finomarkets.org is a scam: the broker blocked by Consob that changes domain the next day

Foreword: we are a law firm that deals exclusively with online scams. We have examined the documentation of a person who fell into the trap of finomarkets.org and we can help anyone who has suffered the same scam: if you want assistance, fill in the request form at the bottom of this article.

finomarkets.org is a scam that can be recognised from a sequence of dates verifiable in public sources: on 7 October 2021 Consob (the Italian securities regulator) announced the blocking of the website finomarkets.com; on 8 October 2021 the self-styled consultant wrote to the client that "following a system update the platform access link has changed" and pointed to finomarkets.org; on 11 October another message offered, as an "alternative link", finomarkets.info. There was no system update: there was a supervisory measure and the move of the same front-end to another domain name, communicated to the client in the vocabulary of technical support. We examined the WhatsApp chat between the person and the "consultant" from 20 July 2021 to March 2022, the receipt of a foreign bank transfer of 2,600 euros executed on 20 January 2022, and the email received in October 2023 from a free mailbox presenting itself as the company's "administration".

The conclusion is clear: finomarkets.org is a scam because it promises a "guaranteed doubling" and an "insured" capital, promises that no authorised intermediary can make; because withdrawals were made conditional on further payments, to be made with an imposed payment reference ("Buy BTC") to a foreign company with no relationship to any financial intermediary; because, after the blocking of the original site, the same structure reappeared under another domain; and because, two years later, the same organisation proposed a "settlement and write-off" that would have meant waiving every claim. For criminal law practitioners the finomarkets.org case has a further point of interest: the person never filed a complaint, the sums were paid more than four years ago, and the review of the documentary file requires facing, without forced optimism, the complaint deadline, the statute of limitations and the routes that remain open.

How finomarkets.org works: the WhatsApp "consultant", the locked bonus and the guaranteed doubling

Contact with finomarkets.org starts on 20 July 2021 from a WhatsApp Business account. The introduction message of finomarkets.org is a template: the "financial consultant of Finomarkets" gives his working hours ("Monday to Thursday from 9.00 to 17.00, Friday from 9.00 to 13.00"), warns that for clients who received a bonus "the balance will be locked, deposit, bonus and profits, for 90 trading working days" and advises opening a cryptocurrency wallet on one of the two exchanges he indicates, because "our company guarantees the original exchange rate or better, no loss in the transaction". These are three elements that are already enough to rule out that finomarkets.org is a real investment service: the lock on deposit and profits for ninety days, imposed with a bonus that the client did not knowingly request; the exchange-rate guarantee, which belongs to no operator; the choice of a channel, WhatsApp, where messages can be deleted and identities cannot be verified.

On the same day the person writes to finomarkets.org that they have made "a deposit by bank transfer" without receiving any other information, except the announcement of a call back. The order is revealing: the money is requested first, the documentation afterwards. The details of the first payment do not appear in the documents we examined; what does appear precisely is the January 2022 transfer that we describe below.

On 2 August 2021 the first promotional message arrives from finomarkets.org, written in the capital letters of a commercial offer: "REAL BARGAIN, UNREPEATABLE, EXPIRES IN 6 DAYS". With a payment of between 1,500 and 15,000 euros "a bonus of the same amount will be obtained", which "remains a gift after the 40th day of trading" and can be withdrawn "in addition to the deposit and the profits (about 65%)": so, with 6,000 euros, "at the end at least 18,000 euros will be withdrawn". And again: "as usual, the capital paid in is insured". On 22 September 2021 the proposal is "OFFER FOR EVERYONE": by investing 3,000 euros (or multiples, up to 30,000) in the next 72 hours "after 40 working days the guaranteed doubling will be obtained". The person asks "but are you sure?" and the consultant answers "yes of course"; when the person declines because they do not want to be left without liquidity for two months, the consultant proposes reducing the amount to 1,500 euros, explaining that another client cannot manage it and that a package can be split in two. It is the technique of fictitious scarcity: a deadline of a few hours, a "package" that can be divided, a negotiation on the price that has nothing to do with a market.

finomarkets.org is a scam that changes domain: the Consob blocking of 7 October 2021 and the "new link" of 8 October

