A FinTelegram whistleblower describes how the alleged “fund recovery” specialist Nexora.Finance and individuals claiming to act from the “Payback finance department” turned an existing bank-fraud victim into a serial target: more than €28,000 in new losses, double payments “because of blockchain errors,” and crypto routed via an Austrian P2P dealer. Regulators and law enforcement already flag both names or their networks – yet the machinery keeps running.
Key Facts At A Glance
- Whistleblower loss to Nexora.Finance: >€20,000 in “upfront fees” for promised recovery of funds lost in a German/Netherlands bank scam; pressured to repeat the same transfer due to alleged “technical issues with XRP and ETF crypto.”
- Whistleblower loss to Payback side: €8,511 to individuals identifying themselves as “Jordan Mitchell” and “Steve” from the “Payback.finance department”; money routed via Austrian P2P crypto dealer Hans Klemen with the classic “send the same amount again to unlock your crypto” pressure tactic.
- CSSF warning: Luxembourg regulator CSSF explicitly warns about fraudulent activities by unknown persons misusing the name of Nexora SARL-S, via website www.nexora.finance, and stresses that the real Nexora SARL-S is not involved (Source: CSSF).
- Global law-enforcement focus on PayBack network: The FBI has seized web domains of Payback LTD as part of a cryptocurrency recovery fraud investigation, describing a pattern of high promises, upfront fees, and no real recovery (Source: Federal Bureau of Investigation).
- Regulatory & watchdog alerts: Multiple regulators (FCA, BaFin, ASIC) and NGOs like EFRI and FinTelegram have warned that PayBack-branded “recovery services” and clones target fraud victims with new scams (Sources: FinTelegram, FCA, BaFin, ASIC).
1. What the Whistleblower Describes – A Classic Recovery-Scam Pattern
According to the victim, the story begins with a bank scam in Germany and the Netherlands in July 2024, resulting in a loss of around €50,000. In the aftermath, the victim is contacted by Nexora.Finance and later by people claiming to act for “Payback.finance.”
- Phase 1 – Nexora.Finance:
- Nexora promises to recover the bank-scam losses.
- The victim pays over €20,000 up front.
- When crypto transfers allegedly run into “technical XRP and ETF blockchain issues,” Nexora demands the same transfer again, claiming this is needed to complete or “unlock” the recovery.
- The “recovered funds” are presented as even higher than the original loss, allegedly because the original scammers had “invested and grown” the funds – a classic psychological hook to keep the victim paying.
- Phase 2 – Payback side & Austrian P2P dealer:
- The victim is told that recovered funds are now sitting in an Exodus wallet.
- Two individuals, “Jordan Mitchell” and “Steve,” present themselves as part of a “Payback.finance Department” and instruct the victim to send €8,511 to an Austrian P2P crypto dealer, Hans Klemen.
- When the transfer is “rejected” in Exodus, the victim is told to repeat the exact same payment to unlock the funds on the blockchain – another very typical “double payment to unlock” trick.
- At this point, the victim finally cuts contact.
Everything about this sequence – upfront fees, technical excuses, doubling payments, routing money via third-party crypto dealers – matches what regulators and law enforcement describe as recovery fraud.
2. Nexora.Finance – Identity Theft & Recovery Pitch
On its website, Nexora.Finance presents itself as a polished “non-bank financial service” offering crypto-recovery and payment resolution with glowing testimonials and claims of “cutting-edge technology” to recover lost crypto (Source: nexora.finance)
But Luxembourg’s CSSF pulls the emergency brake:
- The CSSF explicitly labels the operation as “fraudulent activities by persons misusing the name of Nexora SARL-S.”
- It identifies www.nexora.finance as the website used, with an alleged office at 37A, Avenue Kennedy, Luxembourg, and clarifies that the real Nexora SARL-S, based at 466, Route de Longwy, has nothing to do with these activities.
There is also a NEXORA FINANCE LIMITED registered in the UK (Wakefield address), but there is no public evidence linking this UK company to the website or to the Luxembourg identity theft – adding to the confusion for victims (Source: UK Companies House).
