civistadirect.com - impersonating Civista Bank Ohio

[firefly]

Posted on the behalf of the victim.

The victim received an email regarding an inheritance. The so called bank contacting him was supposedly located in Ohio, United States. They were asking for copies of the victim's identity documents and, after receiving those documents, they asked the victim to pay for the High Value Alert Clearance (HVAC) Certificate.

The scammer is impersonating Civista Bank, using also the name of the bank president in the emails sent to the victim.

The phone number the scammer provided is an Internet phone number and is not used by any of the real bank subsidiaries.

+14199759095
Owner supposedly based in Sandusky, OH
VoIP - Bandwidth SMSEnabled

The real bank activity started in 1884 in the US under the name First Citizens Banc Corp. The financial institution is using the name Civista Bank since January 2015.

The fake bank is using a site registered online in October 2015. The site is registered by someone from India - is a site without content and the scammers are using it only for the email address.

Domain Name: CIVISTADIRECT.COM
Registry Domain ID: 1965282597_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: http://www.publicdomainregistry.com
Updated Date: 2015-12-01T02:34:39Z
Creation Date: 2015-10-01T18:16:37Z
Registrar Registration Expiration Date: 2016-10-01T18:16:37Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Bryan David
Registrant Organization: Aggrawal Safe
Registrant Street: Plot No. 25, Palam Vihar Extension
Registrant City: Palam Vihar
Registrant State/Province: Goa
Registrant Postal Code: 122002
Registrant Country: IN
Registrant Phone: +91.1141136527
Registrant Email: bryanmdavid@hotmail.com

The same person registered another fake sites impersonating the same bank:

civistadirectonline.com

Domain Name: CIVISTADIRECTONLINE.COM
Registry Domain ID: 1965282598_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: http://www.publicdomainregistry.com
Updated Date: 2015-12-01T02:34:39Z
Creation Date: 2015-10-01T18:16:37Z
Registrar Registration Expiration Date: 2016-10-01T18:16:37Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Bryan David
Registrant Organization: Aggrawal Safe
Registrant Street: Plot No. 25, Palam Vihar Extension
Registrant City: Palam Vihar
Registrant State/Province: Goa
Registrant Postal Code: 122002
Registrant Country: IN
Registrant Phone: +91.1141136527
Registrant Email: bryanmdavid@hotmail.com

He is also the registrant for a1expresspost.com:

Domain Name: A1EXPRESSPOST.COM
Registry Domain ID: 1965282596_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: http://www.publicdomainregistry.com
Updated Date: 2015-12-01T02:34:39Z
Creation Date: 2015-10-01T18:16:37Z
Registrar Registration Expiration Date: 2016-10-01T18:16:37Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Bryan David
Registrant Organization: Aggrawal Safe
Registrant Street: Plot No. 25, Palam Vihar Extension
Registrant City: Palam Vihar
Registrant State/Province: Goa
Registrant Postal Code: 122002
Registrant Country: IN
Registrant Phone: +91.1141136527
Registrant Email: bryanmdavid@hotmail.com

[firefly]

Emails:

From: Civista Bank <info@civistabank.com>
Date: Saturday, April 9, 2016
Subject: CLARIFYING YOUR DOUBTS!!

Civista Bank
100 E. Water Street,
Sandusky, Ohio 44870
United States.

Dated: April 8, 2016
Ref: CB/FDA/000228017815

Contact Person:
Mr. Dennis G. Shaffer,
Tel: +1 (419) 975-9095


Attn. Sir
(Mr. xxx)

CLARIFYING YOUR DOUBTS!!



The Civista Bank is the banking subsidiary of Civista Bancshares, Inc., a financial holding company with assets of approximately $1.4 billion headquartered in Sandusky, Ohio. Clarifying your doubts on our existing domains, civistabank.com and civistadirect.com are both managed by this financial institution. The civistadirect.com is an operational domain for international email services on special matters like deceased customer’s Unclaimed Deposits and cross-border transactions as your case while civistabank.com is that on our official website meant for special administrative and company related matters; business, mortgage and wealth management customers services. Our Branches are located throughout Champaign, Crawford, Erie, Franklin, Huron, Logan, Madison, Montgomery Ottawa, Richland and Summit counties and a loan production office is in Cuyahoga County.

We also want to use this medium to inform you that your rights and security are 100% guaranteed now a nd in the near future because you are dealing with the right financial institution just as we’re focused on serving you better.

N.B: Do not reply to this email as matters related to deceased customer’s Unclaimed Deposit will remain unattended to base on the aforementioned reasons. All correspondence relating to your case should be properly addressed and forwarded to civistadirect.com for prompt response.

We appreciate your choice of banking with Civista Bank as we're focused on serving you better.

