Hanzmade is a scam: the fake «Amazon Handmade» job that makes you pay to work

Foreword: we are a law firm that deals exclusively with online scams. We have already handled the case of a person who fell into the Hanzmade trap and we can help anyone who has suffered the same scam: if you want assistance, fill in the request form at the bottom of this article.

Hanzmade is a scam: the application reachable at hanzmade.vip and hanzmade.cc is not a «handicraft» work service linked to Amazon Handmade, but the tool an organised group uses to display a non-existent balance and, in order to «unlock» it, to collect a series of bank transfers to Italian current accounts. We are not writing this on hearsay. We examined the criminal complaint, the WhatsApp and Telegram conversation history, the transfer receipts and a technical report on the domain and the money flows, all kept in the case file.

The conclusion is clear-cut: Hanzmade is a scam because in a real job it is the employer who pays the worker, never the other way round. An «assignment» that requires you to advance money to a third party is not work: it is the pattern of fake online «tasks», which in our experience ranks among the fastest and most aggressive scams in circulation.

How Hanzmade works: from the work-from-home ad to the balance you can never withdraw

The Hanzmade scheme, as documented, runs as follows. The person answers an ad for a job to be done at home: assembling necklaces, pens, clips or hair ties on behalf of a platform that presents itself as linked to «Amazon Handmade». A WhatsApp Business account, behind a female pseudonym, introduces itself as customer service and offers piecework. After a few messages the conversation is moved to Telegram, where a succession of interlocutors with different names takes over, each with a part to play: the instructor, the «tutor», the «tax adviser», the «clerk» who handles refunds.

The person is then added to a Telegram group of hundreds of participants, administered by an account called «Group Help». In the case we examined, the group had 639 members. Screenshots of credits, withdrawals and transfers by other «workers» appear in the group all the time: this is the social-proof technique, which makes people believe that the system works and that everyone else is cashing in. Those in the group, in reality, do not know who the other participants are, and nothing they see can be verified.

On the Hanzmade web application, which is also opened inside the Telegram chats, a growing balance appears. In the case examined the displayed balance reached 39,232 euro. It is a number in a database controlled by the operator: it is not money and it is not a credit.

Domain, holder and the absence of any authorisation

On the Hanzmade domain, according to the RDAP registry queried on 10 November 2026, hanzmade.vip and hanzmade.cc were both registered on 12 August 2026, expiring on 12 August 2027, through the same registrar, Dynadot. The domain hanzmade.cc carries the «client hold» status, i.e. it is suspended at registrar level, while hanzmade.vip is active with Cloudflare name servers. Using Cloudflare and a registrar that allows the holder to be hidden is not unlawful in itself: it becomes an indicator when added to everything else.

What else there is: the Hanzmade domain was registered about a month before the first contact with the victim, an age incompatible with any «established platform»; no mail records or configurations enabling communication through an institutional address are found for the domain, so every contact went exclusively through messaging apps; and there is no company name, VAT number, registered office or reliable contact. Article 7 of Italian Legislative Decree 70/2003 requires information society service providers to make name, address and VAT number, if any, accessible. A company that offers work to hundreds of people and cannot say what it is called does not exist: Hanzmade is a scam for this reason too.

As for Amazon, the name «Amazon Handmade» is real, but the scam uses it as a credibility lure. No legitimate Amazon programme asks those who work to make advance bank transfers to accounts held by individuals or by unrelated companies. Anyone who receives an offer of this kind should assume that it does not come from Amazon, whatever logo is used.

The profit promises and the «test fund»: how trust is built

The mechanism behind Hanzmade is a classic of fake online jobs: at the start the person pays small sums and gets them back at once, with a small margin. In the case examined, a first payment of 35 euro and one of 10 euro were returned after a few minutes, with 10 euro extra. This is the «test fund»: it serves to turn caution into trust.

The second phase follows immediately. An «error» in carrying out the assignment, blamed on the victim, blocks the system, and to fix it further payments must be made, each higher than the last. The justification is always the same: the assignment was «assigned randomly by the seller's system» and, once started, cannot be interrupted without losing what has already been paid. It is the argument that traps those who have already paid: stopping means losing everything.

It should be remembered that no return on a supposed piecework job can be guaranteed in the form of reimbursement of capital plus pay. A «pay» in exchange for an advance, with guaranteed repayment, is not the remuneration of work: it is the description of a loan that nobody has granted.

