Fund Recovery Trap 2.0: How Nexora.Finance and PayBack Re-Victimize Scam Victims

A whistleblower report to Scam-Or Project describes how the supposed “fund recovery” operator Nexora.Finance and individuals claiming to work for a “Payback finance department” turned an existing bank-fraud victim into a repeat target. The result: more than €28,000 in additional losses, duplicate crypto payments allegedly caused by “blockchain errors,” and transfers routed through an Austrian P2P crypto dealer.

Regulators and law enforcement bodies have already issued alerts about these names or their wider networks – yet the scheme appears to continue operating.

Key Facts at a Glance

1. Whistleblower Narrative – A Textbook Recovery Scam

According to the whistleblower, the chain of events starts with a banking fraud in Germany and the Netherlands in July 2024, causing a loss of roughly €50,000. In the aftermath, the victim is approached first by Nexora.Finance and later by people purporting to represent “Payback.finance.”

Phase 1 – Nexora.Finance “Recovery Service”

• Nexora.Finance promises to recover the money lost in the bank fraud.
• The victim pays more than €20,000 in advance as “fees” for the recovery process.
• When crypto transfers allegedly encounter “technical problems” with XRP and ETF blockchain transactions, Nexora insists the victim must send the same amount again to complete or “unlock” the recovery.
• The supposed “recovered funds” are shown as being higher than the original loss, on the grounds that the earlier fraudsters had “invested and increased” the capital – a classic psychological tactic to justify additional payments and keep the victim engaged.

Phase 2 – PayBack Actors and an Austrian P2P Dealer

• The victim is informed that the recovered funds are now visible in an Exodus wallet.
• Two individuals, introduced as “Jordan Mitchell” and “Steve” from a “Payback.finance Department,” instruct the victim to send €8,511 to an Austrian P2P crypto dealer, Hans Klemen.
• When the transfer allegedly gets “rejected” in Exodus, the victim is told to repeat the exact same payment so that the funds can supposedly be unlocked on the blockchain.
• At this point, the victim finally terminates all contact.

The pattern described – high upfront fees, technical pretexts, duplicate payments, and routing money through third-party crypto dealers – is entirely consistent with how regulators and law-enforcement bodies define recovery fraud.

2. Nexora.Finance – Misused Identity and Aggressive Recovery Pitch

On its website, Nexora.Finance presents itself as a sophisticated “non-bank financial service provider,” offering crypto recovery and payment dispute resolution. The site showcases polished marketing statements, client testimonials, and claims of “cutting-edge technology” to trace and recover lost crypto (Source: nexora.finance).

CSSF: Clear Warning About Misuse of Nexora’s Identity

The Luxembourg regulator CSSF has issued a public warning that:

• The activities conducted via www.nexora.finance constitute fraudulent behaviour by persons misusing the name of Nexora SARL-S.
• The website lists an office address at 37A, Avenue Kennedy, Luxembourg, while the genuine Nexora SARL-S is based at 466, Route de Longwy and is not involved in these activities.
• This highlights a classic case of corporate identity theft designed to mislead victims and regulators.

In addition, there is a NEXORA FINANCE LIMITED registered in the UK (Wakefield address). However, there is no public evidence that this UK entity is connected to the website or the misuse of the Luxembourg company’s identity, further complicating the picture for victims seeking clarity (Source: UK Companies House).

Additional Red Flags Around Nexora.Finance

• On public Q&A platforms, individuals ask whether Nexora Finance is legitimate after receiving unsolicited offers to “recover your scam losses,” indicating proactive targeting of vulnerable victims (Source: JustAnswer).
• On Trustpilot, Nexora-related pages contain mixed feedback, including explicit accusations that Nexora is a scam, mention of substantial upfront fees, and visible frustration from customers, with little meaningful engagement from the company (Source: uk.trustpilot).

From Scam-Or Project’s perspective, any operation trading under Nexora.Finance and selling “fund recovery” services should be considered a high-risk recovery scam, given the regulator’s wording and the detailed loss scenario described by the whistleblower.

