trvqx.top is a scam: the fake task job and the imposed instant transfer

Preliminary note: we are a law firm and we deal exclusively with online fraud. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party and everyone else involved, for public interest purposes. The technical data come from checks on the public domain-name registries carried out on the date of publication. If you recognise yourself in what you read, you can submit your situation using the form at the bottom of this page.

There is one sentence in this case that should have stopped everything on its own: "select an instant transfer; the standard transfer is not permitted".

That is not a technical detail. It is the heart of the fraud, and it is why this article is worth reading to the end even by someone who has never heard of "orders" and "tasks".

trvqx.top is a scam, the firm has already handled this case, and here we explain how the fake online task job works, why insisting on an instant transfer is the most reliable warning sign of all, and what to do if you are already inside it.

Why trvqx.top is a scam: the checks

The site used with the injured party was not one site. In the same conversation they were given two alternating addresses: trvqx.top and a second twin domain, used interchangeably for exactly the same procedure.

The registry checks say this. trvqx.top was registered on 25 February 2026, expiring on 25 February 2027: one year, the minimum term. The second domain was registered on 24 December 2025 and expires on 24 December 2026: that is, in a few weeks. Both use a .top extension, among the cheapest in circulation, and both were bought from the same registrar.

A methodological clarification is needed here, one we always make, because the soundness of an investigative hypothesis depends on how rigorous you are about what a piece of data does and does not prove. Both domains rest on a well-known content delivery network, but with different pairs of name servers: on its own, that does not allow one to assert that they are administered from the same account. The same registrar and the same extension are compatible with a single structure, but they do not demonstrate it.

What does demonstrate it in practical terms is a lived fact, not an inference: the same interlocutor, in the same conversation, directed the injured party first to one domain and then to the other to complete the same sequence of operations. That is the better proof, because it does not depend on a technical interpretation.

One last check, the simplest: behind trvqx.top there is no company at all, no VAT number, no corporate reference, no authorisation. There is no employer, there is no contract.

How the fake task job works

The trvqx.top mechanism is repetitive by design, and recognising it takes thirty seconds once you have seen it.

The trvqx.top injured party is put into a group on a messaging app and assigned to a figure presented as an instructor or tutor, who calls them "student" and assigns them tasks. The tone is caring, full of emoji and encouragement.

The tasks consist of operations to be carried out on the trvqx.top site, always the same: open the platform, select a cryptocurrency pair, press the green "Buy" button, choose a thirty-second interval and a thirty per cent rate, enter an amount, confirm, wait half a minute and send a screenshot.

Here the most important thing of all must be said: that is not a financial transaction. It is a button on a web page run by the person writing to you. No market in the world returns thirty per cent in thirty seconds, and no transaction actually exists: the outcome is decided by whoever controls the site, and the balance appearing on the screen is a number written by them.

The second element is what turns the game into an outlay. Every "order" requires an advance payment: you pay in order to work. In the trvqx.top case the options offered were graduated — twenty-one euros to earn six euros thirty, thirty-nine to earn eleven seventy, eighty-nine to earn twenty-six seventy — and it was the "system" that randomly assigned how many orders and of what size.

The third element is the set of rules, accepted at the outset with an "OK", which serves only to close off the exits: orders cannot be cancelled, incomplete orders give no right to a refund, operations may only be carried out on the instructor's instruction. They are rules written by the people collecting the money.

The imposed instant transfer: the most reliable sign

Back to the sentence we started with, because it is the most useful thing this article has to leave you with.

In the trvqx.top case every payment had to be made by instant transfer, with an explicit prohibition on using an ordinary transfer.

The reason has nothing to do with convenience. An instant transfer credits the beneficiary within seconds, at any hour, and is by its nature irrevocable: once executed it cannot be stopped. An ordinary transfer, by contrast, is processed within banking timescales, can be intercepted during the day, gives the bank time to notice an anomaly and the person time to think again.

Anyone who imposes the instant transfer and forbids the ordinary one is telling you, without meaning to, that they know they have only minutes.

Hence a practical rule that applies to any payment, not only trvqx.top: imposing the payment method is itself a warning sign. A legitimate creditor accepts an ordinary transfer. Anyone who refuses it is not protecting your money, they are protecting their own.

There is an important corollary. Since 9 October 2025, under Regulation (EU) 2024/886, banks in the euro area must offer customers a verification of payee service, which flags any mismatch between the name entered and the account holder of the IBAN. If a "name mismatch" warning appeared when the transfer was being completed, that warning was a real alarm and must be recovered: the notification, and the moment it appeared, belong in the criminal complaint.