Yours sincerely,
Civista Bank





Disclaimer Notice: Information contained in this email is confidential & intended for the addresses only. Any dissemination, distribution, copying or use of this communication without prior permission from the address is strictly prohibited. If you are not the intended recipient of this communication, please delete it permanently without copying, disclosing or otherwise using its contents, and notify the (Civista Bank) immediately.

[firefly]

Money request:

From: Civista Bank <info@civistadirect.com>
Date: Saturday, April 9, 2016
Subject: GUARANTEE LETTER RECEIVED!!

Civista Bank
100 E. Water Street,
Sandusky, Ohio 44870
United States.

Dated: April 8, 2016
Ref: CB/FDA/000228017815

Contact Person:
Mr. Dennis G. Shaffer,
Tel: +1 (419) 975-9095

Attn. Sir
(Mr. XXX)


GUARANTEE LETTER RECEIVED!!

This is to bring to your attention that we have received your guarantee letter assuring this management that you will not fail to make the payment for the High Value Alert Clearance (HVAC) certificate on or before April 30th, 2016 unfailingly. However, once you comply with your financial obligation, we will on this date 04/30/2016 terminate the application of the newly introduced beneficiary whom was assumed to be introduced by you.

We regret any inconvenience this might have caused you as our previous action to accept the High Value Alert Clearance (HVAC) procurement payment from the newly introduced beneficiary was based on your incessant procrastination to comply to your financial obligation towards the payment for the High Value Alert Clearance (HVAC) certificate.

Final payment details of our correspondence will be released upon your signifying interest to comply with your financial obligation before the dead line date as your last chance. And failure to do so, this financial institution will no longer accept to receive the High Value Alert Clearance (HVAC) procurement payment through our correspondence but rather will like to have you come down to our head office here in the United States with your attorney for further acquaintances as regards your claim.

N.B: Please check in all your mail folders as a mail has been offically dispatched from civistabank.com as requested by you but further communication on your transaction will be best attended to here to avoid any dismay.

We appreciate your choice of banking with Civista Bank as we're focused on serving you better.

Yours sincerely,
Civista Bank



Disclaimer Notice: Information contained in this email is confidential & intended for the addresses only. Any dissemination, distribution, copying or use of this communication without prior permission from the address is strictly prohibited. If you are not the intended recipient of this communication, please delete it permanently without copying, disclosing or otherwise using its contents, and notify the (Civista Bank) immediately.

[firefly]

Email:

From: Civista Bank <info@civistadirect.com>
Date: Tuesday, April 12, 2016
Subject: CIVISTA BANK BOARD OF DIRECTORS DECISION

Civista Bank
100 E. Water Street,
Sandusky, Ohio 44870,
United States of America.

Dated: April 11, 2016
Ref: CB/FDA/000228017815

Contact Person:
Mr. Dennis G. Shaffer,
Tel: (419) 975-9095




Attn. Sir,
(Mr. xxx)


CIVISTA BANK BOARD OF DIRECTORS DECISION

On behalf of the Civista Bank management, we thank your for your recent mail and further wish to acquaint you of the recent decision of the Board of Directors of Civista after a brief meeting following your piffle queries to this financial institution that we could no longer condone. In view of this, we also want to make it clear that the evolvement of the newly introduced beneficiary to the fund of our deceased customer whom you earlier stand as his legal heirs has created so much doubt by this financial institution.

Therefore, Civista Bank been a reputable financial institution would not tolerate or entertain piffle queries from you as a beneficiary to the fund of our deceased customer and we expect a measure of respect from you by complying to our financial regulations and standards.
Based on the above stated reasons, the recommendations of the United States Financial Crimes Enforcement Network (FinCEN) has it that you MUST be present here at our office due to your insubordination to our status before the release of your fund by a Pay Oder can take effect so that we can equitably carry out an enhance due customer diligence and risk assessment for applicable suspicious activity report in order to ascertain your directly related to our deceased customer whom you stand as the legal heirs to his real estate.

As much as we require your present here at our head office, all the HARD copies not SOFT/PHOTO copies of the originals & legal documents proving your directly related to our deceased customer should be brought along to enable us handle your transaction Sternly.

N.B: Before departing from xxx (victim country) to the United States for this claim purpose, we admonish you to send via email copies of your traveling documents; International Passport (data & visa pages) and Flight Ticket respectively, to intimating us of your departure & arriving date to the United States of America for an effective claim process.

We await your urgent response to this important mail as your response would help us serve you better.

We appreciate your choice of banking with Civista Bank as we’re focused on serving you better.

Yours Sincerely,
Civista Bank




Disclaimer Notice: Information contained in this email is confidential & intended for the addresses only. Any dissemination, distribution, copying or use of this communication without prior permission from the address is strictly prohibited. If you are not the intended recipient of this communication, please delete it permanently without copying, disclosing or otherwise using its contents, and notify the (Civista Bank) immediately.