Nine transfers in six days: the Hanzmade script for emptying the account

The technical report we hold documents, in the Hanzmade case, nine payments made over six days, for a loss of more than 21,900 euro. The amounts grow with a progression that those who deal with these cases recognise at once, from a few dozen euro to more than 5,000, with these characteristic features:

• every payment goes to a different account: nine payments, nine beneficiary accounts, at four institutions, and no account was used more than once;
• the beneficiaries are mostly individuals, but they also include a simplified limited liability company and a minimarket, whose registered activities (wholesale of agricultural raw materials, IT consulting) have nothing to do with any employment relationship;
• four of the nine payments, more than half of the amount, were received by accounts at a single payment institution, with adjacent account numbers: a sign of accounts opened in series;
• the payment reference suggested to the victim is «pay invoice», wording with no connection to the work described;
• the IBANs are given in the chat, one at a time, at the moment of payment, and the transfers are instant, so they cannot be revoked with ordinary tools;
• the victim obtains the money from relatives and acquaintances, under pressure from deadlines and the threat of losing what has already been paid.

Deadlines and pressure serve a single purpose: to stop the person from pausing to think. When every payment is needed to «unlock» the previous one, the capital already lost becomes the reason to pay more.

Fake withdrawals and «taxes» to pay: why no rule requires you to pay in order to work

In the Hanzmade case the victim was shown a «withdrawal procedure» referring to her own user, with a first withdrawal of 100 euro and a second of more than 11,000 euro, as proof that the funds were available and that it would be enough to complete further assignments. The sole purpose of that screen was to induce further payments.

The Hanzmade script repeats with known variations: the «unlocking fee», the «tax» to be paid to obtain the refund, the «security deposit» to complete the order. Let us be clear: there is no rule, Italian or European, that requires a worker to advance money to a private individual in order to receive their pay, nor any tax that is settled by a transfer to an account indicated in a chat. Tax obligations on employment income are met in the tax return and, for employees, through withholding made by the employer.

A case similar to Hanzmade, with the same type of lure, is the one we analysed in the article on ArtisanWorks.vip (in Italian). The practical rule for recognising that Hanzmade is a scam, and any similar scheme, is just one: whoever has to pay to receive money that is already theirs, or to start a job, is being defrauded.

Aggravated fraud (Art. 640 Criminal Code), complaint and money laundering: the criminal framework of Hanzmade

The conduct described constitutes the offence of fraud under Article 640 of the Italian Criminal Code: the artifices and deceptions consist of the fake job offer, the use of the Amazon brand as a guarantee, the balance shown on screen, the invented rules on the impossibility of interrupting the assignment and the staging of groups of workers; the damage is the property paid by the injured party.

When the act is committed remotely through computer or telematic means capable of hindering the identification of the perpetrator, the aggravating circumstance of Article 640(2) no. 2-ter applies, introduced by Law 90/2024 and in force since 17 July 2024. With judgment no. 27907/2026 (hearing of 14 July 2026), the Second Criminal Section of the Court of Cassation clarified that this aggravating circumstance concerns the manner of execution of the conduct, and distinguished it from the diminished defence of Article 61 no. 5, linked instead to the concrete vulnerability of the victim. In the same ruling the Court stated that fraud so aggravated is now prosecutable only on complaint by the injured party, by virtue of the exception in the fourth paragraph of Article 640 as amended by Decree-Law 48/2025, converted by Law 80/2025. Judgment no. 18913/2026 (hearing of 26 March 2026) confirmed it: proceedings are on complaint if no. 2-ter applies, ex officio if Article 61 no. 5 applies.

The practical point, for those defrauded by Hanzmade, is that without a complaint, in many of these cases, the proceedings cannot continue. The complaint is not a formality: it is the act that sets the public prosecutor's office in motion.

With judgment no. 5191/2026 (hearing of 13 January 2026), the Court of Cassation also reaffirmed that fraud is «of prolonged consummation» even when the deceptive activity continues in order to hinder the discovery of the conduct and to create in the victims the reliance needed to obtain further profits. The decided case concerned fictitious interest paid by a false intermediary, not a fake piecework job, but the logic is the same: each «payment to unlock» is an act of the same fraudulent design, not an independent event.