The false reference and the pass-through accounts

In the trvqx.top case the payments did not go to a company but to Italian current accounts held by natural persons, different each time, and the payment reference to be used was always the same: "payment on behalf of a friend".

It is worth understanding what that reference does, because it is designed.

First, it disguises the payment: a transfer between private individuals with a friendly reference attracts far less attention from anti-fraud controls than a commercial payment to a stranger. Second, it confuses the later reconstruction: in the file that payment looks like a loan between friends rather than payment for an "order". Third, and most insidiously, it exposes the payer, because an untruthful reference weakens the injured party's position when they have to explain those transactions to their own bank.

The names of the holders of those accounts are not published here and must not be contacted: they are often people who have themselves been recruited, or identities used without their knowledge, and a private initiative only risks compromising the investigation.

There is, however, good news, and it is concrete: those accounts are Italian. An Italian intermediary answers the Italian judicial authority within reasonable time and is required to retain data for ten years. The trail exists and must be set out precisely in the complaint.

The salary that really was paid, and then the "operational error"

In the trvqx.top affair the injured party was, at first, genuinely paid. They completed the first orders and received real credits, accompanied by congratulations and emoji.

It serves one purpose only: to prove that the system pays. It is the organisation's advertising investment, and it works so well that after that moment the person is no longer deciding whether to trust: they are simply waiting for the next order.

Then comes the turning point of trvqx.top, and it is always the same: an "operational error". An order carried out the wrong way, data entered incorrectly, an operation started without instruction. At that point the balance is shown as blocked and, to unblock it, more must be paid — amounts that go from a few tens of euros to thousands very quickly.

And the social pressure arrives too, which in the trvqx.top case was explicit: the injured party was told that another "student" had already corrected the data and received her refund, and that they were now the only one who had not. It is a deliberate lever: it isolates, it hurries, and it shifts the problem from the fraud to the fault.

There is no error on trvqx.top. The error is part of the script, and the blocked balance is the way to make someone who has already paid pay again. We have written about an identical ladder of pretexts in relation to veneziace.com.

The legal framework

The trvqx.top facts are recent, and therefore subsequent to Law 90/2024: Article 640(2-ter) of the Italian Criminal Code applies, aggravating fraud committed remotely by means of computer tools capable of obstructing identification of the perpetrator.

The aggravating circumstances of diminished capacity to defend oneself (Article 61(5)) — particularly relevant where the injured party is elderly or retired and contact is daily — and, above the threshold, of particularly serious financial loss (Article 61(7)) also apply. The repeated payments amount to a continuing offence (Article 81(2)).

Displaying a balance and transactions that do not exist on a platform controlled by the perpetrators must also be assessed as computer fraud (Article 640-ter). Offering investment services to the public without authorisation falls under Article 166 of the Italian Consolidated Law on Finance, prosecuted ex officio. The subsequent movement of the sums is relevant as money laundering (Article 648-bis).

The aggravating circumstances of the second paragraph of Article 640 make the matter prosecutable ex officio.

What to do now

Anyone caught up in the trvqx.top affair must do four things, in this order.

Stop paying. A blocked balance is never unblocked by paying.

Do not leave the chat by deleting it. First make a native export of the conversation using the application's own function, with dates and times, because it is the document that tells the whole story, instructions included.

Collect the bank advices for every transfer, with destination IBAN and holder, amount, date, time and reference, and recover the screenshots of the platform and of the balance displayed. It is worth asking the bank, under Article 119(4) of the Italian Consolidated Banking Act, for a copy of the documentation of transactions over the last ten years, and reporting the matter at once, asking that any payee-mismatch notification be recorded.

File a complete criminal complaint, with the application for preventive seizure (Article 321 of the Code of Criminal Procedure), the request for information on registration under Article 335 and the request for notice in the event of a request to shelve the case under Article 408(2). The second domain expires in December 2026: the data concerning it can be obtained only for as long as the operators keep it.

Similar cases already handled by the firm

Anyone who has come across trvqx.top will also find useful our analysis of dtw866.it, on fake work with prepaid orders, and that of dfgr269.it, on fake assignments coordinated through messaging apps.

If they are asking you to pay for an order: stop

The picture is this. trvqx.top is a scam: an annual .top domain, used interchangeably with a twin expiring in December 2026, behind which there is no company at all, where the "transactions" are buttons and the earnings are numbers written by the person writing to you.

The rule to take away is a single one, and it applies everywhere: a real job is not paid for in advance, and anyone who imposes an instant transfer while forbidding the ordinary one is not doing it for you.

The firm has already handled this case. You can submit your situation for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.