mirabaudasset-management.com scam: clone firm and incoming transfers

A premise: we are a law firm and we deal exclusively with online fraud and unauthorised financial activity. This article comes from a real case handled by the firm and is published in anonymous form as regards the injured party, for public interest purposes. The technical data come from checks on the public domain registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your position to us using the form at the bottom of this page.

In the mirabaudasset-management.com file there is one detail that completely changes the nature of the problem, and that almost nobody recognises in time: at a certain point the fraudsters sent money to the victim, asking her to reinvest it.

That money, which arrived in her account during the mirabaudasset-management.com affair, came from somebody else. And the moment she passed it on, the injured party became, without knowing it, a link in the chain. It is the most dangerous trap of all, because it turns the person who suffered the loss into somebody who has to explain her own position.

mirabaudasset-management.com is a scam, and our firm has already handled this case. Here we explain why the name was not a coincidence, and what to do when you discover you have moved other people's money.

Why mirabaudasset-management.com is a scam: twenty-nine years against two months

Let us start with the check on mirabaudasset-management.com that would have stopped everything in thirty seconds.

The name mirabaudasset-management.com echoes that of a genuine Swiss private banking group, with an authorised asset management company that has been operating for generations. The technique used by mirabaudasset-management.com has a name: it is called a clone firm, and it consists in taking the name of an authorised intermediary and using it on a different domain in order to gain credibility with anyone who performs only a superficial check.

This must be said straight away, because it is the point that also protects the reader: the genuine group has nothing to do with any of this. It is itself an injured party of the improper use of its own name, it publishes explicit warnings on its own website about the unlawful use of the group's names, and the phenomenon is so well known that the British supervisory authority has for years published a clone firm warning referring to that very name.

Now let us look at mirabaudasset-management.com and the authentic domain side by side, because the comparison is merciless.

The genuine group's domain is registered in March 1997: it is twenty-nine years old, it keeps its nameservers and its mail on Swiss infrastructure, it has complete mail authentication records and it has been active throughout.

mirabaudasset-management.com is registered on 10 September 2026, with a one-year expiry, behind a service that masks the origin server, and with no mail record configured at all.

Twenty-nine years against two months. And the approach to our client began precisely in September 2026: the domain was registered at the start of the story, the way you buy a tool that only has to last one season.

This is the check on mirabaudasset-management.com that is worth more than any reassurance, and it is free: the age of the domain. A historic banking group has a domain that is decades old. A domain a few weeks old, with an annual registration and no mail, is a temporary shop window.

The second check on mirabaudasset-management.com is just as simple: the exact address. An authorised intermediary has one official website only, and that address is published in the supervisory authority's register. You check it there, not on the page somebody sent you.

The most serious point: the incoming transfers

Now we come to the part that makes the mirabaudasset-management.com file different from all the others.

In the course of the mirabaudasset-management.com affair, the injured party received two bank transfers and was told to reinvest them on the platform. She did so, convinced that they were returns or reimbursements.

They were not. In practically every case, money arriving in a victim's account from sources she does not know comes from other victims: it is money of unlawful origin that the organisation routes through a clean account — yours — in order to break the audit trail.

The consequences must be stated clearly, without alarmism and without playing them down.

In criminal terms, a person who receives money of criminal origin and carries out operations capable of hindering the identification of its origin commits money laundering under article 648-bis of the Italian criminal code. The offence, however, requires intent: awareness of the unlawful origin is needed. Someone who was deceived, and who acted believing she was moving her own money, does not have that intent. The same applies to receiving stolen goods under article 648, which likewise requires awareness.

The problem, however, is not theoretical: it is practical and evidential. When one of the other victims files a complaint, the bank reconstructs the flow and the first name that emerges is that of the holder of the account through which the money passed. That is, yours. In a case like mirabaudasset-management.com, at that point it is not the suspicion that has to be proved: it is you who have to explain.

And that is precisely why there is only one thing to do, and it has to be done immediately.

What to do if you received and passed on money from mirabaudasset-management.com

Declare it first, in the criminal complaint about mirabaudasset-management.com. Incoming transfers must be set out expressly in the complaint, with date, amount, ordering party and payment reference, attaching the bank advices. They must not be hidden, and they must not be "left out because they complicate things". Hidden, one day they will look concealed; declared spontaneously before any challenge, they become the best proof of your good faith and, at the same time, a valuable investigative element, because they connect your file to that of another injured party.

Document the instruction you received. The message in which you were told to reinvest those sums is the heart of the defence: it shows that the operation was not your own initiative but the execution of somebody else's instruction, in a context of deception. It must be exported in native form, with date and time.

Notify the bank. If you realise you have received unexpected sums from strangers, report it in writing to your institution. The intermediary has its own obligations on suspicious transactions and your communication remains documented and dated.

Do not return anything on your own initiative to whoever asks you for it. If the organisation asks you to "send back" sums or to pass them on to a third party, you are about to carry out the typical conduct of a money mule. You stop the operations and you talk to a lawyer.

The account opened in her name and the platform registered to somebody else

There are two further elements in the mirabaudasset-management.com file that have to be read together.