The most important passage of the whole finomarkets.org affair is a comparison of dates. Consob, using the powers granted by art. 36, paragraph 2-terdecies, of Decree-Law 179/2012 (inserted by Decree-Law 34/2019, converted by Law 58/2019), announced on 7 October 2021 the blocking of six websites, among them finomarkets.com, as reported by the trade press: for five of the six sites the hypothesis was abusive financial intermediation, for one the offer of financial products without a prospectus, and the press reconstruction does not specify which of the two applied to that name. The following day, 8 October 2021, at 10.29, the consultant writes to clients: "Following a system update the platform access link has changed. The new link: www.finomarkets.org". On 10 October the person replies that they "can still get in with the old address"; on 11 October a further message arrives: "for the duration of the update you can access the platform from an alternative link: www.finomarkets.info", with the instruction to delete browsing data, cookies and cache if the site does not open.

One does not need to be a network infrastructure expert to assess the explanation offered by finomarkets.org. The blocking ordered by Consob concerns a domain name and consists, in practice, of an order to connectivity providers to prevent access to it from Italy: whoever runs finomarkets.org need only move the same interface to another name and tell the clients, presenting the move as a technical event. The message of 11 October, with the invitation to "clear cache and cookies", has a double effect: it attributes to the person the responsibility for the inaccessibility and reassures them that the system works. It is a technique for neutralising the supervisory measure, and its very existence points to knowledge of the measure on the part of whoever uses it: a lawful operator, the addressee of a blocking order, challenges the act or regularises its position; it does not change the domain name the next day.

On the evidentiary level, the sequence of finomarkets.org is valuable because it makes it possible to link the address finomarkets.org to a party already hit by a supervisory measure: the link rests on the temporal correspondence, on the name, on the identity of the contact person who communicates the "new link" to the client and on the fact that the client accesses the same platform with the same credentials. In the file of a possible investigation it is an element to be crystallised immediately, with the transcription of the messages and the indication of date and time.

ID documents and the "anti-money laundering law": the use of KYC verification in the finomarkets.org model

On 20 July 2021 the consultant sends the person a request in the form of a module: identity document front and back, with "all 4 corners visible" and "not a copy of a copy or a scan"; proof of residence (a utility bill for electricity, water or gas issued less than three months ago, a bank statement or a residence certificate); a photograph of the front and back of the credit card, if used for the deposit, with the security code to be covered with "a small piece of paper" and an absolute ban on any computer editing. The request closes with a warning: "sending the documentation is as important as the deposit itself, without documents you are blocked and it will not be possible to reactivate the account (anti-money laundering law)".

The argument is formally correct only for authorised intermediaries, on which Legislative Decree 231/2007 imposes customer due diligence; here it is used instead as a psychological lever and as an acquisition tool: the reference to the anti-money laundering law serves to make it seem mandatory, in the client's eyes, to send a complete set of personal documents to a company whose authorisation is unknown. With those documents the recipient can open accounts and cards in the victim's name, build false identities and, above all, make the subsequent request credible. On 20 and 21 July the person sends photographs of the document, the scan of several documents and a bill: from that moment these data are in the hands of whoever runs finomarkets.org and of unknown third parties, and the risk of unlawful use of the identity is a separate matter that must be flagged in every complaint.

The account that does not move and the conditional withdrawal: the 2,600 euros of January 2022

On 14 December 2021 the person notes that the balance on finomarkets.org has been frozen for three days. The consultant replies with a voice message and then with a step-by-step guide: open the browser menu, go to the history, "delete browsing data", select cache and cookies. The person follows the instructions and, a quarter of an hour later, writes "great, found it", without the message showing whether the balance restarted. It is a minor and instructive episode: the solution to a balance frozen for three days is an operation on the user's browser, which is consistent with a number written on a page and not with the value of an account.

On 17 January 2022 the person writes that the balance "keeps growing" and asks whether there is a withdrawal limit, whether they can withdraw everything, whether they can leave the sums "to mature without a deadline". The consultant replies with two voice messages that have not been transcribed; the person, immediately afterwards, writes: "Absolutely not, we never spoke, nobody ever warned me about fees to pay". The tenor of the reply suggests that the voice messages spoke of fees to be paid before the withdrawal; the audio files should be obtained and transcribed, because they are in all likelihood the direct proof of the request for money. The next day, 18 January, the person writes: "I put my trust in you, yesterday's chat gave me great pleasure and you won my trust (...) you are a gentleman of 60, like my dad and I want to be in good faith". The sentence documents what the previous day's conversation produced: a relationship of trust built through conversation, the father figure, kindness, the language of friendship. It is the phase in which, in scams of this kind, consent to payment is obtained.

