The firm has already handled this case: after three years of payments, four separate payments to "unlock" the capital, the last demanded by a fake United Kingdom revenue agency. The domain checks and why time is now the main problem.
Preliminary note: we are a law firm and we deal exclusively with online fraud and the unauthorised provision of financial services. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.
Three years of payments. Three hundred and eighty-two thousand euros, part of it borrowed. And then, at the end, four separate payments made in order to "unlock" the capital, each demanded by a different party, none of which produced a single euro in return.
The last pretext, that of hmrevenue-agency.com, bore the name of the British tax authority.
hmrevenue-agency.com is a scam, the firm has already handled this case, and this article explains how to recognise it, why unlocking payments never end and — above all — why after three years time has become the main problem.
Why hmrevenue-agency.com is a scam: the checks
Let us start with the name, because it is already enough.
The United Kingdom's tax authority is called HM Revenue & Customs and communicates exclusively through addresses ending in .gov.uk. That suffix cannot be bought: it is reserved, allocated under supervision and unavailable to private parties.
hmrevenue-agency.com, by contrast, is a .com domain: the most widespread commercial extension in the world, purchasable by anyone for a few euros. The word "hmrevenue" is glued inside the name, it is not the suffix. The practical rule, which holds forever, is a single one: what counts is the part immediately before the final extension, and the final extension does not lie.
The registry checks confirm the picture. The hmrevenue-agency.com domain was registered on 17 April 2026, expiring on 17 April 2027: one year, the minimum term, the term of someone who does not expect to still be there the following year. The registrar is a large commercial operator, and the name servers are that same provider's default parking servers: a neutral fact in itself, which proves nothing about who is behind it.
One fact, however, is anything but neutral. The domain has active mail records, resting on the mailbox service of an ordinary commercial hosting provider. That means the "tax authority" communications were sent from a mailbox bought together with the domain: not from any government infrastructure. It is a valuable detail, because that infrastructure is written in black and white in the technical headers of the messages received, and it can be verified.
Finally: hmrevenue-agency.com has no VAT number, no company name, no corporate reference whatsoever. There is no company to name. There is an annual domain with a mailbox.
Why a "tax authority" turns up at the end of the fraud
The hmrevenue-agency.com mechanism is worth explaining, because it recurs with few variations.
In the initial phase the victim is persuaded to invest. When the capital is sitting on the platform and the person asks to withdraw, the script changes: they are no longer told "invest", they are told "pay in order to receive". And to make the demand credible, a party is needed with the authority to ask for money.
Hence the fake tax authorities, the fake supervisory authorities, the fake government departments. In the hmrevenue-agency.com case the role was given to a fake British revenue agency.
We have already dismantled the same script, with different technical infrastructure but an identical design, writing about hmtreasurygovuk.com and ecommbx.online. Different domains, different registrars, hands not necessarily connected: the same playbook in circulation.
The principle that demolishes it is one and admits of no exception: no public authority, Italian or foreign, asks a private individual for money in order to unlock, release or transfer sums. An authority that establishes an offence does not negotiate and does not send invoices. If there is an amount to pay, the communication is false — and the threat accompanying it, being an unjust harm held out in order to obtain a payment, is the structure of extortion under Article 629 of the Italian Criminal Code.
The four unlocking payments
In the hmrevenue-agency.com case the injured party paid four times, to four different parties, always for the same reason: to free their own money.
This is the fact to fix in the whole hmrevenue-agency.com affair, because it is the avoidable part. The first unlocking payment never unlocked anything, and neither will the second, the third or the fourth. There is no threshold beyond which the mechanism reverses and the money comes back. There is no final payment.
There is more, and it explains why the demands arrive one after another: anyone who has already paid once to unlock goes onto a list, and that list circulates. The victims of fake recoveries are resold to other groups offering a new fake recovery. The second scam is built precisely on the names from the first.
The operating rule is brutal but it saves money: from the moment you are asked to pay in order to receive, stop paying anyone, including anyone presenting themselves as an authority, a private investigator, a recovery company or a lawyer. We explained how to recognise the fake professional when writing about veneziace.com.
Remote control and the documents handed over
In the hmrevenue-agency.com sequence the injured party was guided into installing two different remote-assistance programs on their computer, and over time handed over an identity document, tax code, IBAN, residence utility bills and a facial verification.
These are two distinct hmrevenue-agency.com problems, and both must be dealt with at once.
The first is the computer. Whoever obtains remote control sees the screen, opens the folders, reads the mail if the mailbox is open in the browser, sees the saved credentials. So the programs must be uninstalled, any permanent access revoked, the passwords changed from another device, two-step verification enabled on the mailbox and on online banking, and the mailbox checked for automatic forwarding rules to unknown addresses.
The second is the documents. Whoever holds an identity document and a facial verification has, in practical terms, what is needed to open accounts in someone else's name. The answer is not to hope it does not happen: it is an express, dated disavowal, listing every document handed over with dates and channels and declaring that no account was opened or authorised with them. The same communication must be sent in writing to one's own bank. We have written about this in relation to m.hashvalueks.com.
The real problem: three years have passed
Here an uncomfortable thing about hmrevenue-agency.com must be said, because keeping quiet about it would help no one.
The hmrevenue-agency.com facts begin in 2023 and run to 2026, and no criminal complaint has been filed. In a case like this, time works on two fronts and on both of them it works against you.
The first front is limitation. Aggravated fraud becomes time-barred after six years, which become seven years and six months where there are interrupting acts. That means that for the oldest conduct the window is closing, and every month of waiting takes away another.
The second front is evidence. Banks and service providers keep transaction data for ten years under anti-money-laundering rules, but technical data on domains, logins and pass-through accounts have a far shorter life, and an annual domain registered in 2026 can vanish without notice. Any reconstruction made today is richer than the one that can be made in six months' time.
That is not a reason to give up: it is the reason not to wait any longer.
The legal framework
The hmrevenue-agency.com facts straddle the 2024 reform, and that has a precise practical consequence.
For conduct after Law 90/2024 came into force, Article 640(2-ter) of the Italian Criminal Code applies, aggravating fraud committed remotely by means of computer tools capable of obstructing identification of the perpetrator. For earlier conduct that aggravating circumstance does not apply, and the circumstances already in force must be pleaded: diminished capacity to defend oneself (Article 61(5)) and particularly serious financial loss (Article 61(7)). The distinction must be drawn in the complaint, and drawn properly: pleading an aggravating circumstance that does not apply to the period weakens the whole case.
The payments repeated over time on hmrevenue-agency.com amount to a continuing offence (Article 81(2)). The phase of unlocking demands accompanied by threatened consequences is relevant as extortion (Article 629), completed or attempted. Using the name of a public authority amounts to impersonation (Article 494). Offering investment services without authorisation falls under Article 166 of the Italian Consolidated Law on Finance, prosecuted ex officio. The subsequent movement of the sums is relevant as money laundering (Article 648-bis).
Finally, the computer-related aspect linked to remote access must be assessed, on which we refer to what we have written about webtrader.rdpsystem.pro.
The aggravating circumstances of the second paragraph of Article 640 and the extortion make the matter prosecutable ex officio.
What to secure immediately
Anyone who has paid money to hmrevenue-agency.com, or received communications from a similar address, should obtain: the communications in complete original format, with the technical headers, obtained from the "show original" function of your mail program, which is the only way to document the infrastructure the message really came from; the complete bank advices for all transfers, with destination IBAN, bank and reference; the transaction hashes for cryptocurrency payments and the wallet addresses; the native export of the conversations; the name and dates of use of the remote-control programs; the list of personal documents handed over; and the complete banking documentation in official form, invoking Article 119(4) of the Italian Consolidated Banking Act, which gives the right to a copy of the documentation of transactions over the last ten years.
The complaint must contain the application for preventive seizure (Article 321 of the Code of Criminal Procedure), the request for information on registration under Article 335 and the request for notice in the event of a request to shelve the case under Article 408(2).
Similar cases already handled by the firm
Anyone who has come across hmrevenue-agency.com will also find useful our analysis of sepa.finance, where an identity document sent by the self-styled operator turns out to be forged, that of eu-ecommbx.com on fake fund recovery, and that of answer-blockchain.com, devoted precisely to what remains of a 2023 case.
If you have paid to "unlock": what to do now
The picture is this. hmrevenue-agency.com is a scam: a .com domain registered on 17 April 2026 for a single year, with a commercial mailbox and no company behind it, passing itself off as the United Kingdom's revenue agency.
The things to do after hmrevenue-agency.com are three, in this order: stop paying anyone who promises to unlock the capital; secure the computer, the mailbox and the documents, with a written disavowal; file a complete criminal complaint, without waiting any longer, because after three years every month counts.
The firm has already handled this case. You can submit your situation for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
