When it has already happened

I have already signed, paid or lost access

Full

The situation

Something has already happened. You signed, you paid, you granted access, or you can no longer reach an account, a register, or a system. You may not yet know which description is right. More than one can be right.

The decision at stake

Which paths apply, what dates are actually written down, what you already hold, who you will contact on a channel you found yourself, and which remedy you could use rather than only name. The output is a resolution brief to take to your own lawyer.

Reported

A fee to release a package that was never a DFSA process

On 21 September 2026 the DFSA warned that scammers were impersonating it. They claimed it held a box of money and gold, demanded 11.1 percent so the package could leave the country, posed as a fictitious Compliance Department officer, sent AI-generated images, and pressed a deadline. The DFSA says do not respond and do not send money. If you have already sent money, it says contact your bank and the relevant police authority immediately, and report the correspondence through the DFSA complaints function. The alert does not tell you to freeze every other payment the company makes.

Regulatory21 September 2026

DFSA impersonated in an advance-fee scam · Dubai Financial Services Authority

The DFSA says scammers impersonate it, claim it holds a box of money and gold, demand 11.1 percent so the package can leave the country, pose as a fictitious Compliance Department officer, send AI-generated images, and pressure a deadline. It says do not respond and do not send money, report correspondence through the DFSA complaints function, and if you have already sent money, contact your bank and the relevant police authority immediately. The page does not say to freeze every payment.

Reported

A second fee, offered as recovery

Investor.gov, checked on 14 October 2026, describes advance-fee fraud and a reload pattern: people who already lost money are asked to pay again to recover or unlock funds, sometimes by someone impersonating a regulator. A recovery pitch is a reason to verify the sender. It is not a plan.

RegulatoryChecked 14 October 2026

Advance fee fraud · U.S. Securities and Exchange Commission, Investor.gov

The page describes frauds that ask for a fee up front to receive proceeds, such as a fee, a tax, a commission, a validation fee, or repayment of a margin loan. It also describes a reload scam: prior victims, sometimes approached by someone impersonating a government regulator, are asked to pay more to recover or unlock funds. It is a US page, not a ruling on UAE facts.

Evidence used on this page

Each label is a kind of source, not a grade. A regulator’s alert is not a finding about your payment.

Regulatory21 September 2026
DFSA impersonated in an advance-fee scam · Dubai Financial Services Authority
The DFSA says scammers impersonate it, claim it holds a box of money and gold, demand 11.1 percent so the package can leave the country, pose as a fictitious Compliance Department officer, send AI-generated images, and pressure a deadline. It says do not respond and do not send money, report correspondence through the DFSA complaints function, and if you have already sent money, contact your bank and the relevant police authority immediately. The page does not say to freeze every payment.
RegulatoryChecked 14 October 2026
Advance fee fraud · U.S. Securities and Exchange Commission, Investor.gov
The page describes frauds that ask for a fee up front to receive proceeds, such as a fee, a tax, a commission, a validation fee, or repayment of a margin loan. It also describes a reload scam: prior victims, sometimes approached by someone impersonating a government regulator, are asked to pay more to recover or unlock funds. It is a US page, not a ruling on UAE facts.
RegulatoryChecked 14 October 2026
Commissioner of Data Protection: FAQs and glossary · DIFC
On personal data breaches, the FAQ points to Articles 41 and 42 of DIFC Data Protection Law 2020. Notify the Commissioner as soon as practicable in the circumstances if the breach compromises confidentiality, security, or privacy. Communicate to the individual as soon as practicable if the risk is high, and promptly if there is an immediate risk of damage. This is not a blanket 72-hour rule. The FAQ says it is not legal advice and the Commissioner does not warrant accuracy for a particular firm. A direct request was rate-limited; a second fetch returned the FAQ text.
RegulatoryChecked 14 October 2026
Data breach notifications · ADGM Office of Data Protection
Under Article 32 of the ADGM Data Protection Regulations 2021, a Data Controller must notify the Office of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware. The page describes a Data Controller as an ADGM registered entity that determines the purposes and means of processing. It does not set a 72-hour clock for every UAE startup.
RegulatoryChecked 14 October 2026
AML, CTF and sanctions compliance: summary · Dubai Financial Services Authority
The supervisory regime applies to Authorised Firms other than a Credit Rating Agency, Authorised Market Institutions, DNFBPs, and Registered Auditors, collectively Relevant Persons. Raising equity does not by itself make a startup a Relevant Person.
RegulatoryUpdated 11 August 2026
UAE law on bankruptcy · UAE government portal, u.ae
The portal describes Federal Decree-Law No. 51 of 2023. Article 3, as returned by a second fetch of the legislation portal after a direct request was blocked, applies to companies subject to the Commercial Companies Law, a natural person with the capacity of a trader, and a licensed civil company of a professional nature. It does not apply to government companies whose own documents set special rules, free-zone companies that follow special rules, Central Bank licensed banks, financial institutions and insurers under separate laws, or personal, family, and consumption debts including a home. The same u.ae page also says the law does not apply to natural individuals, which is broader than the trader limb. Follow Article 3 and ask counsel. This site does not recommend a jurisdiction.
Regulatory16 March 2026
Fortis Advisors LLC v. Krafton, Inc. · Court of Chancery of Delaware
C.A. No. 2025-0805-LWW, Vice Chancellor Will. Submitted 9 January 2026, decided 16 March 2026. The opinion was read for this pass. Phase One entered judgment that Krafton breached the equity purchase agreement by terminating the key employees without valid cause and by seizing operational control of Unknown Worlds. The remedy is specific performance: Edward Gill is reinstated as CEO with operational authority, and the base earnout testing period is extended by 258 days to 15 September 2026. The opinion says whether Krafton’s actions wrongfully impaired the earnout, and whether any resulting money damages are owed, are reserved for the second phase. One Delaware dispute. Not a rule for other contracts, and not a current docket status.
RegulatoryChecked 14 October 2026
Mediation Service Centre · DIFC Courts
DIFC Courts describes a mediation service facilitated by its Panel of Mediators, and says the process is confidential. A Commercial Mediation Scheme with The Mediation Hub MENA runs from 1 July to 31 December 2026 and offers eligible users a complimentary one-hour conflict management consultation and a 50 percent reduction in administration fees if they proceed. The page does not say mediation is the cheapest route, or that a result can be enforced in a particular case. This site does not recommend it.

The brief

Name what has already happened, in facts. The five paths below stay visible together. Mark every one that applies. Do not collapse them into a single story before you have checked.

1.Your name
2.The company, if it exists
3.Who is on the other side, as you can currently identify them?
4.Date of this brief
5.What has already been signed, paid, or lost? Amounts, dates, and account names you can point to.

Urgent deadlines

Read the document for the date it writes. A scam often invents a deadline. A contract, a bank, a regulator, or a court may each have a different clock, and this page does not invent one. If you cannot find a date, write that, and ask counsel which clock, if any, has started.

1.Which dates can you point to in a document, a bank message you fetched yourself, or a regulator’s own page?
2.Which deadlines arrived only inside the suspicious message or the sales conversation?
3.What will you ask counsel about timing, and by when will you ask?

What you already hold

List what you already have: mail in your own inbox, contracts you signed, receipts, and statements you can download from a bank you bank with. Ask counsel before you copy someone else’s mailbox, a company system you no longer administer, or a device that is not yours. This section does not tell you to take those copies.

1.What do you already hold, and on what date did you save it?
2.What would you be copying from a system that is not yours, and have you asked counsel before doing it?
3.Have you kept this off public posts and group chats until counsel has read it?
Publishing an accusation is not preservation.
YesNot yetNoUnsure

The bank, on a channel you found

The DFSA alert of 21 September 2026 says that if you have already sent money in that impersonation, contact your bank and the relevant police authority immediately, and report the correspondence through the DFSA complaints function. Open the bank’s number from the bank’s own site or from a card you hold. Do not use a number that arrived inside the suspicious message. This is not an instruction to freeze every payment the company makes.

1.Have you taken the bank’s number from the bank’s own site or from a card you already hold?
YesNot yetNoUnsure
2.What did you ask the bank, and what did they say they can see?
3.If money was sent in an impersonation, which police authority, and have you used the DFSA complaints function for the correspondence?

A recovery service

Investor.gov describes a reload scam: prior victims are asked to pay a further fee to recover or unlock funds, sometimes by someone impersonating a government regulator. Advance-fee frauds on that page include a fee, a tax, a commission, a validation fee, or repayment of a margin loan, demanded up front. The page was checked on 14 October 2026. It is a US regulator’s description. Someone offering to get the money back for a fee is a reason to stop and verify them, not a recovery plan.

1.Has anyone asked for a further fee to recover, release, validate, or unlock funds?
Yes, this appliesNoUnsure
2.Who asked, how they proved who they are, and which channel you used that they did not supply?

What exists, and what you can use

A remedy that exists on a page is not a remedy you can run. Write the clause, the forum, or the complaints route that exists. Then write the cost, the time, the evidence you already hold, and who must act. Do not publish an accusation in place of either list. In Fortis Advisors LLC v. Krafton, Inc., the 16 March 2026 phase-one opinion found an operational-control breach and ordered restoration of the CEO’s authority. It reserved whether the earnout was wrongfully impaired, and whether money damages are owed. Do not treat those reserved issues as decided. DIFC Courts publishes a mediation service, including a scheme from 1 July to 31 December 2026. That is a route to evaluate. It is not a finding that mediation is cheaper, suitable, or enforceable for you.

1.What remedy does a document, a statute you were shown, or a regulator’s own page actually name?
2.What would it cost, how long would it take, what evidence do you already hold, and who must act before you could use it?
3.Have you kept those two answers separate?
Yes, this appliesNoUnsure

Path: suspected payment fraud

Use this path when the doubt is whether the payment request was genuine. It can sit beside the other paths. It does not require you to freeze unrelated payments or to name a culprit in public.

1.Does suspected payment fraud apply?
Yes, this appliesNoUnsure
2.What was paid, to which account name, on which date, and what was promised in return?
3.Who will you contact next, using a channel you found yourself?

Path: account compromise

Use this path when you cannot reach mail, a bank, a domain, a cap table, or an admin console that you recently could. Lost access is not, by itself, proof of who took it.

1.Does a compromise of access apply?
Yes, this appliesNoUnsure
2.Which accounts can you still open, and which can you not?
3.Which bank signatory or admin can still act, and have you reached them on a channel you trust?

Path: the contract is not being performed

Use this path when a real document exists and the other side is not doing what it says. Keep it separate from a doubt about whether the person was real. Both can be true.

1.Does contractual non-performance apply?
Yes, this appliesNoUnsure
2.Which clause, which date, and what has not been done?
3.Does the document require a notice before you do anything else, and have you asked counsel about sending one?

Path: ownership or control

Use this path when people disagree about shares, seats, votes, bank mandates, or admin rights. Name the document you believe is current. Do not announce a winner while two versions are unread.

1.Does an ownership or control dispute apply?
Yes, this appliesNoUnsure
2.Which register, minute, consent, or mandate does each side rely on?
3.Which of those documents do you believe is current, and why?

Path: possible inability to pay debts

Use this path when the company may not be able to pay what it owes. UAE federal bankruptcy has exclusions. The inserts below state them. This page does not recommend a jurisdiction or a filing. Ask a lawyer whether any process applies to this entity and this debt.

Jurisdiction inserts

Each insert names an entity, an activity, a source date, and the facts that change the answer. None of them recommends a jurisdiction, a court, or a filing.

DIFC Commissioner of Data Protection

A personal data breach under Articles 41 and 42 of DIFC Data Protection Law 2020, where the breach compromises confidentiality, security, or privacy.

Notify the Commissioner as soon as practicable in the circumstances. Communicate to the individual as soon as practicable if the risk is high, and promptly if there is an immediate risk of damage. The FAQ says it is not legal advice and does not warrant accuracy for a particular firm.

What would change the answer. Whether DIFC data protection law applies to this entity and this processing, and whether the breach compromises confidentiality, security, or privacy. This is not a blanket 72-hour rule.

Regulatory Commissioner of Data Protection: FAQs and glossary FAQ checked 14 October 2026. A direct request was rate-limited. A second fetch returned the FAQ text.

ADGM Office of Data Protection

A personal data breach by a Data Controller under Article 32 of the ADGM Data Protection Regulations 2021. The page describes a Data Controller as an ADGM registered entity that determines the purposes and means of processing.

Notify without undue delay and, where feasible, not later than 72 hours after becoming aware.

What would change the answer. Whether the entity is an ADGM Data Controller, and whether notice within 72 hours is feasible. The 72 hours are not a clock for every UAE startup.

Regulatory Data breach notifications Page checked 14 October 2026.

Dubai Financial Services Authority

Anti-money laundering, counter-terrorist financing, and sanctions compliance.

The supervisory regime applies to Authorised Firms other than a Credit Rating Agency, Authorised Market Institutions, DNFBPs, and Registered Auditors. The page calls these Relevant Persons.

What would change the answer. Whether this entity is a Relevant Person. Raising equity does not by itself put a startup inside the AML module.

Regulatory AML, CTF and sanctions compliance: summary Summary page checked 14 October 2026.

UAE federal bankruptcy, Federal Decree-Law No. 51 of 2023, Article 3

A possible inability to pay debts, and whether a federal process is even in scope.

Article 3 applies to companies subject to the Commercial Companies Law, a natural person with the capacity of a trader, and a licensed civil company of a professional nature. It does not apply to government companies whose own laws or documents set special settlement or bankruptcy rules, free-zone companies and businesses that follow their own special rules, banks, financial institutions and insurance companies licensed by the Central Bank and governed by separate laws, or personal, family, and consumption debts, including a home for personal or family residence. The u.ae page also says the law does not apply to natural individuals. That sentence is broader than the trader limb in Article 3. Ask counsel which sentence governs, and follow Article 3.

What would change the answer. The legal form, whether a free zone has its own rules, whether a person has the capacity of a trader, and whether the debt is personal, family, or consumption. Nothing here recommends a jurisdiction or a process.

Regulatory UAE law on bankruptcy u.ae page updated 11 August 2026 and checked 14 October 2026. The legislation portal blocked a direct request. A second fetch returned Article 3.

1.Does a possible inability to pay debts apply?
Yes, this appliesNoUnsure
2.What is the legal form, and is any debt personal, family, or a home?
3.Which lawyer will you ask whether a process even applies?

This week

End with a short list you can do without a public statement, without a blanket freeze, and without copying systems you do not control. The rest waits for the lawyer named above.

1.What will you do in the next few days, in order?
2.What will you not do until counsel has answered: a further payment, a public post, a copy of someone else’s system, a promise to staff?

Saved on this device.

Open your record