At 15.40 on 18 January the consultant sends the instructions: beneficiary, a company with its seat abroad; IBAN of an account with United Kingdom coordinates; a "mandatory payment reference" made up of the client's first and last name and the wording "Buy Btc", with the warning "please only first and last name and add Buy Btc"; amount 2,600 euros; to be paid, the consultant answers the person's question, within six hours of the details ("yes, more or less").

Foreign "Buy BTC" transfer to a company under Estonian law: what the payment reference imposed by finomarkets.org says

The payment reference imposed by finomarkets.org is the first point to analyse. The payment is presented as the purchase of bitcoin, but the person received no bitcoin and has no wallet to receive it; whoever collects it is a company whose corporate form (OÜ) is typical of Estonian law, holder of an account with a Lithuanian IBAN, and not a crypto-asset exchange. A payment reference dictated by the beneficiary, identical for every client and referring to an operation that does not take place, has a precise function: it makes the payment compatible with banks' automatic checks and disguises its nature as a fee for the withdrawal.

The second circumstance in the finomarkets.org case concerns the behaviour of the intermediaries. On 19 January 2022 the first attempt at a transfer, made by the person at a post office, does not go through: the system signals an error code (CC1) that the person, searching online, cannot identify, finding only a similar one that refers to security and antitrust profiles. The consultant suggests checking the data and sends, at 10.06, new details, this time of a Lithuanian account; on the afternoon of the 19th, a new attempt, a new refusal. On 20 January the person writes that "they do not let the transfer go through for suspicious accounts" and that, to avoid the block, they make it at their own bank: "I did it from the bank avoiding the post office, let's hope". The receipt, dated 20 January 2022, certifies a single transfer of 2,600.00 euros, value date 21 January, with the reference "buy btc", made in favour of the Lithuanian account.

The fact has legal significance. The first intermediary had rejected the order, as the person reports, for "suspicious accounts"; the person circumvented the obstacle by turning to another channel. Verifying the intermediaries' conduct against their obligations of due diligence and reporting is a subject to be handled with caution and on the basis of documents, not suggestions: one must know what the first intermediary reported to the client, in what form and with what warnings. A transfer duly authorised by the payer does not, moreover, fall within the refund rules for unauthorised transactions of Legislative Decree 11/2010: the route to recovery goes through criminal and civil action, not through a simple complaint to the bank. On recovering sums after an online scam we refer to our analysis of recovery of undue payments.

After the payment the person sends, on 20 January, further documents (an invoice, some photographs), which the consultant declares he cannot upload. The consultant had also asked for the IBAN details "handwritten": on 22 January the person asks when to send them and on 25 January transmits them. Then silence: on 27 January "the account keeps increasing and I have seen no change, and not even the money in the account"; on 1 February the consultant, for the first time in English, writes "I'll call you right back"; on 10 February "Next monday, 21st"; on 21 February "Tomorrow". Then no reply: on 3 March the person, addressing the interlocutor by a first name different from the one on his profile, asks whether he "no longer exists", and on 9 March writes once more only that name, without reply. That the consultant wrote in English and that the person calls him by a name different from the one he introduced himself with is further confirmation of the fictitious identity of whoever operated behind the account.

Checks on finomarkets.org: domain, registry and authorisations

On 12 November 2026 we queried the domain name system. The name finomarkets.org is not delegated: the public resolver returns NXDOMAIN and the query of the .org domain registry returns a name-not-found result. For finomarkets.info too the resolver returns NXDOMAIN. In practical terms, the two addresses of finomarkets.org communicated to clients in October 2021 no longer exist, and with them the pages on which the person saw their balance have disappeared. The name finomarkets.com, on the other hand, appears registered anew on 3 June 2026 according to registry data, with expiry on 3 June 2027: we are not able to attribute it to the perpetrators and must not assume that it is theirs; anyone who finds it online today should not take it for the historic site, nor trust a possible reactivation of the brand.

