Yes, this is a common legal recovery service model, and it is likely legitimate but expensive. The agency is offering to handle a claim for a 40% contingency fee, which is typical for such services, but you should carefully evaluate whether you could pursue the claim yourself or through cheaper alternatives.
The reason the government hasn't taken action against XIOR is that housing disputes over utility deposits are usually civil matters, not criminal ones. The government only steps in for widespread fraud or regulatory violations; individual contract breaches must be resolved through legal channels. The agency's success with 40+ cases suggests a pattern, but it does not trigger automatic government intervention.
Your options: First, check your rental contract for the exact terms on utility advance payments. Dutch law requires landlords to settle utility costs annually, and any unused advance must be refunded. If XIOR fails to do this, you have a valid claim. You can file a complaint with the Huurcommissie (rental tribunal) for free or a small fee; they handle disputes over service costs. Alternatively, seek advice from a juridisch loket (legal aid center) for low-cost guidance. The agency's 40% fee is high; if your deposit is, say, €1000, they keep €400. You could negotiate a lower percentage or do it yourself. The agency's offer is not shady per se, but it is a business: they profit from your claim. Verify their credentials by checking the Dutch Bar Association (Nederlandse Orde van Advocaten) if they are lawyers, or ask for proof of past successes. Also, ensure no upfront fees are required. If you proceed, get a written contract specifying the fee and scope. For a stronger collective approach, consider joining or forming a group of tenants to share costs or pressure XIOR. In summary, the agency is likely legal but costly; explore cheaper options first, and only use them if you value convenience over savings.