Additional red flags:
- Public Q&A platforms show people asking whether Nexora Finance is legitimate after cold approaches about “recovering your scam losses,” indicating pro-active targeting of victims (Source: JustAnswer).
- Trustpilot pages show a mix of reviews, including negative reports describing Nexora as a scam and complaining about upfront fees, with little or no visible engagement from the company (Source: uk.trustpilot).
In FinTelegram’s view, any operation trading under Nexora.Finance and pitching “fund recovery” must be treated as a high-risk recovery scam, especially given the CSSF’s explicit language and the whistleblower’s loss scenario.
3. PayBack – From “Fund Recovery” Brand to Law-Enforcement Target
The PayBack brand (Payback.com, Payback Ltd, various “Payback-recovery” domains and clones) presents itself as a global scam-recovery specialist. Its websites sell “investigation reports” and “crypto tracing reports,” stating that they “do not engage in financial services” and charge case-based fees (Source: Payback, Payback)
However, regulators and law enforcement tell a different story:
- The FBI San Diego office seized domains of Payback LTD, MyChargeBack, and Claim Justice in a cryptocurrency recovery fraud investigation, stating that these companies charged significant upfront fees and commissions while having no real record of successfully recovering funds.
- ASIC and MoneySmart warn about payback-recovery.com impersonating regulators with fake documents and offering money-recovery services to scam victims.
- The FCA and BaFin flag PayBack LTD / Money Back Ltd as part of a clone-firm setup that preys on victims of investment fraud.
- The European Funds Recovery Initiative (EFRI) explicitly urges victims to “strictly avoid recovery scammers especially Payback Ltd,” documenting a long pattern of complaints from victims.
- FinTelegram has already published a detailed warning about the PayBack fund recovery scam, including references to directors and beneficial owners and to unlicensed activities in multiple jurisdictions.
Against this background, any contact from people claiming to act for “Payback” or a “Payback finance department” should ring alarm bells, particularly when they ask for upfront crypto payments via P2P dealers – exactly what our whistleblower describes.
4. The Nexora–PayBack Connection: A Serial-Victim Business Model
The whistleblower’s case suggests an operational link or at least a coordinated flow between Nexora.Finance and individuals claiming to be Payback staff:
- Nexora first monetises the original bank fraud by charging a large upfront “recovery” fee (>€20,000).
- Funds allegedly recovered are shown as crypto in an Exodus wallet, creating the illusion of success.
- Payback-branded actors then step in to “help release” these crypto funds – but only if the victim sends fresh money via a local P2P crypto dealer (Austria), with the classic “repeat the identical transaction to unlock the blockchain” lie.
From a compliance perspective, this model:
- Recycles victims from one scam to the next (“double or triple victimisation”).
- Uses opaque third-party P2P dealers and bank accounts – typical layering behaviour from an AML point of view.
- Leverages recovery-industry branding (“crypto tracing,” “investigation report”) to create a veneer of legitimacy.
The question practically asks itself: How many more victims are being circulated through this Nexora–PayBack pipeline right now?
FinTelegram Warning & Call for Information
FinTelegram strongly warns consumers and investors NOT to engage with Nexora.Finance or any PayBack-branded recovery offer that demands upfront payments, crypto transfers, or repeat “unlock” payments.
- If you have already paid such entities, do not send further money, keep all documents, emails, WhatsApp chats, and payment receipts.
- File complaints with your local police, financial regulator, and – where relevant – reference the CSSF warning on Nexora and the FBI/ASIC/FCA/BaFin actions on PayBack-type schemes.
🔎 Call to victims & insiders
FinTelegram is investigating the global network behind Nexora.Finance, PayBack LTD, and connected P2P dealers. If you:
- have worked for these entities,
- processed payments for them, or
- have been approached or harmed by similar “fund recovery” offers,
please share your information, documents, and screenshots confidentially via our whistleblower platform Whistle42. Your evidence can help expose this network and protect countless other victims from being scammed a second and third time.