As to the authorisations of finomarkets.org, the documents never indicate a registration number, a company name with seat and VAT number, a physical address of the intermediary. The consultant speaks of a nameless "company" and, in the 2023 email, of an "administration" and of operations "via Whatsapp or landline from Belgium". There is no trace in the records of any authorisation from Consob or from another European authority; in March 2023 a Canadian supervisory authority, the Manitoba Securities Commission, published a notice on "Fino Markets" and on the name finomarkets.com, stating that the company is not and has never been registered in the province to deal in securities. The positive check (a licence that can be consulted on the supervisory authority's register, with name, seat and number) is the only check that counts: the silence of a search engine on reports, by itself, proves nothing, and a block of the site by Consob is not an acquittal for the domain names that appear afterwards.

Whoever provides investment services like finomarkets.org without authorisation is liable for the abusive activity provided for by art. 166 of the Consolidated Law on Finance (TUF), a crime prosecutable ex officio; whoever promises guaranteed returns and insured capital, in the absence of a prospectus and of a supervised intermediary, adopts language incompatible with the transparency rules and with the very function of an offer of financial products. Whoever then moves the sums to a foreign account of a company with no relationship to the supposed intermediary commits, in the ordinary course, conduct attributable to complicity in fraud or to money laundering and receiving stolen goods (arts. 110, 640, 648, 648-bis of the Criminal Code), to be established with regard to the account holders.

2023 and the "settlement and write-off": the second wave of finomarkets.org and the receipt that wipes out the claim

On 10 October 2023, at 11.29, the person receives, among several recipients in blind copy, an email in the name of finomarkets.org from a free mailbox whose name recalls the company. The text, signed by a self-styled "administration" officer, states that "the company has received the obligation to reach an agreement with at least 50% + 1 of clients with outstanding accounts, on pain of losing the domain and Broker licence" and that, "if you wish, there are now the conditions to access credit". It follows with a capitalised clarification, "NO PAYMENT OF TAXES IS NEEDED", and the proposal: "if we manage to find an agreement, you will be able to withdraw your money, sending us afterwards a receipt in settlement and write-off". The message asks for the telephone number and the name of the person who had followed the client, with a new "operation from Monday to Thursday, from 8 to 15.45".

The deception of the second wave of finomarkets.org is twofold. The premise is invented: no rule requires an intermediary to reach an agreement with half plus one of its clients on pain of losing its licence; and an intermediary that really had a licence would not "lose" it for this. More insidious is the final request: the receipt "in settlement and write-off" is, in civil-law language, a discharge with waiver of any further claim. If the person signed it, after receiving a partial sum (or, as often happens, after paying a fee to receive it), they would produce a document that the author could try to use to argue that every relationship was closed by settlement. In a subsequent civil action or in the assessment of damage, that signature would carry considerable weight, even if the waiver was obtained by deceit. For this reason, the rule for anyone who receives emails of this kind is simple: do not reply, do not sign, do not provide telephone numbers, and hand the message to a lawyer.

The person replies after five minutes, writes that "the people who took turns were different" and gives their own mobile number. The interlocutor replies that they will be "called back as soon as possible with notice via WhatsApp". Nothing else appears in the file. The passage is instructive on one point: the second wave targets clients who have already lost money and their hope of recovering it, and uses, as we saw in the examination of a fake fund-recovery company, the language of agreement and negotiation.

Criminal classification of the facts of finomarkets.org: fraud, abusive financial activity and Italian jurisdiction

The conduct of finomarkets.org amounts to fraud (art. 640 of the Criminal Code). The artifices and deceptions can be reconstructed precisely: the status of "financial consultant" of an intermediary that does not appear to be authorised; the promise of a "guaranteed doubling" and of an "insured" capital; the "balance" that grows and stops depending on the browser cache; the withdrawal made conditional on a payment with a fictitious payment reference; the "new link" presented as a technical update after a supervisory measure; the changing identities of the interlocutors. The unjust profit is the sum collected in the foreign account, the damage is the money paid by the person; for the purposes of classification, the Court of Cassation has stated, in judgment no. 5191/2026 (hearing of 13 January 2026), that fraud is "of prolonged consummation" when the deceptive activity continues over time to consolidate reliance and obtain further profits: the payments to finomarkets.org from July 2021 to January 2022 are therefore to be read as a single affair and not as autonomous episodes.

