If you have received this offer, stop here. Do not sign the Letter of Intent or Term Sheet. Do not send money under any structure, including through an attorney trust account. Do not provide banking or account details. See "If You've Received This Offer" below for the full list.
- Entity named: H J Investment W.L.L. · CR 152603-1, Bahrain
- Identity claimed: Abdulaziz Hamad A Aljomaih — Managing Director & Chief Investment Officer
- Sending address: hamad@hjinvestmentsbh.com
- Determination: Advance fee fraud, via investor impersonation
- Confidence: High
- Status: Public research brief — part of the Fraud Watch series
An unsolicited email offering a USD 65 million secured lending facility is circulating under two names: HJ Investment W.L.L., a company registered in Bahrain, and Abdulaziz Hamad A Aljomaih, who is listed as that company's Managing Director and Chief Investment Officer. The email is sent from hamad@hjinvestmentsbh.com. Backgrounder assesses that this offer is almost certainly advance fee fraud: a scheme in which a large, dangled loan is never actually funded, and the real goal is to collect upfront costs from the target before disappearing.
The one line version, for anyone in a hurry: the company is real, and the named individual is real. Neither one, as far as this investigation can tell, is actually behind the emails.
That gap is the core finding of this brief, and it is likely investor impersonation: someone using a real company's name and a real person's identity to send fraudulent correspondence that neither of them controls.
The company. HJ Investment W.L.L. (Bahrain company registration CR 152603-1) is legally registered and active. But its own official registration lists no website at all, and neither does an independent Dun & Bradstreet profile for the same company. A firm with no online presence of its own has no business claiming the capacity to fund a $65 million facility.
The individual. Abdulaziz Hamad A Aljomaih is listed as a signatory on that same registration, so the name on the offer is genuine. But the email account sending the offer is not connected to him or to Bahrain: it traces, through public enrichment data, to a generic profile located in Pakistan, and shows several other identity inconsistencies detailed later in this brief.
The emails. The offer was sent from hamad@hjinvestmentsbh.com, the third in a rotating sequence of nearly identical domains — hjinvestmentwll.com, hjiwll.com, and hjinvestmentsbh.com — all registered anonymously under the company's name since June 2024.
Important. This brief is about the offer and the correspondence, not a legal finding against any individual. The match between the offer's named sender and HJ Investment W.L.L.'s listed signatory only confirms that the paperwork is real. It does not confirm who actually sent the email. Read against everything in this brief, including the rotating anonymously registered domains, the Pakistan linked sending account, and the missing web presence, this is likely investor impersonation: a real person's verifiable identity being used without his involvement, not that he is personally behind this offer. HJ Investment W.L.L. and the individuals named in its registration may themselves be victims, with their real, public paperwork copied by someone else to lend the approach credibility. See "What This Report Is Not Saying" at the end.
At a glance
- Offer assessed: Unsolicited USD 65 million secured lending facility, conditioned on the borrower paying upfront "external transaction-establishment costs"
- Determination: Advance fee fraud — most likely carried out through investor impersonation, not by the named company or individual themselves
- Confidence level: High
- The company: Real and active on Bahrain's Sijilat registry (CR 152603-1) — but its own registration and an independent Dun & Bradstreet profile both list no website
- The sending domain: hjinvestmentsbh.com — the third in a rotating sequence of nearly identical domains registered anonymously since June 2024
- If you received this offer: Stop engagement, send no money under any structure, and report it — see "If You've Received This Offer" below
Methodology: How We Know This
This brief is built entirely on open source intelligence, or OSINT: information anyone can find without special access, including public company registries, domain registration records, web archives, and commercially available account enrichment data. Nothing here required insider access to the sender's accounts, computer, or bank records. That is deliberate: a method the reader can retrace is more convincing than a conclusion they have to take on faith, and it is also what makes this reproducible if the same operator resurfaces under a new name.
- Start from what's public — the sender's email address and domain, taken from the offer itself.
- Verify the registry — check the claimed company against Bahrain's official Sijilat registry and an independent business database.
- Trace the domain — WHOIS history, registrar, creation date, privacy status, and any related domains under the same name.
- Enrich the identity — check the sending account against other platforms it's registered on: do the name and location line up?
- Cross check the pattern — compare the structure and language against regulator fraud alerts and known advance fee scam mechanics.
- Weigh it together — no single check is proof. The assessment rests on how the checks line up, or fail to, as a whole.
