Original article (in Croatian) was published on 28/10/2024; Authors: Anja Vladisavljević, Ivan Nekić
Advertisements circulating on social media are promising victims of online frauds a refund. However, several institutions have confirmed to Faktograf.hr that these ads are, in fact, part of – another scam.
One paid advertisement on the RefundFX Facebook page reads:
“For all those who have lost money… 👉 If the platform you traded on operates under one of the following European licenses: CySEC, FCA, BaFin, KPWig, HCMC, CONSOB, there’s a high chance you’re eligible for a refund. 🥇 Don’t wait—get a free consultation with RefundFX experts. 🤓 A specialized agency with years of experience in fraud related to online trading. Free consultation and refund assessment options. ✔️ The deadline for filing an official complaint is 12 months after trading ends. 📝 74% success rate ✅ Millions refunded ✅”
This advertisement claims to be from a “specialized agency with years of experience in online trading fraud”, but is it truly legitimate?
As we continued to observe these Facebook ads, which promise to help those who have fallen victim to online scams, we became curious about the actual service being offered. Some users in the comments immediately identified the ads as fraudulent, while others shared their personal experiences with scams and asked for help.
Among these comments was a retired woman who, on the condition of anonymity, told us that after a series of failed investments – cryptocurrency, an online loan, and a promised overseas transfer (via a special card she was supposed to receive the money on) – she turned to RefundFX. She said her family was unaware of the scam, and since she lives on a small disability pension, recovering the funds would make a significant difference for her. However, RefundFX never responded to her request.
“A woman contacted me and said they would email me a form to fill out, but I never received it”, she told Faktograf.
In fact, she was fortunate compared to our other interviewee, who went through the process and ended up losing even more money. This woman had been promised a refund for the money lost in fake loans and donations. She paid RefundFX 250 euros, only to be asked for more. She cut off communication once she realized she had been scammed twice.
This is a refund scam known as “Recovery Scam”, where fraudsters exploit victims’ desperation to recover their lost funds by offering them fraudulent services that lead to further financial losses.
A Nonexistent Company
The Refundfx.eu website appears professional and legitimate at first glance, which is why some people don’t question its authenticity. With clearly organized sections, contact information, muted colors, and various logos (from the European Commission, Hanfa, and similar regulatory bodies) it gives the impression of a credible operation.
The website claims that its service involves three steps: assessing the chances of a client getting a refund, gathering evidence, preparing a complaint to submit to the “brokerage house and the Office of the Financial Ombudsman” and, finally, the refund. “When the process is successfully completed, and only after our client receives payment, we collect our commission for that case”, they state.
However, what’s missing from the website is information about the company itself, including a physical address. The RefundFX Facebook page lists “Ljubljana, Slovenia” as its location, and its administrators are spread across Slovenia and Serbia. Yet, when checked against Slovenian, Croatian, and Serbian business registries, no entity by the name of RefundFX exists (1, 2, 3).
We reached out to the Slovenian CERT (the national body for the prevention of cyber threats and public information system security) to inquire if they had encountered similar cases and if any agencies were authorised to help recover funds lost in scams.
“To our knowledge and experience, there is no firm in Slovenia engaged (exclusively) in refunds or assistance to victims of crypto fraud. There are, of course, companies involved in debt collection and claims recovery, but that is a different field. So, in the case of the ‘company’ RefundFX, we can be quite sure that this is yet another (crypto) fraud – as you found it: it’s not in the registry, lacks contact addresses, and the content on the website and Facebook is generic. Moreover, to convince victims, our (Slovenian CERT’s) educational materials have been stolen or referenced”, they replied.
The Slovenian CERT also pointed out that the primary purpose of these fraudulent companies is “to further victimise already scammed individuals, naturally under the guise or promises of refunding invested and lost funds”. They suggest that the same actors are likely involved.
“Companies, if they even listed an address on the website, were mostly located on exotic islands or tax havens like Jersey, the Caribbean islands, Gibraltar, Cyprus, or even Israel. So, outside of any EU jurisdiction. Even if legitimate, they could do no more than submit a complaint to the bank on behalf of the victim”, explains Slovenian CERT.
Croatian CERT confirmed that it had not received any specific complaints about RefundFX, though it had identified similar scams. They pointed out several warning signs, including a pop-up form on the website, a grammatical error in the tab title (“Poćetna stranica”), AI-generated images of “satisfied clients”, and sections of the site written in English (such as the Terms of Service).
The Croatian Financial Services Supervisory Agency (HANFA), whose logo is displayed on the RefundFX website, confirmed to Faktograf that “the mentioned agency is not an entity within HANFA’s scope”.
“As you know, HANFA is responsible for the activities of investment companies, but it has no legal authority over firms involved in assisting with fund recovery from investment scams, which would be the case here”, stated HANFA’s written response.