Two clarifications of intertemporal law on the finomarkets.org case. The aggravating circumstance of no. 2-ter of the second paragraph of art. 640 of the Criminal Code, introduced by Law 90/2024 for acts committed remotely with computer or telematic means capable of hindering the identification of the perpetrator, does not apply to the facts of 2021-2022: the provision is subsequent and harsher, and art. 2 of the Criminal Code (like art. 25 of the Constitution) excludes its retroactivity. The same applies to the rules on prosecutability introduced by Decree-Law 48/2025: it is the regime in force at the time of the act that must be checked on the file.

As to jurisdiction over the facts of finomarkets.org, fraud is considered committed in Italy when the action or the event occurs, even in part, in the territory of the State (art. 6 of the Criminal Code): the person, in Italy, suffered the deception and the damage. Territorial competence, with a foreign credit account, is determined with the residual criteria of art. 9 of the Code of Criminal Procedure. Obtaining the data of the account holder from the Lithuanian institution and of the Estonian company, these being Member States, goes through the European Investigation Order (Legislative Decree 108/2017): it is the ordinary tool of the public prosecutor, which the injured party may urge with a brief but cannot activate alone.

No complaint after four years: complaint deadline, limitation period and ex officio report

From the documents we examined it appears that the person never filed a report or complaint. It is the most delicate point of the finomarkets.org case and we say so plainly. The complaint for non-aggravated fraud must be filed within three months of the day on which one learns of the fact constituting the offence (art. 124 of the Criminal Code): if the moment at which the person understood they had been deceived is placed in March 2022 (when the person asks the interlocutor whether he "no longer exists") or, at the latest, in October 2023, the deadline has in all likelihood long expired. It would be for a lawyer, on the whole file, to assess whether there are arguments for placing the "knowledge of the fact" later or whether hypotheses of prosecution ex officio arise.

The limitation period poses, for finomarkets.org, another constraint. For fraud the time needed for the offence to become time-barred is six years (art. 157 of the Criminal Code), extendable up to seven years and six months with interrupting acts (art. 161 of the Criminal Code): for the transfer of 20 January 2022, in the absence of interrupting acts, the term is completed in January 2028. There is a margin, but it shrinks every month.

In the finomarkets.org case a route remains open that does not depend on the complaint. Abusive financial activity (art. 166 TUF), receiving stolen goods and money laundering (arts. 648 and 648-bis of the Criminal Code) are crimes prosecutable ex officio: a detailed report to the Public Prosecutor's Office, to the Guardia di Finanza and to Consob, with the chronology of the messages, the dates of the blocking orders, the receipt of the transfer and the details of the foreign account, puts the judicial authority in a position to investigate the structure, independently of the individual position of the injured party. The report does not guarantee a result, but has a modest cost and a concrete effect: its filing creates a basis for any proceedings concerning the same account holders, and allows the public prosecutor to connect several injured parties. On seizure and confiscation, we refer to the in-depth analysis of confiscation by equivalent in online scams; on other platforms that replicate the same model see our articles on a fake crypto trading platform and on a broker with a denied chargeback.

Frequently asked questions about finomarkets.org: legitimacy, recovery and deadlines

Is finomarkets.org an authorised broker?

No authorisation, from Consob or from a European authority, appears from the records examined in favour of finomarkets.org or of the name finomarkets.com from which the service came. Consob announced in October 2021 the blocking of finomarkets.com and the change of domain communicated to clients the following day points to knowledge of the measure on the part of whoever ran finomarkets.org. An authorised intermediary is recognised by a name, a seat, a registration number verifiable on the authority's register, not by a WhatsApp account.

Can the money paid to finomarkets.org be recovered?

It depends on promptness and on the possibility of identifying the recipient of the transfer. With a foreign account of a foreign company, recovery goes through criminal proceedings, the seizure of sums still available and requests for cooperation to other Member States, not through a complaint to the payer's bank. The more time passes, the more the sums are dispersed: for this reason an assessment by a lawyer, in the finomarkets.org case, must be sought immediately and not after the next promise of a "settlement and write-off".