A note on limits: third party enrichment data (step 4) is compiled by commercial vendors from public and semi public sources. It is indicative rather than authoritative: it can be stale, mismatched, or affected by privacy tools. A domain registered recently (step 3) is, on its own, a weak signal, since plenty of legitimate small businesses use new domains. What makes an OSINT assessment reliable is convergence: several independent, imperfect signals pointing the same direction, cross checked against a documented fraud pattern rather than read in isolation.
A note on our language: where this brief states a judgment rather than a directly verified fact, it uses graded language rather than a single tone of confidence, drawn from a three tier scale — almost certainly, likely, and very unlikely — each used consistently for the same claim throughout. Directly verified facts, such as registration dates or public registry records, are stated plainly without hedging, because they are not judgments. Where the evidence available does not yet support even a low confidence judgment, this brief says so directly rather than assigning a probability it cannot support.
Technical Findings
1. How the ask is structured
The offer follows the classic shape of advance fee fraud. A large sum, USD 65 million, is offered to fund the acquisition of assets the borrower does not yet own. The original terms required an "Initial Performance Security" of 0.5 to 1 percent of the facility (USD 325,000 to 650,000) held by an unnamed "independent third party custodian." After the recipient questioned it, the sender reported having this deposit "removed" as a concession, and replaced it with responsibility for an open ended list of eight categories of "external transaction establishment costs" (KYC/AML checks, notarization, registration and filing, and similar), with no total given and no provider named for any of them.
"These are not a fee for the capital and are not a replacement for the Initial Performance Security." — From the offer email, August 8, 2026
2. Manipulation tactics in the correspondence
The emails lean on rapport and urgency rather than documentation. The sender repeatedly addresses the recipient as "my Brother" and appeals to his personal and professional standing. Decisions are attributed to an unnamed "Board" whose deliberations only the sender can report. A cautionary story about a previous "prospective business partner" who nearly lost assets is offered, unprompted, as a pressure narrative. A deadline is set, not by any external requirement, but by the sender's own travel plans. And diligence itself is discouraged: the recipient is told he is "entirely free" to verify things, immediately followed by a request not to lose momentum "through an endless exchange of individual concerns." None of this is proof by itself, but all of it is textbook.
3. The company is real, but has no online footprint
Bahrain's public commercial registry (Sijilat) confirms that H J INVESTMENT W.L.L., CR 152603-1, is a real, active company, registered March 14, 2022 and renewed annually since. Its paid up capital is BHD 5,000, roughly USD 13,300, and its registered activities are securities dealing for its own account, real estate, and management consultancy. It is not licensed with the Central Bank of Bahrain as a financing company, which is the category that would cover lending of this kind on a commercial basis.
Crucially, the official registration lists no website at all and neither does an independent Dun & Bradstreet corporate profile for the same company. A firm four years into its legal existence, now claiming the capacity to fund a $65 million facility, has no web presence in either its own government paperwork or an independent commercial data source.
The individual named as sender of the offer, Abdulaziz Hamad A Aljomaih, is himself listed as a signatory on this same registration. That is worth being precise about: it verifies the paperwork, not the sender. In the advance fee schemes regulators have documented, registration details check out because the operator copied them from a public record. The company name, the address, and even a real officer's name can all be genuine while only the email account is actually the fraudster's. Matching the name against the registry narrows the real question from does this company exist to who controls hamad@hjinvestmentsbh.com, and Findings 4 through 6 below point away from Bahrain.
4. Three domains, a rotating identity
The domain used in the offer email, hjinvestmentsbh.com, was created February 24, 2026, about five and a half months before the offer was sent. Further domain research turned up two earlier, related domains registered under the same company name:
- hjinvestmentwll.com — registered June 2024 — back online, showing generic content
- hjiwll.com — registered August 2025 — suspended, no longer resolves
- hjinvestmentsbh.com — registered February 2026 — active, used in the offer
- hamadaljomaih.com — registered March 2026 — live and resolving, not confirmed as a sending domain
Domain history for the HJ Investment name. The first three are registered through Namecheap with WHOIS privacy protection and no published registrant; hamadaljomaih.com uses a different registrar and is included as a related data point, not yet a confirmed part of the same rotation. Status current as of this brief's publication date and subject to change.
All three domains are registered through the same registrar, Namecheap, and all three use privacy protection that masks the registrant, so no registrant name is published for any of them. The naming pattern tracks the company's legal name directly (HJ Investment W.L.L.) before settling on a variant that adds a Bahrain reference. One identity, rebuilt three times in under two years.
hjiwll.com remains unreachable. hjinvestmentwll.com, reported suspended by its registrar as recently as September 1, 2026, is live again, now showing generic, template style investment firm marketing copy with no way to independently verify who operates it. We treat this as a further data point rather than a retraction. Infrastructure that goes dark and gets rebuilt with boilerplate content is likely disposable domains being cycled behind a real company's name, not a stable, ordinary business website. Domain status can change day to day, and readers checking this themselves may see a different snapshot than the one described here.