The most delicate aspect is that of the beneficiary accounts. When the transfers flow into Italian accounts held by real persons, whoever opened them or allowed their use may be liable, depending on the findings, for complicity in the fraud or for money laundering and self-laundering (Articles 648-bis and 648-ter.1 of the Criminal Code). What each holder knew is a matter for the judicial authority to establish: we do not presume it. It must however be said that the existence of Italian accounts makes the case easier to pursue than people think, because the holders are identifiable. The «interlocutors» who use pseudonyms on WhatsApp and Telegram may also answer for identity substitution (Article 494 of the Criminal Code).

Complaint, seizure and tracing of flows: the timing that decides recovery

The time limit for filing a complaint is three months from the day on which the injured party learned of the fact (Article 124 of the Criminal Code). It does not pay to play with dates, because every day that passes in the hope of a refund reduces the chances of intercepting the funds.

The Hanzmade scam offers an investigative advantage that is often missing in cryptocurrency scams: the transfers are made to Italian accounts, with IBANs, amounts, times and payment references documented by the receipts. A criminal complaint to the public prosecutor's office, complete with these elements, allows the judicial authority to consider a preventive seizure (Article 321 of the Code of Criminal Procedure) and to obtain from the payment institutions the account-opening data and the subsequent movements. In civil proceedings, a conservatory seizure (Article 316 of the Code of Criminal Procedure, when joining as civil party) and, against those who received the sums without entitlement, recovery of undue payment (Article 2033 of the Civil Code) remain available, as we showed in the solved case on recovery of undue payment after an online scam (in Italian). For the confiscation aspect see also our in-depth piece on confiscation of equivalent value and online scams (in Italian).

On the administrative side, blocking websites is a containment remedy, not a recovery one: it does not give back a single euro and does not prevent the same scheme from reappearing at another address, as the pair of .vip and .cc domains registered on the same day already shows.

What to do if you have already worked for Hanzmade

The first step, for those who worked with Hanzmade, is to stop paying, whatever deadline is imposed and whatever «loss» is put to you: the impossibility of interrupting the assignment is pressure, not an obligation. The second is to preserve every element:

• the WhatsApp and Telegram chats, exported in full and with dates;
• the receipts of every transfer, with IBAN, account holder, reference and time;
• screenshots of the balance, of the withdrawals and of the groups;
• the telephone numbers and usernames of the interlocutors;
• the statements of the accounts from which the payments were made.

The third, after Hanzmade, is to report the matter to the bank or payment institution from which the transfers were made, within hours and not days, asking for the checks that are possible: the outcome depends on the instrument and the time elapsed and cannot be guaranteed. A criminal complaint follows, drafted so as to enable the prosecutor's office to act on the accounts.

You should also distrust anyone who offers to «recover» the funds for an advance payment. After the victim stops paying, it is common for the same group to reappear under another name: this is the second scam, analysed in our review of fake fund-recovery services (in Italian). On why to entrust the complaint to a professional, we wrote this guide on how to entrust the complaint to a lawyer expert in online scams (in Italian).

How to check an online job offer before accepting

Before giving your time, or your money, to someone offering you a work-from-home job, the check takes a few minutes:

• look up the employer's company name, registered office and VAT number and compare them with the business register;
• check that contact comes from an institutional address and not only from a WhatsApp or Telegram account;
• check the age of the domain: an «established» site registered a few weeks ago is a serious warning sign;
• distrust anyone who asks you to advance sums, to pay «invoices» or to buy products to «complete orders»;
• never pay money into private individuals' accounts: if a real company needs to collect, it does so with an invoice, a VAT number and an account in its own name.

Hanzmade is a scam: the closing warning

A single missing element could be an oversight. In the case of Hanzmade the company, the VAT number, the registered office and the employer are all missing; the domain is a few months old and the holder is not visible; the Hanzmade balance grows but cannot be withdrawn; every payment is presented as the last and goes to a different account. The picture is such that, absent proof to the contrary, prudence requires treating Hanzmade as a scam. The operator of Hanzmade is free to reply with public documents, stating company, authorisations and registered office.

If you have worked for Hanzmade, made transfers or been asked to pay to complete an assignment, contact us by filling in the form at the bottom of this page: we are a law firm that handles only online scam cases, we have already followed this case and we will assess your position, including out of court, indicating the initiatives that are concretely feasible, without promising results that no serious professional can guarantee. If you have suffered the same scam, we can help you.