Can I report finomarkets.org even after years?

Yes, with a clarification: the complaint for non-aggravated fraud has a deadline of three months from knowledge of the fact (art. 124 of the Criminal Code), whereas crimes prosecutable ex officio, such as the abusive activity of art. 166 TUF, money laundering and receiving stolen goods, can be brought to the attention of the Public Prosecutor's Office with a report at any time, within the limitation periods. For the payments to finomarkets.org of January 2022 the ordinary limitation period for fraud, in the absence of interrupting acts, expires in January 2028.

What should I do if I receive a "settlement and write-off" email in the name of finomarkets.org?

Do not reply, do not sign anything, do not give telephone numbers and do not pay any sum to "access credit". Keep the message with its full headers, note the date and time and hand it to a lawyer: the proposal of a receipt in settlement and write-off, once signed, can be used against you in any recovery action.

What to do if you have lost money to a broker like finomarkets.org

If you have paid money to finomarkets.org, or to a platform that asked you for a payment to "unlock" a withdrawal, these are the steps we recommend, in order of urgency:

• do not pay any more money to anyone and do not sign any "settlement and write-off", waiver or discharge document, even if it is presented to you as the only way to recover the sums;
• keep everything: transfer receipts with the beneficiary's name and IBAN, payment references, screenshots of the balance, full chats, voice messages, emails with full headers, telephone numbers used;
• export the chats with the messaging application's function and save the audio files, which are often the proof of the request for money;
• check the date on which you understood the deception and turn immediately to a lawyer: the three-month deadline for the complaint runs from that moment (art. 124 of the Criminal Code), and every week counts;
• if a complaint is no longer possible, consider a report for the offences prosecutable ex officio (abusive financial activity, money laundering, receiving stolen goods) and a notice to Consob;
• if you sent an identity card, residence documents or photographs of the credit card, say so, notify the bank and consider checks on the use of your data;
• ask the bank that executed the transfer for a copy of the documentation of the operation and of any warnings or blocks, because they can serve as evidence;
• distrust anyone who, after the loss, offers to recover the funds by asking for an advance, a fee or the opening of an account.

How to recognise a fake broker like finomarkets.org before paying money

Some signals, in the finomarkets.org case, were visible before the first payment and recur in scams of the same kind:

• a "consultant", like the one at finomarkets.org, who contacts the client on WhatsApp with a business account, gives office hours and does not indicate a company name, a seat, a registration number in a professional list or supervisory register;
• the deposit requested first, the documentation afterwards, with the reference to the "anti-money laundering law" to obtain identity documents, proof of residence and photographs of the credit card;
• offers expiring "in 6 days" or "in the next 72 hours", a bonus equal to the payment, "guaranteed doubling", "insured capital": promises that no authorised operator can make;
• a balance that grows at every check and an account that freezes, with the invitation to empty the browser cache;
• a change of site address, as from finomarkets.com to finomarkets.org, communicated as a "system update", followed by an "alternative link";
• a withdrawal made conditional on a further payment, to be made to a foreign company with an imposed payment reference, the same for all clients ("Buy BTC");
• interlocutors of finomarkets.org who change name, answer in English, postpone the call back and then disappear, only to reappear years later with a proposal of "settlement and write-off".

finomarkets.org is a scam: the closing warning

The elements examined lead to a conclusion that, in the absence of proof to the contrary, we consider well founded: finomarkets.org is a scam in the criminal-law sense of the term. A site that appears the day after the Consob blocking of another domain name, with the same contact person and the same platform, and that presents the move as maintenance; that promises guaranteed doublings and insured capital; that makes the withdrawal conditional on a transfer with an imposed payment reference to a foreign company and that, after the payment, answers in English and disappears, is not a financial intermediary: it is a structure that uses the form of an investment service to collect money. What the file lacks, more than four years after the facts, is not proof of the deception, but a complaint that sets the judicial authority in motion; the way forward, if there is one, passes through an immediate assessment of the deadlines and a report on the offences prosecutable ex officio.

If you have lost money to finomarkets.org or to a broker that changed domain name after a blocking order, time is not on your side: the complaint and limitation deadlines are running, account data do not stay available forever and platforms change name. If you have suffered the same scam, we can help you.