[firefly]

Because the victim asked too many questions, trying to see if the allegedly bank is real or not, the scammer decided to change the game blaming and threatening the victim:

Email:

From: Civista Bank <info@civistadirect.com>
Date: Wednesday, April 13, 2016
Subject: THE IMPLICATIONS OF NOT COMPLYING TO OUR TERMS AND CONDITIONS

Civista Bank
100 E. Water Street,
Sandusky, Ohio 44870

Dated: April 12, 2016
Ref: CB/FDA/000228017815

Contact Person:
Mr. Dennis G. Shaffer,
Phone: (419) 975-9095



Attn:
(Mr. xxx)


THE IMPLICATIONS OF NOT COMPLYING TO OUR TERMS AND CONDITIONS

It has been observed that you the officially made legal beneficiary to our deceased customer does not want to comply to our instructions. Therefore, as a financial institution, we want to implement extreme measures to curb the situation.

Your failure in adhering to our instructions laid out already which is visiting the United States of America at our head office with all the hard copy und documents has questioned your eligibility as the legal beneficiary to the fund of our deceased customer who was the original depositor of the fund you are laying claims to.

In line with the stringent policies laid out by the U.S government guiding us on matters such as this, we are sending our VERIFICATION team which is from the Ohio Police Department (OPD) to your home address which is in our record for further scrutiny and verification and as such your utmost co-operation will be highly needed as any attempt or hitch by you to stop the verification process will be translated into a punishable offense under law.

Furthermore, we would need you to tender the original hard copies of all the documents you have forwarded to this management regarding your claim by mail to the verification team upon their arrival at your home address.

We appreciate your choice of banking with Civista Bank as we're focused on serving you better.

Yours sincerely,
Civista Bank



Disclaimer Notice: Information contained in this email is confidential & intended for the addresses only. Any dissemination, distribution, copying or use of this communication without prior permission from the address is strictly prohibited. If you are not the intended recipient of this communication, please delete it permanently without copying, disclosing or otherwise using its contents, and notify the (Civista Bank) immediately.

[firefly]

From: Civista Bank <info@civistadirect.com>
Date: Saturday, April 16, 2016
Subject: PAYMENT FOR HVAC CERTIFICATE PROCUREMENT RECEIVED FROM YOUR ATTORNEY

Civista Bank
100 E. Water Street,
Sandusky, Ohio 44870

Dated: April 15, 2016
Ref: CB/FDA/000228017815

Contact Person:
Mr. Dennis G. Shaffer,
Phone: (419) 975-9095



Attn:
(Mr. xxx)


PAYMENT FOR HVAC CERTIFICATE PROCUREMENT RECEIVED FROM YOUR ATTORNEY

This is to inform you that this financial institution has just received payment for High Value Alert Clearance (HVAC) certificate procurement charge of the sum of US$1053.00 from your attorney and has been forwarded to the in-charge United States LEGAL department this morning for the said certificate procurement without delay.

Therefore, you are hereby advised to exercise some patience while the High Value Alert Clearance (HVAC) document is being legally procured within some hours from now to facilitate the transfer of your inheritance fund to your designated bank account, and we shall equally notify you as it progresses.

Meanwhile, we shall keep you updated with information regarding the same in a short while.

We appreciate your choice of banking with Civista Bank as we’re focused on serving you better.

Yours Sincerely,
Civista Bank



Disclaimer Notice: Information contained in this email is confidential & intended for the addresses only. Any dissemination, distribution, copying or use of this communication without prior permission from the address is strictly prohibited. If you are not the intended recipient of this communication, please delete it permanently without copying, disclosing or otherwise using its contents, and notify the (Civista Bank) immediately.

[firefly]

Email:

From: Richard J Dutton <richarddutton1958@hotmail.com>
Date: Sunday, April 21, 2016
Subject: Sorry I couldn’t keep in touch, I was out of station
To:

Dear xxx,

Top of the day to you

Actually I was delegated for an official duty more like a conference to another city due to the present diversity that we are currently having in recognition of our today’s banking business, to enable us serve the full range of financial service needs of our esteemed customers beyond commercial banking to investment banking and insurance as well as retaining a financial service focus and also affords us the opportunity to capture the long term growth potential that exists in our non-commercial banking business.

Mind you! I am working seriously towards getting the fund out based on my earlier decision with the new party introduced because I have lately realized that nothing good will come out of you due to your being pessimistic absolutely.

Do not attend or respond to any mail that did not come from this e-mail address.


Please take precaution!

I rest my case.


Humble regards,

Richard Dutton

The scammer impersonating the real vice-president of the real bank and he is using the phone number 1-567-9983-165 / +15679983165. No real bank or real bank staffer will use a free email address - gmail, hotmail, yahoo or similar - for business contacts.

+15679983165
Owner supposedly based in Sandusky, OH
VoIP - Vail Lab