Disclaimer: we are a law firm dealing exclusively with online fraud and unauthorised financial activity. This article arises from two real cases handled by the firm and is published in anonymised form as regards the injured parties, for public-interest purposes. The technical data comes from checks on the public domain registries carried out at the date of publication; the company names reported are those appearing in the payment instructions received by the victims, and each party's position must be verified individually. If what you read sounds familiar, you can submit your case through the form at the bottom of this page.
On 28 August 2026 a genuinely existing Lithuanian bank, AB Mano bankas, published a notice on its own official website: someone was using its name to have money sent to them, and it named a specific address. Five days later that address was suspended. On the very day of the suspension a new domain was registered, identical but for a hyphen. That new domain is manoab.com, and another 45,000 euro went through it.
manoab.com is a scam. Our firm has already handled this case — in two separate files, two injured parties, two domains — and in this article we set out the facts, the dates and the accounts the money ended up in.
Why manoab.com is a scam: the name is a real bank's
The technique used by manoab.com is not an original invention: it is the cloning of an authorised intermediary, what the trade calls a clone firm.
It works like this. A genuinely authorised bank exists, with a licence, supervision and an official website. The fraudsters behind manoab.com do not touch that bank: they take its name, turn it into a similar but different domain, reconstruct a lookalike visual identity and use it to gain credibility with people who run only a superficial check.
In the first of the two manoab.com files, the injured party was directed to the twin domain mano-ab.com and opened a personal account there, complete with an identifying number. Her complaint records that the domain appeared referable, in name and visual presentation, to the Lithuanian institution AB Mano bankas.
This must be said clearly, because it is the point that protects the reader too: the real bank has nothing to do with any of this. It is itself injured by the misuse of its name, and it was the first to say so publicly. In its notice of 28 August 2026 it stated that its only official website is its own, that the hyphenated domain was being used for these approaches, and it urged people not to register there, not to supply data and not to make transfers on the instructions of anyone presenting themselves in its name.
The operating principle that follows applies to any bank, broker or financial company: the name is no guarantee, the exact domain is. An authorised intermediary has a single official website, and that address is published in the register kept by its country's supervisory authority. You check it there, not on the page somebody sent you.
The decisive proof: the chronology of the domains
Here comes the part that makes the manoab.com file different from many others, because it is entirely documentable on the public registries.
4 June 2026. The hyphenated domain is registered, with a one-year term.
January to July 2026. The first injured party is hooked, opens an account on the platform and pays, in four operations, 16,581 euro, plus bank charges.
28 August 2026. The genuinely existing bank publishes its public notice, expressly naming that domain.
2 September 2026. The hyphenated domain is placed on registry hold — the measure a registrar typically applies following an abuse report — and today it no longer resolves.
2 September 2026, the same day. manoab.com is registered: same name without the hyphen, same registrar, and above all the very same pair of authoritative nameservers.
That last item deserves explaining, because it is the soundest technical element in the whole file and is almost always overlooked.
When a managed DNS service is used, the provider assigns each account a pair of nameservers drawn from a large set. Two domains showing the same pair are therefore, with very high probability, managed from the same account. This is not the shared-IP situation, which proves nothing because thousands of unrelated sites live on one shared server: here we are looking at a configuration pointing to a single user profile.
Put together the data on manoab.com and its twin: same registrar, same nameserver pair, and the registration of the new domain on the very day the old one was blocked. That is no coincidence. manoab.com is the continuation of the same activity under a barely different name, and it shows the structure was ready to restart before the suspension even arrived.
Autumn 2026. A second injured party, who did not know the first, is hooked on manoab.com and pays a total of 45,000 euro, the last transfer in October.
As at the date of this article manoab.com is still registered and still active, expiring in September 2027.
The detail that is worth an investigation on its own: the mailbox
There is an element in the second file that looks at first like a poverty of evidence and is in fact the opposite.
The second injured party was never shown a real platform. Asked to give the link of the site where she saw her gains, she answered that there were no gains to see and that the only reference she held was an email address on the manoab.com domain, sent by the person who had contacted her.
Many victims of manoab.com, at this point, convince themselves they have no case: no screenshots, no dashboard, no fictitious balance to produce. The opposite is true, and the reason is technical.
Checks on the public records of manoab.com show that the web traffic passes through a service that masks the origin server — which on its own conceals where the site is hosted. But the mail records are not masked: they state in clear which provider the mailbox is held with, and the sending-authorisation record configured on the domain confirms it.
It means that, behind manoab.com, there is an identified party, reachable by the judicial authority, who holds right now: who created that mailbox, under which account, from which IP addresses it is accessed and what it contains. It is one of the few points in the whole affair that leads to a real physical person, and it is available only while the domain remains active.
