channels. To be credible, the fake recovery agent tends to be paid by transfer and card, not through opaque instruments. Every transfer is a name, an IBAN, an institution.

It has a declared identity. The self-styled company presents itself with a name, a website, contacts, written correspondence: material that is often entirely missing from the original fraud.

There is external corroboration. The domains used are suspended by their respective providers: not an assessment by one party, but a documentable position taken by the operator that sold those names.

For this reason the filing must contain both matters, with the two payment flows distinct and separately listed — the one to the original platform and the one to the self-styled recovery company — asking for enquiries into the destination accounts of both.

The legal framework

The fake fund recovery of ecommbx.group is not a tail-end of the first fraud: it is a separate offence, with its own conduct, its own perpetrators and its own payees.

Article 640 of the criminal code applies, with article 640 paragraph 2-ter introduced by law 90/2024 for facts after July 2024, and the aggravating circumstances of diminished defence under article 61 no. 5 — particularly telling here, because the condition of somebody who has already been defrauded and is looking for a way out is exactly the situation of diminished defence the perpetrator knowingly exploits — and of damage of particular seriousness under article 61 no. 7.

Impersonation under article 494 is relevant for the use of an authorised institution's name and, in the final phase, of an authority's name. Whoever presents themselves as a lawyer without being one answers for unlawful exercise of a profession under article 348. When the demand for money is accompanied by the threat of an unjust harm — a complaint, proceedings, confiscation of assets — extortion under article 629 comes into play, completed or attempted. Also relevant are unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion, and, as regards the path of the funds, money laundering under article 648-bis.

The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion. The domains, however, are already suspended, and the data concerning them can be obtained only while the operators keep them: that is why it is not worth waiting.

What to secure immediately

Anyone who went through ecommbx.group must obtain: the complete bank statement in official form, outgoing and incoming, separating the payments to the original platform from those to the self-styled recovery company, with ordering party, beneficiary, IBAN, BIC, country and payment reference; the native export of all conversations, including the daily ones that seem irrelevant — they are the proof of how the relationship was built; the emails in complete original format, not photographed; the exact addresses of all the sites used, including any pages with a personal access key; the names, numbers and declared roles of each person spoken to; and a copy of every contract, invoice, letter or screenshot received.

Similar cases already handled by the firm

Anyone who crossed paths with ecommbx.group will find useful our analysis of eu-ecommbx.com and of ecommbx.online, the other two domains of the same affair — the second devoted to the fake authority letter. On fake fund recovery see dam-w24platform.com. On clones of authorised institutions, manoab.com and mirabaudasset-management.com.

If you paid ecommbx.group: what to do now

This is the picture. ecommbx.group is a scam: a domain registered on 10 February 2026 with a one-year term, with no mail, today suspended by its registrar, the first of three names rotated every two weeks and all built on the name of an authorised payment institution that has nothing to do with it and is itself an injured party.

The amount they told you they had located is not blocked: it does not exist. And the sum demanded to unlock it is simply the next payment.

If you have already paid, it is not money wasted in procedural terms: it is the most recent, best documented and easiest to follow part of the affair. It must be reported together with the first fraud, in the same filing.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.