Scammer/Service: TorWex
Website: torwex.com
Transaction/Application ID: 43226
Amount: 15,000 RUB
Date: September 2, 2026
Exchange direction: YooMoney RUB → UAH

Summary

I am creating this scam accusation because TorWex received my payment of 15,000 RUB, confirmed my application as “paid”, required me to complete an additional card verification, and then failed to complete the exchange or return my money.

Afterwards, TorWex changed the application status to “Customer refused payment”, although I never refused payment and never cancelled the transaction.

On September 5, TorWex's security department refused to return my money, accused me of using a supposedly forged card image, and threatened to publish my personal information and correspondence.

I have preserved evidence documenting the entire sequence.

Chronology
September 2, 2026 — application and payment

I created application No. 43226 on TorWex for an exchange of 15,000 RUB.

At 18:12, TorWex sent me an email confirming that the application had been created and showing the status as “New.”

At 18:14, I made the payment of 15,000 RUB via YooMoney, using the payment details provided by TorWex.

After making the payment, I clicked the “I paid” button on the TorWex website and uploaded the YooMoney payment receipt.

At 18:14, TorWex itself sent me an email stating:

“Application status: Paid.”

Therefore, TorWex's own system and email confirmation recorded that the application had been paid.

Contact with TorWex

At 18:26, I contacted TorWex through their chat and asked how long the processing would take and when I should expect the funds.

At 18:27, the TorWex operator asked me to send the payment receipt.

I sent the receipt both in the chat and additionally by email.

After that, the operator stopped responding.

Card verification

At approximately 18:35, the application status changed to:

“Application under verification.”

TorWex required me to verify my card.

Their own instructions stated that:

the first 6 digits and the last 4 digits of the card had to be visible;
the remaining card details could be covered;
a monitor, phone or tablet showing the TorWex website and my application number had to be visible in the background.

I followed these instructions and provided the requested photograph.

I did not provide my PIN, banking password or security code. The card number itself was already part of the exchange/payment information available to TorWex.

Status changed to “Customer refused payment”

Despite all of the above, TorWex later changed the application status to:

“Customer refused payment.”

I never refused payment.

I had already paid the 15,000 RUB, confirmed the payment through their website, provided the receipt, communicated with their operator and completed the additional verification requested by TorWex.

September 5 — cancellation allegedly made by me

On September 5, 2026 at 16:53, the application page showed:

“Application status: Customer refused payment.”

and:

“The application was cancelled by the user.”

I did not cancel the application.

This is particularly concerning because TorWex had previously recorded the same application as “Paid.”

Refusal to return the money

On September 5, TorWex's security department sent me a message stating that:

no funds would be paid or returned;
my communications were allegedly being treated as evidence of attempted financial fraud;
they accused me of using a supposedly “forged” card image;
they claimed that materials had been sent to the security departments of YooMoney and the recipient's bank, as well as to cyber police.

I strongly dispute these accusations.

The photograph of the card was provided only because TorWex itself required this verification and supplied the instructions for taking the photograph.

Threats to publish my personal information

The same security message also stated that TorWex intended to publish my personal information on forums and monitoring websites.

They specifically mentioned information such as:

my full name;
YooMoney and bank card details;
IP addresses;
screenshots of our correspondence.

They also stated that the correspondence and other materials had allegedly been forwarded to financial institutions and law enforcement.

I consider these statements to be intimidation and threats, particularly because TorWex is refusing to return the 15,000 RUB that it received from me.

Important contradiction

There is a clear contradiction in TorWex's own records:

18:14 — TorWex: “Application status: Paid.”

Later:

“Customer refused payment.”

And on September 5 at 16:53:

“The application was cancelled by the user.”

I did not cancel the application and did not refuse payment.

I paid the requested amount and followed the additional verification procedure required by TorWex.

Evidence available

I have evidence documenting the transaction, including:

TorWex email confirming creation of application No. 43226.
YooMoney payment receipt for 15,000 RUB.
TorWex email from 18:14 confirming “Application status: Paid.”
YooMoney support confirmation that the transfer was completed.
Transaction/reference number provided by YooMoney support.
TorWex chat correspondence from 18:26–18:27.
The payment receipt sent to TorWex in the chat and by email.
TorWex's card-verification instructions.
The photograph submitted in accordance with those instructions.
The application status showing “Customer refused payment.”
The application page showing the September 5, 2026 status change at 16:53 and stating that the application was allegedly cancelled by the user.
The September 5 security department message refusing to return the funds and containing accusations and threats.

I will provide screenshots with sensitive financial information appropriately redacted.

What I am asking for

I am asking TorWex to:

Return my 15,000 RUB.
Explain why the application was first marked “Paid” and later changed to “Customer refused payment.”
Explain why the system states that I cancelled the application when I did not do so.
Provide evidence supporting their accusation that my card photograph was allegedly forged.
Explain the legal and factual basis for their threats to publish my personal information and correspondence.

Until these questions are answered and my funds are returned, I strongly advise other users to exercise extreme caution before sending money to this service.

I am publishing this thread so that the facts and evidence surrounding transaction No. 43226 are publicly documented and so that other users can make an informed decision before using TorWex.

**Evidence #1 — TorWex created application #43226**

On September 2, 2026, at 18:12:26, TorWex created application **#43226** for **15,000 RUB** (YooMoney RUB → UAH).

The screenshot shows the application status as **“New”** at the time it was created.

**Screenshot:**


This establishes the exact application number, amount, direction and creation time. I will provide further evidence showing that the application was subsequently marked as **“Paid”** by TorWex.

**Evidence #2 — YooMoney payment receipt**

On September 2, 2026, at approximately 18:14, I made the payment of **15,000 RUB** using the YooMoney payment details provided by TorWex for application **#43226**.

The screenshot below shows the YooMoney payment receipt confirming the transaction.

**Payment amount:** 15,000 RUB
**Application:** #43226
**Payment date:** September 2, 2026

**Screenshot:**


This payment was made using the payment details provided by TorWex. I did not cancel or refuse the payment.

The next piece of evidence shows that TorWex itself subsequently confirmed the application as **“Paid.”**

**Evidence #3 — TorWex confirmed the application as “Paid”**

Shortly after I made the payment, TorWex itself confirmed that application **#43226** had been paid.

The email from TorWex, sent on **September 2, 2026 at 18:14**, explicitly shows:

**“Application status: Paid”**

The email also identifies the same application **#43226**, the exchange amount of **15,000 RUB**, and the corresponding transaction details.

**Screenshot:**


This is important because TorWex later claimed that I had **“refused payment”** and that the application had been **cancelled by the user**.

I did not refuse or cancel the application.

At this point, TorWex had both received my payment and confirmed the application as **Paid**.

**Evidence #4 — TorWex required card verification**

At **18:35 on September 2, 2026**, TorWex changed application **#43226** to:

**“Application under verification”**

TorWex stated that I needed to verify my card before the exchange could be completed.

Their own instructions explicitly required a photo of the card showing the **first 6 and last 4 digits**, with the remaining card details covered. They also required the TorWex website and the application number to be visible in the background.

I followed these instructions and provided the requested card verification photo.

**Screenshot:**


This is important because TorWex later accused me of providing a **“falsified” card photo**, even though the photo was provided specifically because **TorWex itself required this verification procedure**.

**Evidence #5 — I provided the card verification photo as requested**

After TorWex requested card verification, I followed their instructions and provided the requested photo of my card.

The photo was submitted **only because TorWex explicitly required it as part of their verification procedure**.

As instructed by TorWex, the card photo showed the required identifying digits while sensitive card information was covered.

**Screenshot:**


This is relevant because TorWex later accused me of using a **“falsified” card photo**.

However, the photo was submitted in response to **their own verification request and according to their own instructions**.

**Evidence #6 — TorWex claimed that I cancelled the application**

Later, TorWex changed the status of application **#43226** to:

**“Customer refused payment”**

The application page also stated:

**“The application was cancelled by the user.”**

I did **not** refuse the payment and I did **not** cancel the application.

When I opened the application marked as cancelled, the details inside the application showed the same cancellation status.

**Screenshot 1 — application status:**


**Screenshot 2 — details inside the cancelled application:**


This is directly inconsistent with TorWex’s earlier confirmation that the application had been **“Paid”**, as shown in Evidence #3.

I am posting both screenshots to document exactly how the application was displayed after TorWex marked it as cancelled.

Thanks for creating the scam accusation. Those are bloody scammers and it's sad to know that you even sent them your sensitive data yet they even have no information regarding an operating licence on their website. A lot of red flags were discovered regarding the service earlier on when they made an announcement in the Exchange board. I am creating a  trust flag against their account and you are free to support the flag.

1. https://bitcointalk.org/index.php?action=trust;flag=3586

## Evidence #9 — TorWex Terms of Service and public disclosure of customer data

I checked TorWex’s current Terms of Service and could not find any general provision allowing TorWex to publicly disclose a customer’s personal data, bank card details, IP addresses, or private correspondence.

TorWex’s Terms contain a specific clause regarding information disclosure:

**Section 11.3** states that TorWex may provide information about an electronic currency transfer to law enforcement authorities, payment-system administrations, and victims of unlawful actions in cases of fraud proven by judicial authorities.

This is a specific provision concerning disclosure to specified parties. It does not state that TorWex may publicly publish a customer’s personal information or private correspondence.

The Terms also contain Section 11.4, which requires a customer to provide identity documents if fraud or money laundering is suspected.

This is particularly relevant because, after receiving my payment and requiring card verification, TorWex later threatened to publish my personal information, IP addresses, bank card details and correspondence.

I have found no separate Privacy Policy on the current TorWex website and no general confidentiality provision granting such a public-disclosure right.

There is also another important inconsistency.

TorWex’s own homepage currently states:

**“If something goes wrong, we will always return your money.”**

Their Terms also contain provisions concerning the return of funds when an exchange cannot be completed.

However, in my case, after receiving my 15,000 RUB payment, TorWex ultimately stated that the funds would neither be paid nor returned.

I am publishing this information so that other users can compare TorWex’s public promises and Terms of Service with what happened in my case.

Sources:

TorWex Terms of Service:
https://torwex.com/tos/

TorWex homepage:
https://torwex.com/

Application: #43226
Amount: 15,000 RUB
Date: September 2, 2026

Quote from: logfiles on September 06, 2026, 10:45:38 AM

Thanks for creating the scam accusation. Those are bloody scammers and it's sad to know that you even sent them your sensitive data yet they even have no information regarding an operating licence on their website. A lot of red flags were discovered regarding the service earlier on when they made an announcement in the Exchange board. I am creating a  trust flag against their account and you are free to support the flag.

1. https://bitcointalk.org/index.php?action=trust;flag=3586

Flag supported.

OP why would you use this site?

It is a "selective scam" operation by TorWex

Scammers often follow up with "fees" to "unlock" the funds or "cancel" the investigation. Any further communication or payments will only result in further losses. Their threat to "publish your information" is certainly a bluff designed to silence you.

I'm very sorry that you have found yourself in such a situation. I translated (with AI) some of the screenshots you posted (https://postimg.cc/LgDqLHRB

The Russian-language text (the content of the image) reads as follows:

"Notice: The results of handwriting analysis and electronic tracking (IP addresses, chat logs, credentials) have been fully prepared for submission to the relevant authorities. If the aforementioned posts on platforms such as Bits.media, Crypto.ru, and others are not deleted, further proceedings will be initiated. To confirm the attempted [offense], the cardholder's information, IP address, and the complete set of financial documents will be forwarded to the Cybercrime Police Department"

⚠️ Important warning: This text is typical of an online extortion scheme (scam/phishing), often targeting cryptocurrency users. Such messages are sent by scammers to intimidate you and pressure you into deleting your comments or transferring money. No legitimate "handwriting analyses" or "cybercrime police" procedures work this way. I recommend ignoring the message, not clicking any links, and not providing your personal information.

This looks like a scam intended to frighten you. The screenshot shows that your browser is displaying a warning https://postimg.cc/2L4GDfCP Their status on VirusTotal does not appear to be very trustworthy https://www.virustotal.com/gui/url/04b1288c89facec4c1a2e5b8451f5c537b9a7eb7662117ab1b6627bf3162f9dc

I will publish your story on my website to help bring more attention to it. I hope TorWex will eventually return your money to you.

Quote from: Arhad on September 06, 2026, 01:17:58 PM

This looks like a scam intended to frighten you. The screenshot shows that your browser is displaying a warning https://postimg.cc/2L4GDfCP Their status on VirusTotal does not appear to be very trustworthy https://www.virustotal.com/gui/url/04b1288c89facec4c1a2e5b8451f5c537b9a7eb7662117ab1b6627bf3162f9dc

This actually gives me an Idea. OP if you can, please report them to metamask as a scam/phishing domain so users get a warning as soon as they attempt to visit the website once the metamask folks add it to their blacklist. Almost all the browser and some extensions (metamask wallet,coinbase wallet, phantom wallet) use the same blacklist of scam/phishing websites

You will need a Github account which is not hard to create and then you will create/open an issue and add in some details about the scam in the report ---> https://github.com/MetaMask/eth-phishing-detect/issues

**Evidence #7 — TorWex threatened to report me and demanded removal of my reviews**

After I published complaints about my unresolved transaction, TorWex sent me a message from its Security Department.

In this message, TorWex accused me of:

* using a supposedly falsified card image;
* committing attempted financial fraud;
* and “reputational blackmail.”

TorWex then stated that if I did not delete my publications and reviews on forums and monitoring websites, it would initiate procedures including an appeal to the Cyber Police and provide them with what it described as a full package of evidence.

The message also states that TorWex had prepared a digital forensic examination and digital traces of the transaction for submission to the relevant authorities.

**Screenshots:**





I am posting the original message so that readers can see TorWex's own statements and decide for themselves.

I did not agree to remove my reviews or withdraw my complaints.

The next evidence shows TorWex's subsequent final decision regarding my 15,000 RUB payment.

**Evidence #8 — TorWex final security decision: funds will not be returned**

On September 5, 2026, at 17:33, TorWex sent what it described as its **“final decision of the Security Department”** regarding application **#43226**.

TorWex explicitly stated:

**“No funds will be paid or returned.”**

In the same message, TorWex accused me of attempting to obtain funds using allegedly falsified graphic materials and stated that it considered the matter an attempt at financial fraud.

TorWex also stated that it intended to publish my personal information, including my name, payment-card information, IP address and screenshots of our correspondence.

The message further claims that the full evidence package had been sent to the security departments of **YooMoney, the recipient bank and the Cyber Police Department**, and mentions possible account blocking and inclusion in fraud-related registries.

**Screenshot:**


This is TorWex's own written statement and is provided here so that readers can review their final position regarding application #43226.

I have not received my 15,000 RUB back.

Quote from: logfiles on September 06, 2026, 10:45:38 AM

Thanks for creating the scam accusation. Those are bloody scammers and it's sad to know that you even sent them your sensitive data yet they even have no information regarding an operating licence on their website. A lot of red flags were discovered regarding the service earlier on when they made an announcement in the Exchange board. I am creating a  trust flag against their account and you are free to support the flag.

1. https://bitcointalk.org/index.php?action=trust;flag=3586

Thank you very much for your support and for creating the Trust Flag. I’ve supported it.

I really appreciate your help and the warning to other users. Hopefully this will prevent others from losing money to this service.

Quote from: TorWex on September 08, 2026, 08:31:48 AM

Due to ongoing spam and slander on forums and monitoring sites (Bits.media, Bitcointalk, Crypto.ru, Pro-Change, Osobye.ru, etc.), we are publishing comprehensive information regarding application ID 43226.

1. Deanonymization of participants and exchange parameters:

Full name of applicant/recipient: Elena *** Kh***

Exchange direction: Russia (YuMoney) ➔ Ukraine (M***k)

Sender's details (YuMoney RF): 4100 *** 906

Recipient's details (Monobank UAH): 4441 *** 4182

Recorded IP addresses: O***, B***

2. Context of checks and fraud detection:

International transfers from Russia to Ukraine are subject to enhanced AML controls and financial monitoring. As part of a standard check for request ID 43226, the service requested confirmation of the transaction's legality.

In response, E.* Kh*** provided a falsified file—a graphically rendered photo of the recipient's card (M***k) 4441 *** 4182. Analysis confirmed the complete forgery: the digits of the card are flat, lack volume, highlights, and embossing, the lettering is distorted, and traces of abrasion on the original card are visible beneath the text. The client categorically refused to confirm her actual ownership of the sender's YuMoney account.

3. The refund and subsequent extortion:

As soon as the security service established the use of rendered documents and the lack of sender verification, the service canceled the request and issued a full refund to the sender's original YuMoney wallet (4100 *** 906).

However, after receiving a refund to the original account, E.* Kh*** resorted to outright blackmail: she demanded "repeat payments" and duplicated identical defamatory reviews on dozens of websites in an attempt to damage the service's reputation.

The service's actual obligations to the original sender have been fulfilled (the funds have been returned to YuMoney), and the attempt to obtain a repeat payment to a M***k card using Photoshopped graphics constitutes outright fraud. We ask the moderators to consider this user's actions as spam and extortion and to delete the fake messages. We are ready to provide the original files and refund receipts to the administration privately.

Since you have made my personal data public and have made a number of serious allegations against me, I demand documentary evidence supporting the statements you have published.

In particular, you are required to provide:

1. **Proof that the funds were actually refunded for application No. 43226** to the original YooMoney wallet: the date of the refund, the amount, the transaction/operation ID, and a document confirming that the transaction was actually made to wallet 4100 *** 906.

2. **Evidence supporting your claim that I refused to confirm ownership of the YooMoney wallet** — specifically, the relevant fragment of our correspondence, screenshot, or other material containing such a statement made by me.

3. **Evidence supporting your claim that I demanded a “repeat payment” after receiving a refund** — specifically, the relevant fragment of our correspondence on which this allegation is based.

4. **Documentary evidence supporting your claim that the M***k card photograph was falsified**, including the results of the analysis you allegedly conducted and the materials on which you based your conclusion that the photograph was forged.

5. **Evidence that the refund was actually made before I published my complaints and reviews.** If you claim that the funds were returned, a statement to that effect is insufficient. You must provide the transaction ID and other information allowing the fact and destination of the refund to be independently verified.

I also demand that you specify **the legal and other grounds on which my personal data was published publicly**, including my full name, payment details and IP addresses, together with public allegations of fraud, extortion and document falsification.

I draw your attention to the fact that in your published response, these allegations are presented as established facts rather than assumptions. Accordingly, they must be supported by documentary evidence.

I also note that OKCHANGER has already requested the transaction number confirming the refund. I expect this evidence to be provided as part of the ongoing review of this matter.

Until such evidence is provided, I consider the allegations you have published against me to be unsubstantiated.

Quote from: logfiles on September 06, 2026, 10:45:38 AM

Thanks for creating the scam accusation. Those are bloody scammers and it's sad to know that you even sent them your sensitive data yet they even have no information regarding an operating licence on their website. A lot of red flags were discovered regarding the service earlier on when they made an announcement in the Exchange board. I am creating a  trust flag against their account and you are free to support the flag.

1. https://bitcointalk.org/index.php?action=trust;flag=3586

Sorry to hear about OP’s loss. I have supported the flag you created after looking at the evidence provided by OP, which clearly shows that he was scammed and that TorWex was involved.

It’s worth mentioning that this appears to be a new platform that is only around 6 months old. So how can they claim to have a review dated 01/01/2024? [ARCHIVED] That would mean the review was posted two years before the platform was even launched.

WHOIS Information: [WHOIS] | [ARCHIVED]

Quote

Domain: torwex.com
Registered On: 2026-02-26
Expires On: 2027-02-26
Updated On: 2026-03-03
Registrar: NameSilo, LLC
Email: support@namesilo.com
Abuse Email: abuse@namesilo.com

Also, their News page shows an article dated 01/01/2024 at 00:00 titled "[Welcome!]". [ARCHIVED]

Quote from: logfiles on September 06, 2026, 01:32:34 PM

You will need a Github account which is not hard to create and then you will create/open an issue and add in some details about the scam in the report ---> https://github.com/MetaMask/eth-phishing-detect/issues

I volunteered to do it for OP and already submitted a ticket with a detailed report explaining what happened and asking them to add the domain to the blacklist. ---> Ticket #292002.

Update:

After I reported the issue to MetaMask via their GitHub account and gave details about what happened with OP, with enough evidence proving the fraudulent nature of this platform, MetaMask responded and chose to add the website to their blocklist.

Now, the warning is shown to all MetaMask wallet users, as well as users of other wallets, when they try to open the website.



I will also be submitting a report to NameSilo’s Abuse Department, as this platform seems to violate their policies and may fall under the category of fraudulent or scam websites.

I will wait for their response and keep you updated on everything I find out.