ecommbx.online scam: the fake letter from an authority

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

At the end of the affair, the injured party in this file received a letter. Written in impeccable Italian, on the letterhead of a British financial supervisory authority, complete with references to European legislation. It demanded payment of a sum by a specific date and, failing that, held out the prospect of criminal proceedings for money laundering: up to fourteen years' imprisonment, unlimited fines, confiscation of assets "even if transferred to third parties".

It was fake, like everything that came from ecommbx.online. And the way it was built is worth taking apart piece by piece, because anybody can find themselves facing it.

ecommbx.online is a scam, our firm has already handled this case, and this article explains how to recognise a fake letter from an authority — and why, legally, we are no longer in the field of simple fraud.

Why ecommbx.online is a scam: the registry data

Let us start with the checks, which anybody can repeat.

ecommbx.online is registered on 27 February 2026, for one year, with a foreign registrar, resting on parking name servers and with no mail configured. Today it is suspended by its registrar: a state the provider imposes to stop a domain name working, and which in practice follows abuse reports.

The name of ecommbx.online is not invented. It is the name of a genuine, authorised payment institution, with the final extension simply changed. Changing the extension — from .com to .online, .group, .co, .vip — requires no authorisation and certifies absolutely nothing: the resulting domain belongs to whoever registers it, not to the institution.

It must be said at once: the authentic institution has nothing to do with any of this. It is an authorised and supervised electronic money institution, and it is itself an injured party of the improper use of its own name. Its domain has been registered since 2016, already paid up to 2033 and protected by all the registry's security locks: ten years of history against a name born a few weeks before it was needed.

In the file, ecommbx.online was the second of three domains built on the same name, used in sequence within the same affair, all with a one-year term and all suspended today — after the injured party had already been defrauded once on a trading and cryptocurrency platform.

The letter, taken apart point by point

Now the useful part, for anyone who has received a communication from ecommbx.online or similar sites. Here are the signs that make a fake authority communication recognisable, all present in the letter received in the ecommbx.online case.

First: a supervisory authority does not issue invoices to a private individual. In the ecommbx.online case this alone was enough. An authority supervises, sanctions and publishes warnings; it is not a consumer's creditor, it does not send them payment deadlines and it does not grant them extensions. If a communication attributed to an authority contains an amount to be paid, it is fake. There is no second reading.

Second: the rules cited by ecommbx.online are irrelevant. The letter invoked the European directive on late payment in commercial transactions. That regime concerns payments between undertakings and between undertakings and public authorities: it has nothing to do with a consumer supposedly owing money to a supervisory authority. The reference serves only to produce legal noise — to make the letter look technical and therefore genuine. It is a recurring technique: the more a communication is stuffed with acronyms, directive numbers and articles, the more worthwhile it is to verify just one of them, because that is enough to bring the whole structure down.

Third, and this is the core: the criminal threat. Holding out to the victim an accusation of money laundering, with years in prison, unlimited fines and confiscation of assets, is not a warning: it is the instrument of pressure. And it contains a contradiction worth seeing: whoever genuinely suspects money laundering does not warn the person concerned, and above all does not offer them the chance to avoid the consequences by paying. An authority that establishes an offence does not negotiate. A blackmailer does.

Fourth: the tight deadline and the "extension granted exceptionally". Time pressure — a few days, a single concession, "no further extensions will be granted" — is a manipulation technique, not administrative practice. It is there to stop the person pausing to check or talking to somebody.

Fifth: the channel. In the ecommbx.online file the letter did not arrive through an institutional channel: it came via the "consultant" the injured party was in daily contact with. Authorities do not communicate with citizens through a private intermediary on a messaging app.

To these is added, in this case, a further telling element: besides the domains built on the institution's name, a separate site with a personal access key had been set up, communicated to the injured party alone. A page built for a single recipient is not a platform: it is a stage set.

Why it is not "just" fraud

In the ecommbx.online file this is the step that matters for the filing, and it is often overlooked.

As long as payments are induced by artifice and deception, we are within fraud under article 640 of the criminal code. But when a person is threatened with an unjust harm — a criminal complaint, prison, confiscation of their assets — in order to obtain a payment from them, a different and more serious offence comes into play: extortion under article 629, completed if the payment is made, attempted if it is not.

This is not a technicality. Extortion carries a far heavier sentencing framework, is prosecutable of the court's own motion, and gives the file a weight that simple fraud does not have. For it to be charged, however, the threat must be in the filing, documented: the letter must be attached in its original form, not summarised.

To this is added impersonation under article 494: attributing to oneself the name and capacity of a public authority in order to induce somebody to pay is precisely the conduct that provision describes. And whoever presents themselves as a lawyer without being one also answers for unlawful exercise of a profession under article 348.

For the overall picture there remain article 640 paragraph 2-ter, introduced by law 90/2024 for facts after July 2024, the aggravating circumstances of diminished defence under article 61 no. 5 and of damage of particular seriousness under article 61 no. 7, unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion, and money laundering under article 648-bis for whoever moved the sums.

What to do if you receive a letter like this

Five things, in order, valid for ecommbx.online and for any message of the same kind.

Do not pay. Whatever the sum demanded by ecommbx.online or by whoever writes on its behalf, and whatever consequence is held out. Payment closes nothing: it opens the next demand.

Do not answer the threat and do not argue with it. There is no point defending yourself against an accusation invented by the person who wrote it.

Do not delete anything. Keep the letter, the messages that came with it and the channel it arrived through.

Export it in original form. If it is an email, you need the complete original format with the technical headers, obtained with the "view original message" function of your mail program; not a photograph of the screen. If it arrived in a chat, export it with the application's native function, with date and time.

Check and report. Every authority's official website states its own communication channels, and the main supervisory authorities publish warnings and collect reports about the abusive use of their name. Reporting does not recover the money, but it feeds the public warnings that stop the next person.

And the general rule, the one to remember even in ten years' time: no public authority, Italian or foreign, asks a private individual for money in order to release funds, close a position or avoid proceedings.

What to secure immediately

Anyone who went through ecommbx.online must obtain the complete bank statement in official form for both flows — the one to the original platform and the one to the self-styled recovery company — with ordering party, beneficiary, IBAN, BIC, country and payment reference; the native export of all conversations; the emails in complete original format; the exact addresses of all the domains used, with dates; the names and contact details of the people spoken to; and a copy of every letter, invoice or document received.

Similar cases already handled by the firm

Anyone who crossed paths with ecommbx.online will find useful our analysis of eu-ecommbx.com, the first domain of the same affair, and of the clones of authorised institutions manoab.com and mirabaudasset-management.com. On fake fund recovery see dam-w24platform.com; on unlocking fees, eliteclouds.com.

If you received a letter from ecommbx.online: what to do now

This is the picture. ecommbx.online is a scam: a domain registered on 27 February 2026 with a one-year term, with no mail, today suspended by its registrar, built by changing the extension of the name of an authorised payment institution that has nothing to do with it and is itself an injured party.

The letter accusing you of money laundering and demanding payment is not a legal document: it is the closing act of the fraud, and in legal terms it is a threat that may amount to extortion.

Do not pay it. Keep it: it is the best evidence you have.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.