The first: with the documents handed over — identity card, tax code, IBAN, contact details, utility bills as proof of residence — a relationship was opened in the injured party's name, which she neither wanted nor managed.

The second: the account on the exchange platform through which the operations passed was not in her name.

Both are serious facts and they are relevant on distinct grounds. Opening relationships with another person's documents amounts to impersonation under article 494 of the criminal code, and operating on third-party accounts is exactly the mechanism by which a chain of money mules is built. For this reason the complaint must contain an express and dated disavowal: the declaration that you did not open or authorise any relationship with your own documents and that you disavow every operation carried out with them.

To this must be added the use of a remote control program on the computer, which appears here too. Access to another person's device, obtained with consent that was extracted and in any event exceeding the limits for which it was given, amounts to unauthorised access to a computer system under article 615-ter; if during the remote session the systems were operated on directly, computer fraud under article 640-ter also comes into play. And the usual warning applies: do not reformat the computer, because remote control programs log the sessions and keep the identifier of the device that connected.

The emails that looked like the platform's

One last technical element of the mirabaudasset-management.com case, and a very instructive one.

The injured party of mirabaudasset-management.com received emails that appeared to come from the exchange platform. They did not.

There is a simple way of spotting a mirabaudasset-management.com style email and it is worth learning. You do not look at the sender's display name, which anyone can write as they please: you look at the domain after the at sign, and you compare it with the official domain published by the operator. If it differs even by one character, or if it is a different domain with the brand placed in front of it, the email is not theirs.

And above all there is a substantive rule with no exceptions: no genuine exchange platform ever asks you to transfer money to a natural person or to a third party. If an email gives you the details of somebody who is not the operator itself, the email is false regardless of how it looks.

It should be said, to our client's credit, that she worked it out herself: she managed to log in to the real platform and take her own screenshots, while she was being told that the system did not allow them to be shown to her. Those screenshots are evidence: they document the divergence between what she was being told and what the system actually showed, and it is precisely in that divergence that the artifice of article 640 of the criminal code lives.

The legal framework

The mirabaudasset-management.com facts date from September-October 2026, and therefore come after the entry into force of law 90/2024: article 640, paragraph 2-ter of the criminal code applies, which aggravates fraud committed remotely by means of computer tools capable of hindering the identification of the perpetrator.

In the mirabaudasset-management.com file there are also the aggravating circumstance of diminished defence under article 61 no. 5, recalled by article 640 paragraph 2 no. 2-bis — particularly telling here, the victim being a woman living alone, employed in care work and with no familiarity whatsoever with financial markets — and damage of particular seriousness under article 61 no. 7, made worse by the fact that part of the sum came from a loan, with a debt that survives the fraud.

Also relevant are impersonation under article 494, unauthorised access under article 615-ter, possibly computer fraud under article 640-ter, and unauthorised financial activity under article 166 of the Consolidated Law on Finance, prosecutable of the court's own motion: a party who offers investment services spending the name of an authorised intermediary without being one is acting in breach of sector rules. The movement of third-party funds must be presented as somebody else's conduct, with a request to ascertain the positions of those who ordered those transfers.

On the time limit: simple fraud is prosecutable on complaint within three months of learning of the facts; with the last transfer in October 2026 the deadline falls in January 2027. The aggravating circumstances of the second paragraph of article 640 entail prosecution of the court's own motion and unauthorised financial activity is prosecutable of the court's own motion in any event, but filing within the time limit remains the sounder choice.

What to secure immediately

Anyone who paid money to mirabaudasset-management.com should obtain from their bank the complete list of operations, incoming and outgoing, with ordering party, beneficiary, IBAN, BIC, country and payment reference: the transfers received matter as much as those ordered. The native export of all conversations, including the instructions to reinvest. The emails received in complete original format, not as a photograph of the screen: the technical headers are needed, and they are obtained with the "view original message" function of your mail program. The screenshots of the real platform and those of the platform that was shown. The exact address of the domain. The list of personal documents handed over and of the relationships opened in your name. The computer on which the remote control program was installed, isolated and not reformatted. The documentation of any loan taken out.

Similar cases already handled by the firm

For anyone who has crossed paths with mirabaudasset-management.com, on the cloning of an authorised intermediary our analysis of manoab.com may be useful, concerning the clone of a Lithuanian bank, as may that of axi24-cfd.com, with the same use of remote control; on the broker blocked by the supervisory authority, that of finomarkets.org; on money entrusted to a self-styled adviser, the one on unauthorised financial activity; on access to the account and the unauthorised withdrawal, that of hub.hariolas.com.

If you invested in mirabaudasset-management.com: what to do now

This is the picture. mirabaudasset-management.com is a scam: a domain registered on 10 September 2026, behind a service that masks its server, spending the name of a real Swiss banking group — which has nothing to do with it and is itself an injured party. The genuine group has a domain registered in 1997: twenty-nine years against two months, and that was all there was to it.

If your own story includes incoming transfers that you were asked to reinvest, that is the first thing to deal with, not the last: it must be declared, documented and explained before somebody else asks you about it.

Our firm has already handled this case. You can submit your position to us for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form you will find at the bottom of this page.