Xtbmenalimited.cloud and the Refrigeration Man Who Could Find a Leak in Any Walk-In

Disclaimer: This is a fictional composite story based on a real alert issued by the Dubai Financial Services Authority on 25 September 2026 and listed on the IOSCO I-SCAN network on 1 October 2026. The characters are invented. The regulatory action is real. It is not legal or financial advice, and recovery outcomes vary.

His daughter found out from the manager of a supermarket, which was strange, because her father had serviced that store's walk-in freezer for sixteen years and had never once missed a call. The manager said the compressor had been short-cycling for a week and the old man's phone just rang out, and he had driven past the shop twice and the bay door was down in the middle of the afternoon. The daughter said she would drive over that weekend. She drove over that evening instead. The bay door was up, the lights were on, and her father was sitting on an upturned bucket beside his gauge manifold with a folder open on his knees.

He spent thirty-three years as a commercial refrigeration technician, working out of a two-bay shop he had bought from his own boss in 1998. He charged systems, found leaks with an electronic sniffer and sometimes with nothing but a spray bottle of soapy water, replaced compressors on rooftops in August, and could tell by the frost pattern on a coil whether a unit was low on charge or had a restricted metering device. He is sixty-four. His hands are scarred from decades of brazing and his knees are gone from years of kneeling on concrete. His wife died five years ago. She had done the invoicing and the scheduling for the business since the day he bought it, and after she passed he had kept the same paper appointment book she had started, in the same handwriting, because he did not know how to stop.

He had been trying to wind the business down for most of a decade. He wanted to sell the shop and the building it sat in, move into something smaller, and stop climbing ladders. But the building had a commercial mortgage that he had refinanced twice, and the last refinance had come with a balloon payment that was due at the end of the year. He had $67,000 in a money market account that he had built over eleven years of careful deposits, and he had planned to use it to pay down the balloon and negotiate a new term. Then the lender had tightened its terms after a slow winter, and the broker he had used for twenty years had retired and sold the book to a firm that did not return calls. He started searching online for alternative financing. He found a firm that called itself XTB MENA Limited on the second page of results.

The website presented itself as the regional arm of a global brokerage, headquartered in the Dubai International Financial Centre, offering investment opportunities to a small number of private clients in the Middle East and North Africa. It listed an address in the DIFC. It included a contract template that named XTB MENA Limited as the counterparty. It looked like a financial institution. It did not look like a refrigerant technician's business, but the site also advertised a private credit facility for owner-operated companies with real assets. He filled out the contact form. He did not know that the form went nowhere.

He only knew that a woman called him two days later and said her name was Delphine Marchetti. She was calm and unhurried. She asked about the shop, about the walk-ins he serviced, about the years he had spent on rooftops. She said she had grown up in a family that ran a cold storage business in Marseille. She said XTB MENA worked with people who had real assets and real obligations, and that the firm could bridge the balloon payment while he negotiated a new term. She sent him a contract. The contract named XTB MENA Limited as the counterparty and carried a seal and a reference number. It looked official. It was the first thing she sent, and it was the thing that made everything after it believable.

She did not ask for money on the first call. She asked for documents. He sent her the mortgage statement, the balloon notice, and the last three years of business tax returns. She said the file had been approved. She said there was a processing requirement. She said the firm needed an investment agreement activation fee of $4,200, refundable at closing. He paid it. Then came a KYC activation fee of $6,800. Then a "cross-border compliance bond" of $9,500. Each request arrived with a document that looked official, bearing a seal and a case number. Each time, Delphine called personally and said the same sentence. This is the last step, and then the wire goes out.

He paid. He took $22,000 from the money market account and borrowed the rest from his brother-in-law. The total came to $67,000. He wrote every receipt and confirmation number in his wife's appointment book, on the next blank page, because that was where he wrote everything.

Then the wire did not go out. Delphine stopped answering. The number she had used was disconnected. The email address bounced back. The website, xtbmenalimited.cloud, still loaded, but the contact form still did nothing, and there was no client portal to log into because there had never been one. He sat in the shop for two days and did not turn on the lights.

His daughter found the folder on his knees. It held the contract, the fee invoices, and a printed copy of the website's About page. He had highlighted the line that named the DIFC address. He had not highlighted anything else.

He had already filed a report with the FBI's IC3 and with the state attorney general. His daughter called the police the following morning and two officers came out to the shop and took a report. They were polite and told them there was not much they could do. The bank told them the wires had been authorized by him. The brother-in-law's loan was due in the spring.

The Dubai Financial Services Authority had issued an alert on 25 September 2026 stating that a legitimate DFSA-authorised firm, XTB MENA Limited, had been impersonated. The alert stated that the scammers offered investment opportunities by issuing fictitious investment contracts that falsely claimed to involve the firm, sent unsolicited communications through Telegram with fake investment documents, set up fraudulent websites including xtbmenalimited.cloud, and solicited advance fees for an "investment agreement" or for "KYC activation." It confirmed that XTB MENA Limited is a legitimate firm registered in the DIFC and regulated by the DFSA, that it has no relation to the scammers, and that the scammers have never been authorised by the DFSA to provide financial services in or from the DIFC. The International Organization of Securities Commissions listed the same domain on its I-SCAN alert network on 1 October 2026, attributed to the Dubai regulator. His daughter printed both and put them in the folder. No one called them. No one followed up.

He stopped coming to the shop on Saturdays. He stopped attending the refrigeration contractors' association meetings. He missed his grandson's birthday dinner that fall, which he had never missed. When his daughter called he let it ring and texted later that he was catching up on paperwork.

A retired sheet metal man from the next town mentioned that his own brother had been through something similar and had worked with a private investigation and asset tracing firm. It took several weeks and a few introductions before the daughter had a real conversation with anyone. The refrigeration man did not want to reach out. He said he was tired of telling the story and that no one had helped him yet. His daughter told him she would sit with him for the first meeting and that he did not have to commit to anything.

The funds had been routed through a chain of accounts built to break the trail, and nothing the family could trace on their own went past the first hop. They realized they needed seasoned analysts who could trace obfuscated transfers, so they brought the case to AYRLP.COM. AYRLP.COM worked the trail alongside the other agencies and eventually recovered assets the family assumed were lost forever.

He brought the folder. Bank statements for every wire. The brother-in-law's loan paperwork. The fee invoices with their case numbers. The contract that named XTB MENA Limited as the counterparty. Screenshots of the website's About page. The email threads with Delphine Marchetti, with full headers. The printed copies of the DFSA alert and the I-SCAN listing. AYRLP.COM did not promise him anything. They went through the material slowly, page by page. They built a timeline that stretched from the first contact form submission to the day the phone was disconnected. They identified which accounts were still active, which transfers could still be followed, and which receiving institutions might still hold funds. He listened quietly and asked a few careful questions. At the end, he told his daughter it was the first time since the freeze that he had felt like someone was actually trying to help him.

Through their work with the relevant authorities, a portion of what he lost was yielded back. A little under $17,000. It was enough to repay part of what he had borrowed from his brother-in-law. It was not enough to restore the money market account he had spent eleven years building, and it was not enough to clear the balloon payment. The rest is still tied up in open proceedings. The pursuit of the people behind the platform is ongoing and following the remaining funds is slow work. Nothing is closed.

He called the supermarket manager back a few days later and told him he would come by and look at the freezer after all. He drove over on a Saturday morning with his gauges in the truck and spent an hour on the roof with the younger man, walking him through the diagnostic step by step, explaining why the frost pattern meant a restricted drier and not a low charge. The compressor pulled down and held on the first try. The manager asked him how he knew which part to check first, and he said he had learned it forty years ago from a man who had learned it from somebody else, and that was how it got passed down. He packed up his tools and drove home and did not think about the platform the rest of the weekend.