So, to anyone who received only an email address: that address is evidence. Keep it in its exact form and name it in the complaint, with an express request for acquisition from the mail provider.
Where the money went: four accounts, four countries
Putting the two manoab.com files side by side, a constantly rotating collection structure emerges.
In the first manoab.com file, the July 2026 payments split as follows. The first two operations, totalling 6,831 euro, go to an account at a French payment institution. The other two, totalling 9,750 euro, go to an account at a Maltese electronic money institution, with the stated beneficiary DIGIFUNDS FINSERVICES LTD.
In the second file, the payment instructions name an account at a Lithuanian institution, with beneficiary GUITARWAVE LTD and the reference "TRANSFER 30000".
Three jurisdictions, three institutions, two company names having nothing to do with manoab.com and nothing to do with the banking name displayed on the site. To be precise: the names reported are those appearing in the instructions received by the victims, and each must be established individually, because real company names are not infrequently misused by third parties. The first check is an extract from the competent companies register.
But there is a detail in the first manoab.com file that must be flagged to anyone about to make a transfer, because it is the subtlest trap we have encountered.
In the first two operations, the stated beneficiary was the injured party's own name. She was made to order a transfer to a French account that was not hers, but which appeared in her own name in the order data.
This serves two purposes. First, to put the victim at ease: "I am sending money to myself, it is only a technical transfer". Second, and more serious, to neutralise the name-IBAN matching check that European banks perform before executing a transfer: if the stated name matches the payer's own, nothing is flagged.
The practical rule is this: if someone tells you to put your own name as the beneficiary of a transfer to an IBAN that is not yours, stop right there. There is no lawful reason to do it.
One favourable technical note: all three receiving institutions are established in the European Union. They are therefore subject to anti-money-laundering obligations and reachable by European Investigation Order, with no letters rogatory. By law they retain the holder's identity, the account-opening documents, the access IP addresses and the full transaction history.
The blocked withdrawal, the invented taxes and the "100% penalty"
The first manoab.com file documents in full the second phase, the one anyone inside it recognises at once.
After the payments, operations were moved to a third domain, where a residual balance of 4,068.60 euro appeared. On the withdrawal request, the answer was that the transfer was conditional on paying a further 11,996.66 euro, of which 6,907.66 as a "balance" and 6,800 euro of "international transfer charges".
Pause on the arithmetic, because it dismantles everything on its own: to collect 4,068 euro you had to pay nearly twelve thousand. No lawful financial operation anywhere works that way. When the sum demanded to unblock exceeds the sum to be unblocked, you are not facing a procedure: you are facing the second half of the fraud.
And when the injured party hesitated, the threat arrived: failing payment, a 100% penalty would be applied, with the loss of everything. The messages came through a messaging app, from a contact with an invented name, and by telephone from an Italian number, from a self-styled operator whose name nobody has ever been able to verify.
This phase is not colour: holding out an unjust harm to obtain an undue payment must also be assessed as extortion under art. 629 of the Italian criminal code, a far more serious offence prosecuted of the court's own motion. It is one of the reasons threats must be preserved, not deleted.
The hook: the person who calls just after you have sold your house
One aspect of the second manoab.com file deserves saying plainly, because it concerns a specific target.
The second injured party is a pensioner living on around six hundred euro a month. The 45,000 euro were not accumulated savings: they were the proceeds of the sale of her flat, intended to buy a home in another region. She was contacted by someone presenting himself as a financial adviser, and within a few months nothing was left.
Anyone who sells a property becomes, for a period, a person with sudden liquidity and a known plan. We do not wish to cast suspicion on anybody, but the experience is this: people who have just completed a property sale receive, with anomalous frequency, calls from self-styled financial advisers. If it happens to you, there is only one correct response: you do not discuss investments with someone who called you first.
And the check is within everyone's reach: a financial adviser authorised in Italy is entered on the register kept by the sector's supervisory body, searchable free of charge online by name. Anyone not on it cannot offer that service, and offering it regardless amounts to the unauthorised activity offence under art. 166 of the Italian consolidated financial act, prosecuted of the court's own motion.
The legal framework and the deadline now running
The manoab.com facts fall in 2026, hence after the entry into force of law 90/2024: art. 640 paragraph 2-ter of the Italian criminal code applies, aggravating fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator. Here the obstacle was built methodically: a real bank's name, interchangeable domains, a server-masking service, accounts held by third-party companies in three countries, messaging contacts under invented names.
In the manoab.com files there are added the diminished defence of art. 61 no. 5, recalled by art. 640 paragraph 2 no. 2-bis — particularly apt in the second file, involving an elderly woman, alone, just out of a property sale — and the particularly serious financial loss of art. 61 no. 7.