Since HANFA’s logo is used on the agency’s website without authorization, HANFA has announced it will take steps to have it removed. They added that they want to remind citizens not to engage with unregistered companies, “as there are no means or legal tools available to intervene and potentially recover funds for defrauded citizens”.
Croatian police informed us that RefundFX is not under the supervision of the Croatian National Bank or HANFA and is not listed in the registry, “therefore, it is highly likely to be a fraud”. Slovenian police also suspect it is a scam, reporting that they have received several fraud attempt complaints in recent years.
False Claims of Legitimacy
To convince potential clients that they genuinely care about their safety, the scammers at RefundFX fill their website and Facebook page with additional content, including free advice on digital security and data protection. They even went a step further by warning visitors that others are using their name and logo to commit fraud. And not only that – they even went so far as to post a warning about refund scams on Facebook:
On August 16, 2024, RefundFX posted a warning on their Facebook page:
“🚨 WARNING: INCREASED NUMBER OF ONLINE SCAMS 🚨Recently, we’ve noticed an increase in scams where individuals or “companies” promise you a refund. BE CAREFUL! If someone contacts you out of the blue and promises a refund, it’s a scam! ❌
👉 DO NOT ENGAGE WITH SUCH INDIVIDUALS!
👉 NEVER SHARE YOUR BANK OR OTHER PERSONAL INFORMATION!
Sharing bank information with strangers can lead to your bank account being completely emptied. Scammers are always alert, so be extremely cautious! 🛡️
Share this post and warn your friends to avoid falling into online scam traps! Together, we can stop the scammers! 🙌”
Ironically, although they present themselves as advocates for safety, they actually continue to target those who have already been scammed.
The Recovery Scam Mechanism
The U.S. Commodity Futures Trading Commission (CFTC) outlines how recovery scams (Recovery Frauds) operate, and the tactics employed by RefundFX follow this pattern. The scammers often use legitimate resources, such as Slovenian CERT’s fraud prevention advice, to trick victims into thinking they are dealing with a trustworthy entity. They may also reference the CFTC’s fraud prevention materials to appear more credible.
Typically, recovery scams start with an unsolicited call or email from someone claiming to be a government official, lawyer, or agent. Victims are told that their money is almost ready for recovery, but they must first make a small “donation” or payment. After the initial payment, additional requests for money often follow.
Once scammers have the victim’s contact information, it is often used for further scams.
As the CFTC warns, a common tactic in refund scams is using existing lists of victims: “After scammers steal victims’ money, they also profit from victims’ data – by holding onto it for several months and returning to commit a new scam or selling it on the dark web”.
Similarly, the Slovenian police have reported that fraudsters often target victims months or years after their initial scam, claiming that recovery is now possible for a fee – usually 10 % or more of the amount originally lost.
Non-existent cooperation with Interpol and the police
When victims realize they have (for the first time) been scammed, Slovenian CERT writes, they try to find information online on how to recover the stolen money. In doing so, they quickly come across websites claiming to offer assistance with this type of fraud.
At the same time, scammers actively seek out their victims on social networks, for example, through sponsored ads on Facebook. In recent weeks, Faktograf has identified eight Facebook pages that offer refund services through active ads (1, 2, 3, 4, 5, 6, 7, 8), with RefundFX being one of them.
Their posts are generally not visible on the page’s news feed but are found in Meta’s (Facebook’s) ad gallery. This means that such posts on Facebook are shown only to specific users, as ad creators can target their audience based on certain criteria such as location, gender, or age. Artificial intelligence (AI) also assists with targeting by analyzing vast amounts of data, such as past activities, interests, and user feedback, once the advertiser sets campaign goals.
Five of these pages advertised their services in Croatian, and three in the English language. According to data we obtained from Meta’s gallery, Croatia, along with other European countries, was one of the locations where these ads were broadcast.
None of these pages have administrators in Croatia. Some administrators are located in Ukraine, Afghanistan, Vietnam, the United Kingdom, Bangladesh, and the Philippines.
Ads in Croatian often sound awkward, indicating they were machine-translated. For example, a Facebook page falsely presenting itself as the European Securities and Markets Authority (ESMA) runs an ad with the caption “Get a consultation on the website”.
Several such pages falsely claim to collaborate with the Croatian police or the International Criminal Police Organization, Interpol (1, 2, 3). Allegedly, through their form, fraud can be reported to one of these institutions.
“We will help you recover your investment!
Start the recovery in 2 steps:
– Submit a report against the fraudsters
– Wait for a call from Interpol staff to assist with the recovery”, reads a paid advertisement on the page Ronnie Silas.
However, the Ministry of the Interior (MUP) confirmed to Faktograf that “it does not collaborate with private agencies regarding the submission of reports or the return of investments”.
“If a page claims to cooperate with MUP, Europol, or Interpol, it is often a sign of impersonation or possible fraud”, they note.