A fourth domain also turns up: hamadaljomaih.com, built from the sender's own name rather than the company's, and listed in the signature block of the offer email itself. Public registration records show it was registered on March 17, 2026 through Hostinger, a different registrar from the three domains above, on a standard one year term that runs to March 17, 2027. Those records show no activity since it was first registered, though that can simply be how some registrars display things by default rather than a sign of anything unusual on its own. What is notable is that the domain is live and resolving right now, as of this brief's September 14, 2026 publication date, according to public DNS lookup data. We have not yet looked into what the site itself shows or who runs it, and with only one domain and no reactivation history to compare, it is not yet possible to assess whether it fits the same pattern as the other three. It is worth a closer look.
5. The sender's account doesn't match the claimed identity
Third party enrichment data on hamad@hjinvestmentsbh.com, the account the offer was sent from, associates it with a generic profile name ("Hamad Hamad"), an account on the developer platform HackerEarth, and a location in Pakistan. None of that is consistent with the sender's claimed identity as a Bahrain based Saudi investment principal. The Microsoft account tied to the same address was created and used almost entirely within about 48 hours. A name-only search on the Arabic display name, حمد الجميه (Hamad Aljomaih), returned a single match: +966501144264, a Saudi Arabia number. This is a common name, so the match is not necessarily the same individual, and the country itself is a mismatch: the enrichment data above ties this identity to Bahrain, not Saudi Arabia, and the number appears on none of the sender's known accounts. It is included here as the one public lead tied to the Arabic name, not as a confirmed link. Given the country mismatch and its absence from any of the sender's known accounts, it is very unlikely that this number belongs to the same individual, and it remains a dead end rather than a confirmation. This enrichment data is compiled by commercial vendors from public and semi public sources and should be read as indicative, not conclusive, but it points the same direction as everything else in this brief.
6. A spelling inconsistency in the sender's own name
Bahrain's official registration spells the family name ending in the Arabic letter ح, giving "Aljomaih." The sending account's Arabic display name ends in ه instead, a variant that appears nowhere in the official record. On its own this proves little: it is very unlikely that this spelling variant reflects anything beyond a common transposition, since a display name is set by the user. Read alongside everything else, it is one more small inconsistency in a file that has accumulated several.
7. This matches a documented, named pattern
Financial regulators publish alerts describing exactly this mechanic: a real firm's genuine name, registered address, and licence or registration number used without permission, paired with a domain designed to look nearly identical to the real one, while the genuine firm has no connection to the outreach. The UAE's Dubai Financial Services Authority (DFSA) has issued several such alerts in 2026 alone, unrelated to this case, describing the same pattern: a real firm's identity used alongside a fraudulent domain to solicit funds.
One regulator alert we reviewed while researching this pattern, issued by the DFSA in 2016, happens to concern a similarly named firm, "Al Jomaih Investments Ltd." That is a different, unrelated company, impersonated in an unrelated case a decade earlier. We mention it only because anyone searching this name is likely to encounter it. It is not evidence about the offer described in this brief.
The broader pattern is what matters. In these schemes, the details a target would think to check, including company name, registered address, and registration number, are frequently genuine. What isn't genuine is control of the communication channel. That is precisely why a basic "does this company exist" check passes even when the offer itself is fraudulent, and why the digital footprint checks in this brief matter more than the registry check alone.
If You've Received This Offer
Cease engagement. Do not reply further, and do not sign or execute the Letter of Intent or the Indicative Term Sheet.
Send no money under any structure, including through an attorney trust account, for KYC/AML checks, due diligence, notarization, filing, registration, or any other "external cost" requested before funding. See the appendix below for the exact list of costs cited in the offer.
Provide no banking or account details. A step that asks you to "confirm" a receiving account is often itself the collection point.
Preserve the full correspondence, with original headers intact, and avoid forwarding it in a form that strips header data.
Report it. In the United States, the FBI's Internet Crime Complaint Center (ic3.gov) and the Federal Trade Commission (reportfraud.ftc.gov) both accept reports. A completed loss is not required to file. If the offer invokes a specific Bahraini company, Bahrain's Ministry of Industry and Commerce can also be notified.
Expect a follow up approach. Operators running advance fee schemes commonly contact a target again after a decline, under a different name or as a purported recovery service. If anyone else was copied on the offer, tell them directly that it is assessed as fraudulent.
What This Report Is Not Saying
This assessment is directed at the offer and the correspondence, not at any named individual. H J Investment W.L.L. is a real, active, legally registered Bahraini company, and Abdulaziz Hamad A Aljomaih, the name used to send the offer, does appear as a listed signatory on its official registration. That confirms the registration is genuine. It does not confirm that this individual wrote the email, controls hamad@hjinvestmentsbh.com, or has any connection to the domain activity described in this brief. The pattern regulators have documented in comparable cases, together with the totality of findings above, makes it likely that a real person's verifiable identity was taken from the public record rather than that he is personally operating this scheme. Backgrounder has not established authorship of the offer, and nothing in this brief should be read as a finding about the conduct of any specific named person. He, like the company itself, may well be a victim of this scheme rather than a party to it. Determinations of legal liability are matters for regulators, prosecutors, and courts, not for a security advisory.
About This Brief
Backgrounder is a company that uses AI to detect scams. This brief is part of an ongoing series examining unsolicited financial offers and the open source information techniques used to evaluate them, published for general awareness. It reflects research conducted through September 14, 2026, and, like any investigation tied to a single point in time, may not reflect developments after that date.
Sources: Commercial registration record for H J INVESTMENT W.L.L., CR 152603-1 (Government of Bahrain, Ministry of Industry and Commerce, Sijilat portal); Dun & Bradstreet corporate profile for H J Investment W.L.L.; domain registration records for hjinvestmentsbh.com, hjinvestmentwll.com, and hjiwll.com; ICANN, EPP Status Codes; DFSA public alerts on advance fee and impersonation scams, including "Al Jomaih Investments Ltd Impersonated in a Fraudulent Advance Fee Scam" (2016, dfsa.ae/alerts); Federal Trade Commission, "What To Know About Advance Fee Loans" (consumer.ftc.gov); FBI Internet Crime Complaint Center (ic3.gov) and FTC report portal (reportfraud.ftc.gov); and third party email enrichment and message header analysis, Backgrounder, August through September 2026.
Disclaimer: This brief is based on open source intelligence (OSINT): publicly available records, databases, and online sources, current as of the date above and subject to change. It does not constitute legal advice. Inclusion of a name or entity is not an allegation of criminal conduct by Backgrounder. Determinations of legal liability are matters for prosecutors and courts. Readers should independently verify critical details before acting on them.
Appendix: The Offer Email (Redacted)
The email below is the primary source for the offer described in this brief, reproduced in full. Only the recipient's name and email address have been removed to protect his privacy. The sender's name, email address, physical address, and the domains referenced in the signature are preserved exactly as sent.
From: حمد الجميه <hamad@hjinvestmentsbh.com> Date: August 8, 2026 at 7:21:04 PM GMT+2 To: [recipient email redacted] Subject: Re: Board Decision – Proposed USD 65 Million Secured Lending Facility
Dear [Recipient],
I hope you are keeping well, my Brother. Yes, there is progress and I am bringing you updated information on the process.
I wanted to write to you personally before sending across the documents because I have spent considerable time over the past several days going back and forth with the Board and our advisers to make this transaction as straightforward as possible for you.
I know you are anxious to move forward, and I am equally conscious of the time. As I mentioned, I will be travelling shortly for official commitments, and I would very much like to see us bring this transaction to a clear position before I leave. For that reason, I have kept this matter very much at the top of my list.
Let me first say something openly, Brother.
The Board's willingness to proceed with a USD 65 million Facility on the basis of assets that are YET TO BE acquired is not something they have treated lightly.
The assets forming the basis of the acquisition are not yet in your ownership today. Between the time the Facility is funded and the time the acquisitions are completed, there is naturally a period in which circumstances can change. We have unfortunately experienced this before. In one previous situation, a prospective business partner was only a week away from funding when the assets intended to support the transaction were unexpectedly lost to another party.
That experience has stayed with the Board.
So, while we want to move quickly with you and we understand the acquisition strategy you are pursuing, the Board naturally has to ask what protection exists during that period between funding and acquisition.
The reality is that USD 65 million would be leaving HJ Investment before the tangible assets that are intended to support the Facility have actually been acquired and secured.
That is a significant exposure.
And I want you to understand something important about the Board's position.
The willingness to consider that structure is itself a reflection of the confidence that has been built in you, your experience, your reputation and your credibility as a businessman, father, and a professional.
The Board is not making this decision simply because the numbers look attractive on paper. They are prepared to rely upon the person behind the transaction. That confidence has been built through our discussions, through the way you have presented the acquisition strategy, and through the relationship that has developed between us.
That is why I have been pushing this internally.
Regarding the 1% Initial Performance Security
You had quite rightly asked me what the 0.5%–1% Initial Performance Security was intended to achieve.
I took that question back to the Board.
The Board's original thinking was straightforward: if HJ Investment was preparing to commit USD 65 million while the underlying assets were still to be acquired, they wanted to see that the Borrower was also putting something meaningful at risk. The intention was for that amount to be placed with an independent third-party custodian, under agreed terms and outside the control of either party. It was never about HJ Investment taking possession of the money; it was simply about demonstrating that both sides had a genuine financial commitment to seeing the transaction through.
It was never intended to be a fee to HJ Investment, nor an annual charge, nor something from which we would commercially benefit.
The thinking was simply that both parties should have something at risk when entering into a transaction of this magnitude.
I explained to the Board, however, that we should not allow this point to become an unnecessary obstacle between us, particularly given the confidence that has developed and the fact that you are ready to move.
I am therefore pleased to tell you that I have managed to have the 0.5%–1% Initial Performance Security removed from the proposed structure.
I believe this makes the transaction considerably easier for you and demonstrates that we are genuinely trying to build a structure around the opportunity rather than create unnecessary burdens for you.
The Board's position is now that HJ Investment will handle its own internal legal, investment, Board and administrative costs.
The Borrower, however, will be responsible for the reasonable external transaction-establishment costs necessary to bring the Facility to Financial Close. These are not a fee for the capital and are not a replacement for the Initial Performance Security. They are simply the external costs required to establish and close the transaction properly.
These may include, as applicable:
- KYC and AML verification and clearance
- Corporate due diligence and verification
- External documentation and legal filing requirements
- Notarization and certification
- Authentication or apostille where required
- Registration and filing of the Facility or security
- Perfection and registration of the agreed security interests
- Other necessary third-party documentation or transaction administration directly related to Financial Close
I believe this is a much cleaner arrangement.
You are not being asked to place a large amount of capital into the transaction simply to demonstrate commitment. Instead, you are responsible for the reasonable external costs necessary to establish the transaction, while HJ Investment carries its own internal costs and, more importantly, commits the substantial capital required for the Facility.
The path forward
Brother, I want to make this as simple as possible for you.
Attached in my next mail are:
- The Letter of Intent – confirming HJ Investment's intention to proceed with the proposed Facility; and
- The Indicative Term Sheet – setting out the Board's proposed commercial structure and principal terms before the transaction moves into definitive legal documentation.
The purpose of sending these together is to allow you and your advisers to see the complete picture now, rather than spending weeks going back and forth over individual points.
Subject to your review and alignment, I would propose that we proceed in the following sequence:
- Finalization of Terms — we agree the commercial terms and principal structure reflected in the Term Sheet.
- Internal Legal Documentation — HJ Investment's legal advisers finalize the Facility Agreement, Security Agreement and other internal transaction documentation.
- External Documentation — the necessary external KYC/AML, due diligence, notarization, certification, registration, filing and security-perfection requirements are completed.
- Confirmation of Recipient Account — the designated receiving account for the Facility is independently confirmed and verified in accordance with our internal procedures.
- Financial Closing — once the agreed Conditions Precedent have been satisfied, the transaction proceeds to Financial Close and the Facility is released in accordance with the definitive Facility Agreement.
[Recipient], I genuinely believe we have reached a very good point here.
I have spent considerable time trying to remove the unnecessary friction from the original structure because I believe in the opportunity and, more importantly, I believe in the person leading it.
You have considerable experience, you understand transactions of this nature, and you have presented an acquisition strategy that the Board believes is commercially compelling. That is why we are prepared to consider deploying USD 65 million into a structure where the principal assets are still to be acquired.
I would not want that confidence to be misunderstood. It comes with responsibility on both sides, and I believe the structure we are now putting forward reflects that balance.
My Brother, I would like us to move quickly now. I will be travelling for official commitments no later than the 15th of this month, and I would very much like to see us finalize the commercial position and move the documentation forward before my departure.
If you and your advisers are comfortable with the proposed structure, let us proceed without unnecessary delay. I believe we have a very good opportunity here, and I would like to see us turn the understanding we have developed into a completed transaction.
Insha'Allah, I look forward to seeing this come together.
With my warmest regards,
Shukran
——
ABDULAZIZ HAMAD A ALJOMAIH (عبدالعزيز بن حمد بن عبدالعزيز الجميح)
Managing Director & Chief Investment Officer
HJ INVESTMENT W.L.L
Flat 328, Building 2648,
Road 5720, Block 257
AMWAJ,
Bahrain.
hjinvestmentsbh.com
hamadaljomaih.com
Long-term relationships. Long-term value.