brr.mjohnson@gmail.com

[firefly]

The victim was contacted on Facebook. The scammer claimed he is traveling to Indonesia for an investment project and he was asking for the victim financial help to finish the project.

Email address used: brr.mjohnson@gmail.com

Fake profile used:
Mark Johnson
Self-Employed
Studied Drilling Engineering at St Lukes Amsterdam
Went to Van University Amsterdam
Lives in Amsterdam, Netherlands
From Amsterdam, Netherlands

Stolen pictures used:

mark1.jpg (18.93 KiB) Viewed 1327 times

[firefly]

The scammer asked the victim to contact the same bank where he is having his bank account for making the transfer of the returned payment easier.

Fake bank used in scam: JONCE COMMERCIAL FINANCE

According to the fake site:

JONCE COMMERCIAL FINANCE PLC, a UK incorporated bank, is a wholly owned subsidiary of the Jonce Commercial Finance Plc, one of the oldest and most respected banks in United Kingdom.

Contact details:

UK OFFICE
2A TOWER ROAD, BELVEDERE. KENT. DA17 6HX. UK
accountant@joncecommercialfinance.com
+447764643827

USA OFFICE
15569 RICHVALE DR WHITTIER CALIFORNIA 90604 USA
+15309243877
remittance@joncecommercialfinance.com

+447764643827 - mobile number
+15309243877 - TextPlus VoIP number

From the fake site details - http://db.aa419.org/fakebanksview.php?key=120404:
Domain Name: JONCECOMMERCIALFINANCE.COM
Updated Date: 2017-02-10
Creation Date: 2017-02-10
Registrar Registration Expiration Date: 2018-02-10
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Paul Gabriel
Registrant Organization: Net
Registrant Street: plot 105 pangrove drive
Registrant City: manchester
Registrant State/Province: NY
Registrant Postal Code: 10011
Registrant Country: US
Registrant Phone: +1.8774531304
Registrant Email: paul.gabriel1963@gmail.com

This is what the fake site is looking like: