Disclaimer: we are a law firm dealing exclusively with online fraud and unauthorised financial activity. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public-interest purposes. The technical data comes from checks on the public domain registries carried out at the date of publication. If what you read sounds familiar, you can submit your case through the form at the bottom of this page.
Two days after her last transfer to hub.hariolas.com, the injured party discovered that someone had got into her bank account and emptied it. The bank froze the relationship. The platform was hub.hariolas.com. For safety, she reset her phone — and with it lost every image of the conversations and of the platform.
hub.hariolas.com is a scam, and this case serves to explain two things almost nobody knows: that an unauthorised withdrawal from your account is legally a different matter from the fraud, governed by rules far more favourable to the victim; and that resetting your phone after a compromise is the most expensive mistake you can make. Our firm has already handled this case.
Why hub.hariolas.com is a scam: a nine-day-old domain
Let us start with the datum from hub.hariolas.com that should on its own have stopped everything.
In the address hub.hariolas.com the name that counts is not "hub", which is merely a subdomain written by whoever runs the domain: the actual domain is hariolas.com. And hariolas.com was registered on 5 November 2026, with a one-year term.
The injured party's last transfer is dated 6 November 2026. The day after registration.
It means that, in the middle of a relationship already weeks old, the victim ended up on hub.hariolas.com: that is, the organisation moved her to an address born the day before. It is the typical behaviour of those who change shop window as soon as the previous one starts being reported: the name is thrown away, the structure stays.
As at the date of this article hub.hariolas.com is still active, and the domain rests on a service that masks the origin server. It is nine days old.
Let us ask what a domain like hariolas.com means in practice, because it is the lesson for anyone reading: nobody would dream of handing their savings to a company incorporated yesterday, with no premises and no name. But almost nobody checks the age of the domain before making a transfer, and that check is free, takes thirty seconds and can be done on any public registry lookup service. A serious financial platform has a domain that is years old. A domain a few days or a few months old, on a one-year registration, is a temporary shop window.
There is, however, also good news, and it is why one must move now on the hub.hariolas.com case. While the domain is registered and active, the registrar and the DNS service hold the account name, the registration email, the payment method, the access IP addresses and the list of other domains held in the same account. These are obtainable only through a judicial request, and must be expressly sought in the complaint. Once the domain expires or is deleted, that road closes.
The point that changes everything: the withdrawal from your account is not the fraud
Here lies the practical value of this article on hub.hariolas.com, and it applies to anyone in the same position.
In the hub.hariolas.com file there are two distinct courses of conduct, and they must be kept rigorously apart because the rules are opposite.
The first are the transfers to hub.hariolas.com that the injured party ordered herself, deceived as to the reasons but aware of the act. On these the protection for unauthorised operations does not apply: the order came from the account holder, and recovery runs through the criminal route, seizure and the reconstruction of the flows.
The second is the access to the current account and the removal of the funds by third parties. That is an unauthorised payment transaction, governed in Italy by legislative decree 11/2010 implementing the EU payment services rules, and it is a completely different world.
Here are the rules in brief, because almost nobody knows them:
The user must notify the bank of the unauthorised transaction without delay, as soon as they become aware of it, and in any event within the statutory time limits. That notification is the foundation of everything: it must be made at once and in writing, not only by telephone.
Having received the notification, the bank must refund the amount by the end of the following business day, unless it has reasonable grounds to suspect fraud by the user, which it must report in writing to the authority.
The burden of proof is on the bank, not on the customer. It is the institution that must show the operation was authenticated, accurately recorded and unaffected by a technical breakdown. And the mere record of the operation is not enough to prove the customer authorised it or acted with intent or gross negligence.
The user bears a limited excess for unauthorised operations arising from the use of a lost or stolen instrument. They bear the whole loss only where they acted with intent or gross negligence, and gross negligence must be demonstrated concretely, not presumed.
And there is a decisive point, often determinative: if the operation was carried out without the bank having applied strong customer authentication, the institution cannot rely on the mere record against the customer. It is always worth checking whether the disputed operation actually required a second factor, and which.
Finally, the practical tool: besides the written complaint to the bank, Italy has the Arbitro Bancario Finanziario, an out-of-court dispute resolution system free of charge for the customer, to which one turns after a complaint that has not been resolved. It is the fastest route and the one in which this subject has been decided thousands of times.
So, to anyone who paid into hub.hariolas.com: the transfer you made and the withdrawal they made do not go in the same basket. The second must be disputed with the bank, in writing, today.
What to do when you discover they are inside your account
Let us set out the order of operations after an affair like hub.hariolas.com, because the order matters.
First, after an affair like hub.hariolas.com: block, do not delete. Block the payment instrument and have the credentials suspended. Delete nothing, close nothing, "clean up" nothing.
Second: notify in writing. A written complaint to the bank with an itemised list of the disowned operations — date, time, amount and beneficiary — with an express request for refund under the unauthorised-transaction rules and for the preservation of the authentication logs. The date of that communication is the hinge of the whole position.
Third: ask for the logs. Ask the bank, already in the complaint, to preserve and produce the authentication data of the operation: which device, which channel, which second factor, which IP address. If the bank later argues gross negligence, it is that data that decides.
Fourth: the criminal complaint. Accessing someone else's account amounts to unauthorised access to a computer system under art. 615-ter of the Italian criminal code, autonomous from the fraud, and moving the funds by operating on the system amounts to computer fraud under art. 640-ter. If credentials were obtained, the unlawful holding and dissemination of access codes under art. 615-quater is also relevant. These are all offences distinct from art. 640, and they must be charged separately, not absorbed into the narrative of the fraud.
Fifth: and here comes the part nobody says.
Do not reset your phone
In the hub.hariolas.com file, on discovering the withdrawal, the injured party did the thing that instinctively feels safest: she reset her phone. The result is that the evidence vanished — the conversations, the screenshots of the platform, the so-called certificates with profit charts she had been shown.
Let us say it clearly, because it is a message that can save many cases: after a compromise you do not reset the device. The reset does not remove a problem that is no longer in the phone: the money is already gone, the credentials are already known, the data is already in someone else's hands. It removes only the one thing that was still yours, namely the evidence.
The correct sequence is different: isolate the device, change everything from the outside (banking and email credentials from another device, revoke active sessions, disable any remote-access apps), export everything relevant natively, and only then, if needed, clean up — ideally with the help of someone who can take a forensic copy.
And if the reset has already happened? Not everything is necessarily lost, and it is worth knowing:
Server-side backups of messaging apps may retain the conversations; the phone account's cloud backup often retains the images; the bank is required by law to retain the full transaction history and the data of the disputed operation; the telephone operator retains call records; and the counterparty — the platform, the recipient of the transfers, the domain operator — retains what it has, and is reachable only by the authority. The reset deleted your copy, not the original held elsewhere. That is why the complaint must contain applications for acquisition from all these parties.
Facial recognition: the gravest datum of all
In the hub.hariolas.com file the injured party handed over, on request, a package of data worth listing in full: identity card, name and surname, IBAN, email address, mobile number, utility bills proving her address, access credentials and a facial recognition check.
It is not a random list, and it is the list hub.hariolas.com asked for. It is exactly the set required by the remote verification procedures of payment institutions and exchange platforms. Whoever holds it has what is needed to attempt to open accounts in someone else's name.
The facial recognition requested by hub.hariolas.com deserves a paragraph of its own. It is biometric data, belonging to the category the European data protection regulation protects in a reinforced way. It is not a password: it cannot be changed. Once an identity-verification video has been handed over, that material remains usable.
The practical consequences are two. On the criminal side, identity impersonation under art. 494 is relevant, as is the concrete risk that money from other frauds passes through accounts opened with the victim's data, with the paradoxical outcome of a money-laundering allegation against her. On the civil and administrative side, the improper handing over of biometric data can be brought to the attention of the data protection supervisory authority.
For that reason the complaint must include an express, dated disavowal: a statement of not having opened or authorised any relationship with those documents, of disowning every operation carried out with them, and of having handed over the biometric material under fraudulent inducement. It is a line that costs nothing and that, the day an allegation arrives, is worth a great deal.
"I am pretending to still cooperate": why it is dangerous
There is a point in the hub.hariolas.com case that deserves honesty, because at the time of our first interview the injured party had chosen to keep pretending to cooperate with the organisation in order to buy time.
The intention is understandable and so is the investigative instinct. But it must be said that it is a risky choice and that, in our experience, it does more harm than good.
Anyone still inside hub.hariolas.com continues to be worked on. And the next phase is predictable: when they understand no further payments are coming, they change register. They present themselves as authorities, as police, as the tax office, as an appointed recovery firm. Or they move to threats and psychological pressure. That is the moment when many people, already emptied, pay the last sum they did not have.
The correct advice is: export everything, then close it down. The conversations that have already happened are evidence enough; future ones add nothing decisive and expose you to a real risk.
And above all: not another cent is paid, in any form and for any stated reason. When, after the payments, the victim of hub.hariolas.com asked for her money back, the answer was that to get it back she had to pay again. That is not a procedure: it is the second fraud, and holding out an unjust harm to obtain an undue payment must also be assessed as attempted extortion.
The legal framework
The hub.hariolas.com facts are from autumn 2026, hence after the entry into force of law 90/2024: art. 640 paragraph 2-ter of the Italian criminal code applies, aggravating fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator. Here the obstacle is plain: a domain a few days old, a server-masking service, foreign transfers and cryptocurrency moved to wallets.
In the hub.hariolas.com file there are added the diminished defence of art. 61 no. 5, recalled by art. 640 paragraph 2 no. 2-bis, and the particularly serious financial loss of art. 61 no. 7.
As said, unauthorised access under art. 615-ter, computer fraud under art. 640-ter, identity impersonation under art. 494 and, in relation to the receiving accounts, money laundering under art. 648-bis must be charged separately. Offering investment services without authorisation amounts to the unauthorised activity offence under art. 166 of the Italian consolidated financial act, prosecuted of the court's own motion.
On the deadline: simple fraud is prosecutable on complaint filed within three months of knowledge of the fact. With a last transfer on 6 November 2026, that deadline falls in early February 2027. But note: unauthorised access and computer fraud have their own rules, and the time available for the complaint to the bank is far shorter. The first thing to do is not the criminal complaint: it is the written complaint to the institution.
What to secure immediately
Anyone who paid into hub.hariolas.com should keep receipts and confirmations for every transfer, with beneficiary, IBAN, BIC, country and reference. The account statement with the disowned operations highlighted, with date and time. A copy of the complaint sent to the bank and its receipt. The exact address of the platform in complete form, including the subdomain. The screenshots of the balances and of the so-called certificates with charts, if still available, or the backup from which to recover them. A native export of the conversations. The numbers and accounts used by the fraudsters. The list of personal documents handed over, expressly noting the facial recognition check and its date. The destination wallet addresses, if the step was taken in cryptocurrency: they download from your own exchange's transaction history and are the starting point of the chain analysis.
Similar cases already handled by the firm
For anyone who has crossed paths with hub.hariolas.com, on remote control of the device and unauthorised access our analysis of axi24-cfd.com may help; on blocked withdrawals and sums demanded to unblock, those of eliteclouds.com and cryptoledgerx.top; on reading an address correctly and on subdomains, that of tiktok.yalmy.shop; on very short-lived domains, that of artisanworks.vip; and on fake recovery, that of dam.w24platform.com.
If you paid into hub.hariolas.com: what to do now
The picture is this. hub.hariolas.com is a scam served by a domain registered on 5 November 2026 — the day before the injured party's last transfer — still active and behind a service that masks its server. The money left partly through transfers the victim ordered and partly through direct access to her current account. The request for restitution was met with a demand for further payments.
If it has happened to you too, the order of things is this: a written complaint to the bank for the operations you did not authorise, preservation of everything without resetting anything, and then the criminal complaint with the applications for acquisition while the domain is still alive.
Our firm has already handled this case. You can submit your position for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