Also relevant are identity impersonation under art. 494, for the use of a genuinely existing bank's name and of unverifiable personal identities; computer fraud under art. 640-ter, if the balances displayed were the fruit of a manipulation of the system rather than a mere representation; money laundering under art. 648-bis in relation to the receiving accounts; and, as said, extortion under art. 629 for the phase of threats. The plurality of parties, platforms, phone numbers and accounts justifies seeking investigation also under art. 416.
On the deadline: simple fraud is prosecutable on complaint filed within three months of knowledge of the fact. With a last transfer in October 2026, that deadline falls in January 2027. The aggravating circumstances in the second paragraph of art. 640 entail prosecution of the court's own motion, and unauthorised financial activity is prosecutable ex officio in any event, but filing in time remains the sounder course.
And above all: it is the same window in which the domain is still active and the data held by registrar, DNS service and mail provider is still intact.
If you have already reported it to the police
One of the two injured parties of manoab.com had already been to the Carabinieri. That is the right thing to do at once, but you should know what it involves.
A report taken at the counter is normally a summary narrative: it opens the proceeding but contains no investigative applications. Without those, a file against unknown persons risks taking the shortest road.
What is needed is a supplement, to be filed with the same prosecutor's office and under the proceeding number already assigned, containing: the itemised list of transfers with beneficiary, IBAN, BIC, country and reference; the request for acquisition from the registrar and the DNS service of the domain registration data and of the list of other domains attributable to the same account; the request for acquisition from the mail provider of the data of the mailbox on the domain; the applications to identify the holders of the receiving accounts by European Investigation Order; the application for seizure; and the request to be notified of any application to close the file.
The connection with the other proceedings on the same matrix should also be flagged: the existence of several injured parties, on different domains but attributable to the same account, is exactly what turns several isolated files into a single investigation.
If you handed over your documents
Both injured parties of manoab.com handed over copies of their identity documents. That is the norm in these affairs, and it must be managed.
Whoever holds an identity document, a tax code and contact details has what is needed to attempt to open accounts in someone else's name. The consequences are identity impersonation and the risk that money from other frauds passes through accounts opened with the victim's data.
For that reason the complaint must include an express disavowal: a statement of not having opened or authorised any relationship with those documents and of disowning every operation carried out with them. It is a line that costs nothing and that, if a claim arrives one day, is worth a great deal because it is dated and filed.
When there is no money left even to defend yourself
We close with something rarely written, but which in this file is the real knot.
The second injured party of manoab.com was left, after the fraud, without the proceeds of her home and with debts, living on a minimum pension. Someone in that position is, paradoxically, the perfect target for the next phase: calls from people promising to recover the capital against an advance payment. Let us say it once more: no serious recovery is paid for in advance, and anyone calling who knows how much you lost knows it because that data comes from the original fraud.
On the civil side, moreover, Italian law provides a remedy almost nobody knows about and which is pertinent in situations like this: the over-indebtedness crisis composition procedures, now governed by the business crisis and insolvency code, which in the gravest cases extend to discharge of the debtor who has nothing. They are activated through the Crisis Composition Bodies, often established at professional associations and local authorities. It is a different route from the criminal one and must be assessed by those who handle it, but it deserves to be known by anyone left with nothing.
What to secure immediately
Anyone who paid into manoab.com should keep receipts and confirmations for every transfer, with full beneficiary details, IBAN, BIC, country and reference — including the operations where the stated beneficiary was your own name. The exact address of the domain and of every mailbox received, in complete form. A native export of all conversations, including those on messaging apps and the threats. The telephone numbers used. Every screenshot of the platform and the balances displayed. The account number created on the platform. A copy of any report already filed, with the proceeding number. The list of personal documents handed over.
Similar cases already handled by the firm
For anyone who has crossed paths with manoab.com, on the cloning of an authorised intermediary our analysis of axi24-cfd.com may help; on blocked withdrawals and invented fees, those of eliteclouds.com and cryptoledgerx.top; on reading a web address correctly, those of tiktok.yalmy.shop and sienkosyn-com.pl; and on money entrusted to a self-styled adviser, our study of unauthorised financial activity.
If you paid into manoab.com: what to do now
The picture is this. manoab.com is a scam: a domain registered on 2 September 2026, the very day its hyphenated predecessor was blocked following the public notice of the bank whose name it had usurped, managed from the same account and still active today. Collection took place into accounts held by third-party companies in France, Malta and Lithuania, in one case by having the victim state her own name as beneficiary. After the payments came the blocked withdrawal, the invented charges and the threat of a 100% penalty.
The facts are recent, the domain is still registered and the data held by registrar, DNS service and mail provider can still be obtained. It is the best condition in which to act, but it does not last.
Our firm has already handled this case in two separate files and knows this matrix. You can submit your position for a preliminary assessment.
If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
