Mark Buchanan - markbuch05@gmail.com

[firefly]

Posted on behalf of the victim:

Please let me know how this Kruzk online bank account works? Do they
steal money or is the money in this account real? I believe I have
been scammed by someone with this account and asked me to transfer
money out of this bank account
I have been in contact with the fraudster for 4 months.
Apparently, I was tricked by the fraudster and that email from bank that to be able to access his kruzkonline and make a money transfer to his supplier to order equipment for his work, he needed a TAX code and IMF code to be sent to his mobile number. These codes to be sent to him, he asked me to pay 2,580 USD and 21,130 USD on his behalf as instructed by the kruzkonline customer service email via the agent’s account. Do you think the fraudster and the customer service I have been exchanging emails are the same person?

I have contacted my bank and they tried to file a dispute to that bank already - awaiting for response. I have also reported this to police anti cybercrime unit.

Scammer details:

Email address used: markbuch05@gmail.com
Phonen umber used: +15595560168
Type: Non-Fixed VoIP (e.g. Skype or Google Voice)
Original carrier: New Cingular Wireless Pcs, Llc

Stolen pictures used:




Fake document used in scam:



Answering the questions:

That bank is a fake one. Their way of stealing money is done through a romance scam. A fraudster creates and online profile on a social / dating site and find the victim. After spending some time with the victim, he usually talks about his work abroad. Being a a foreign country he claims he cannot access his bank account and ask the victim to do it, giving the victim the login details to access his bank account. The scammer ask the victim to transfer money to her bank account and use the money to pay for a contract he cannot pay himself. The victim is directed to another fake character, playing the "bank employee", and asking the victim to pay a fee for getting the transfer done. After first payment, there will always be another fee.

The bank is fake. The fraudster bank account the victim sees is fake as well. The only real thing is the money the victim lose while paying fees for a transfer that will never happen. In most of the cases, the fraudster romancing the victim and the "agent" of the fake bank are the same person.

[firefly]

Chat log excerpts:

Scammer: You will send a mail on my behalf baby
I have the mail address in the message I got
Customercarl.kruzkbnk@fastservice.com
Ok baby send a mail on my behalf and include
my details Account name and number

Victim: Using my own email address?

Scammer: Yes because here I’m using Kuwait network and
the IP address will not reach the server
I can't access my bank server from here. All I
get is error access denied.
Been calling my bank and they say their server
doesn't work with connections in the rig
I just need to access my offshore account
I want you to give you my online details so you
login to my account. I have to make use of third
party

Victim: Hmm I don't think I can. I'm scared to access
anyone’s bank account

Scammer: I understand you baby, you don't have to worry,
I'm the one asking you to do it
It's my account and already I called my bank to
inform them since the can't open their server

[firefly]

Emails received from the fake bank:

On 6 Nov 2018, Customercarl.kruzkbnk@fastservice.com wrote:

OFFICIAL FUND TRANSFER NOTIFICATION
FROM KRUZK BANK REQUESTING TAX CODE
(TAX CODE)

Attention: Mark Buchanan

Dear Valued Customer

This is an official notification email to acknowledge your
request for release or transfer of fund via our internet/online
banking system.

Kindly note that the new Bank policres have been updated,
you need to update your income tax in our Bank Branch
nearest to you, if you are an international account holder
you need to pay an income tax of 0.2% of the total deposit
in your account to have your tax code sent to your
mobile (as registered in your account).

Be informed that this process is in line with Int‘L Remittance
Ammended Policies under article 198 of Sub-section 23 of
Paragraph 2 of The United Nations Banks Regulation Act,
which requires you to pay an income Tax for all
deposit made to your OFFSHORE ACCOUNT.

Thank you for your anticipated coperation

Yours in Service

Holly Marie Frazier
(CUSTOMER CARE SOLUTION CENTER)
Knuzx BANK

E-mail address customercar1.Kruzkbnk@fastservice.com is also reported here:
viewtopic.php?f=34&t=73319&p=180505#p180505

[firefly]

On 6 Nov 2018, Customercarl.kruzkbnk@fastservice.com wrote:

Please note this, offshore accounts are
international accounts governed by different
policies accross the globe and we as your
Beneficiary bank cannot make withdrawals
from your account,

We advice you forward your tax payment to
your account officer in USA, who will do the
tax clearance for you

Acc name: Chimmezirim O.
Acc num: 18120xxxx
Routing num: 08400xxxx
Bank name: First Tennessee Bank
Bank address: 1350 Broad St,
Chattanooga, TN 37402
Swift code: FTBMUS44
Acc address: xxxx
Chattanooga TN 37403 USA
Purpose of payment: Markxxx

[firefly]

Same fake bank asking for a second payment:

On 10 Nov 2018, Customercarl.kruzkbnk@fastservice.com wrote:

The Bank will start the processing of your IMF
registration / code once you pay 60% of your lMF
processing charges but note the IMF code will be
released to you on the completion of your IMF payment
Charge

Please note that the processing will start in Kuwait/Asia
where the money payment originated from before we
complete this in our Office in USA.

Submit to us a document of proof as regards your
business with Kuwait Petroleum

Directives of payment will be giving to you on your
request.

[firefly]

The fake bank used in scam claims to be Kruzk Bank. Contact details on the fake site:

Address
Head Office Address: 14-18 Copthall Ave, London EC2R 7BN, United Kingdom
Service email: customercar1.kruzkbnk@fastservice.com, support@kruzkonline.com
Telephone: +44 203 095 5876

+442030955876
Number billable as geographic number
Country or destination United Kingdom
Original network provider* Andrews & Arnold Ltd

For the fake site details: https://db.aa419.org/fakebanksview.php?key=135032

From the fake site details:

Domain name: kruzkonline.com
Updated Date: 2018-04-19
Creation Date: 2018-04-19
Registrar Registration Expiration Date: 2019-04-19
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Gianfranco Guerrato
Registrant Organization: arreda homes
Registrant Street: Rotonda Giacinto 556 Piano 6 Settimo Assia lido, 74507 Verona (RO)
Registrant City: Verona
Registrant State/Province: RO
Registrant Postal Code: 74507
Registrant Country: IT
Registrant Phone: +356.7146832820
Registrant Email: daragn1589@gmail.com

This is what the fake site looks like:

The faker maker creating this fake bank has other 38 domain names. 36 of those domain names are actively used in online fraud, while pretending to be banks or delivery companies. Details in viewtopic.php?f=17&t=73163.