Interpol also confirmed that these pages are fraudulent, and that “criminals often use Interpol’s name to try to legitimize their schemes”.
More than half of the Facebook pages we observed were created this year. In April, Croatia’s CERT warned citizens about such scams. Similar to the cases mentioned above, these scams operate through paid ads on social media, with fraudsters posing as a law firm specializing in recovering stolen funds for clients who have already been scammed.
“Clicking on the ad opens a pop-up window within Facebook offering free legal advice for fund recovery after filling out a form. A pre-filled form then appears with contact information that may be found on your Facebook profile – name, surname, email address, and phone number. They ask you to confirm that you lost money by investing in dubious projects and that you are an adult. After submitting the required information, a message appears: ‘WE HAVE RECEIVED YOUR APPLICATION! We will call you in 2 minutes, be ready’”, claims CERT’s description of the scam.
This description matches the ads that Faktograf encountered. They operate in the same manner, using form submissions.
How to protect yourself and what to do in case of fraud?
“Most people who fall victim to online trading scams believe they need to seek help from a lawyer or the police. Unfortunately, in these cases, neither a lawyer nor the police will be able to get your money back. The right address for recovering lost funds are specialized agencies that deal exclusively with recovery related to online trading”, states RefundFX on its website.
However, experts, as well as the police, disagree and advise reporting any fraud. In response to Faktograf’s inquiry, the Ministry of the Interior stated that every police station has specialized cybercrime officers.
“When filing a report, all available ‘evidence,’ such as correspondence during the commission of the fraud, should be attached. To determine the identity of the perpetrator, the police work with internet service providers, who are required to provide all available user and subscriber data about individuals or entities who have opened accounts on social networks or other user services to the police. The police use this information to determine the identity of the perpetrator”, MUP emphasized.
They advise citizens not to share their login credentials and passwords with anyone or enter them on suspicious websites. “If they have done so, they should immediately change the password associated with the account. If they use the same password for other accounts and online services, they should change those passwords immediately as well”, the police added.
The Personal Data Protection Agency (AZOP) highlighted similar advice in response to our inquiry and noted that they regularly organize webinars for interested citizens to educate them on personal data protection and online fraud.
As for prevention, there are several ways to recognize and protect yourself from fraud. The Canadian Investment Regulatory Organization (CIRO) advises the following: do not pay for recovery services in advance, especially if payment is requested via cryptocurrencies, gift cards, electronic transfers, or other cash-based payment methods. Cash and cryptocurrencies are difficult to trace and are therefore a primary means of internet fraud.
If scammers harass you with calls and messages, do not hesitate to hang up, ignore messages, or ask them to introduce themselves more thoroughly. Scammers can often obtain your personal information and debt details because such information can be bought and sold, but this does not mean that legitimate agencies are trying to help you recover your lost money.
There are multiple signs to recognize an investment scheme aimed solely at stealing your money. Scammers usually ask for your phone number or email address before you even see details about fees or a list of services that the so-called agencies offer. They also request payment of fees before providing any service. Additionally, the agency’s address is often outside Croatia, as is the case with RefundFX, which lists an address in Slovenia.
These alleged agencies typically do not provide a phone number and often ask you to communicate via apps like Telegram or WhatsApp. They also ask for your account’s IBAN for funds recovery, which scammers could easily use to withdraw money from your account. Emails, letters, and general communication with scammers often contain spelling and grammar mistakes, and the email address they use is usually from common services like Gmail or Yahoo rather than an organizational address. Photos, logos, and other organization symbols are often of poor quality and look as if they were copied from a document, highlights the CFTC.
If you suspect a website or receive suspicious calls, you can always contact the police, CARNET (Croatia’s Academic and Research Network), CERT, and AZOP, who will advise you. If you end up being scammed and money is stolen, in addition to reporting it to the police, be sure to contact your bank to prevent further transactions on your account. Recently, Faktograf contacted Privredna banka Zagreb while writing about scams through fake Facebook pages to clarify the steps clients should take if they become victims of fraud.
“If you suspect fraud or have sent your card information to someone, report your suspicions to the Bank immediately. In the case of an online fraud report, the Bank will take preventive actions immediately to protect the client and conduct a detailed analysis of the transaction’s origin. After analyzing the incident, the Bank will take all necessary steps to prevent future damage and mitigate existing damage for the client in accordance with the specific case analysis”, explained the bank’s Public Relations Department.
Protecting your personal data and carefully choosing with whom to share it is very important. Misuse of personal data carries serious consequences, as it can be used to commit crimes such as signing fake contracts, an unlawful profit, accessing your medical records, which could then be publicly disclosed, and similar offences. The best thing to do with all types of fraud is to report it to the police and other relevant services, regardless of the amount lost.
In conclusion, the page RefundFX is part of a recovery scam in which fraudsters lure victims (who have already been scammed before) into another fraud by combining real and useful information with their deceptive services.