3. PayBack – From “Recovery Brand” to Enforcement Target

The PayBack brand (including Payback.com, Payback Ltd and various “Payback-recovery” domains and clones) markets itself as a global specialist in recovering funds from online scams. Its sites promote “investigation reports” and “crypto tracing reports,” explicitly claiming not to provide financial services and instead charging case-based fees.

Contrasting Picture from Regulators and Law Enforcement

• The FBI San Diego office seized domains belonging to Payback LTD, MyChargeBack, and Claim Justice as part of a crypto recovery fraud investigation. According to the seizure documentation, these businesses charged substantial upfront fees and commissions while having no verifiable track record of successfully returning funds to victims.
• ASIC and its consumer portal MoneySmart warn that payback-recovery.com impersonates regulatory bodies using fake documents and offers fraudulent “money recovery” services to scam victims.
• The FCA and BaFin list PayBack-linked entities (e.g., PayBack LTD / Money Back Ltd) as unauthorised clone firms targeting victims of investment fraud.
• Consumer-protection advocates and investigative projects, including Scam-Or Project, document extensive complaints from victims about PayBack-style recovery approaches and highlight recurring patterns of fake success stories and fee-driven pressure tactics.

Given this regulatory and enforcement background, any contact from people claiming to act on behalf of “Payback” or a “Payback finance department” should be treated as a major red flag – especially when they demand upfront crypto payments routed via P2P dealers, precisely as described in the whistleblower case.

4. The Nexora–PayBack Pipeline: Turning One Victim into Many

The whistleblower’s experience suggests at least a functional connection, if not direct coordination, between Nexora.Finance and individuals claiming to be PayBack staff:

1. Monetising the initial fraud
   Nexora first capitalises on the original bank fraud by charging more than €20,000 in “recovery” and “technical” fees.
2. Creating the illusion of success
   The supposed “recovered” funds are displayed as crypto in an Exodus wallet, suggesting that the victim’s money has been retrieved and even increased.
3. Introducing PayBack-branded “helpers”
   PayBack-linked actors then appear, offering to “release” or “unblock” these crypto funds – but only if the victim sends new money via an Austrian P2P crypto dealer, under the false claim that the blockchain requires a repeated, identical transaction to unblock the funds.

Compliance and AML Perspective

From a compliance and anti-money-laundering point of view, this model:

• Recycles victims through consecutive frauds, resulting in double or triple victimisation.
• Channels money through opaque P2P crypto dealers and multiple bank accounts, a typical layering pattern in AML risk analysis.
• Leverages pseudo-professional branding (“crypto tracing,” “investigation reports,” “non-bank financial services”) to create the appearance of legitimacy.

A key question remains: How many more victims are currently being passed through this Nexora–PayBack pipeline worldwide?

Scam-Or Project Warning and Call for Information

Scam-Or Project strongly warns consumers and investors not to engage with Nexora.Finance or any PayBack-branded recovery operation that:

• demands upfront payments or “fees,”
• requires crypto transfers, or
• pressures you to send repeated “unlock” payments to supposedly free funds on a blockchain or in a wallet.

If You Have Already Paid These Entities

• Stop all further payments immediately.
• Preserve all evidence: contracts, emails, chat logs (WhatsApp, Telegram, etc.), screenshots, invoices, and payment confirmations.
• File formal complaints with your local police and your national financial regulator. Where relevant, refer to:
• the CSSF warning concerning the misuse of the Nexora SARL-S name, and
• the FBI/ASIC/FCA/BaFin measures relating to PayBack-type recovery schemes.

Call to Victims, Insiders, and Intermediaries

Scam-Or Project is actively investigating the international network connected to Nexora.Finance, PayBack LTD, and associated P2P crypto dealers.

If you:

• have ever worked for these companies or their subcontractors,
• have processed payments or crypto transfers on their behalf, or
• have been approached or harmed by similar “fund recovery” offers,

please send your information, documents, and screenshots confidentially via the Scam-Or Project whistleblower section.

Your evidence can help map this network and prevent other victims from being defrauded a second – or even a third – time.