Polo Murillo Romance Scam

[DarkTalonProject]

Website: https: // polomurilloconstructions.com/

Posting this for a female friend who was baited by this guy under the name Polo Murillo. Luckily she was smart enough to not send any money.

Found on POF
First he flew out to Turkey and was hit by a car and spent time in the hospital. After unsuccessfully trying to get in the neighborhood of $4000 to unfreeze his bank account and be released from the hospital.
When that failed he tried the following "legal email"

Hello _____,
I am Barr. Güney Kirkuk , an international advocate. I am contacting you on behalf of Mr Polo that was arrested on Monday night with respect to the armed robbery incident that took place at the 4 star hotel istanbul where he lodged. There was a serious robbery incident in the hotel on Monday evening and it is recorded that it was the 3rd time that such happened in the same location so the police raided the place and Polo was also arrested. My client , Mr Polo has also made his statement in the police station because he claimed that he had over $400000 in his hotel room which was also stolen on that day. Unfortunately the government has charged every person that was arrested in the scene and in the hotel and they are all been investigated for terrorism and robbery because it is suspected that an insider knows about the constant robbery and terrorism activity in the area, Polo directed me to contact you , he said that you are his wife. I have succeeded in retrieving his phone from the police but I will let him have it when I go to visit him this morning . They were all remanded including Polo Murillo and placed on $100000USD bail bond. I will forward a picture of him as at the time of his arrest, please reply asap if you recognize him as your husband . Thanks.

Sincerely,
Barr. Güney K(SA)

[firefly]

Thank you for the report, DarkTalonProject.

It is a classical game in the romance scammers playbook to create a fake site for their main character pretending to be a CEO. The fake website is meant to give more credibility to the fake persona, making it look like he is real outside the dating or the social profile where he contacts the victims.

Most of the fake websites built this way will have a recent registration and stolen pictures from the same gallery used also on social media and the dating profile.

This case is no exception.

It would help if your friend will also share here some of the message received: the initial ones where he is introducing himself, the ones where he is talking about his business and the ones where he is talking about money.

Those messages are copy-pasted scripts sent to more victims in the same time.

[firefly]

From the fake website used in fraud:

Polo Murillo Constructions provides services to regional and international customers in three operational business divisions; Road and Network, Track Construction as well as Engineering and Turnkey Construction.
As a partner with over 58 years of accumulated experiences of our work force We have become one of America’s leading construction companies operating in the Seattle area. Besides the construction company, we are also active on the American market with three fully-owned subsidiaries.

Contact details on the fake website:

Address: 280 Westlake Ave N, Seattle, WA 98109
Phone number; +12064556279
Email:
Info@Polomurilloconstructions.com
polomurillog@gmail.com

There is no business named "Polo Murillo Constructions" legally registered anywhere in Seattle. Also there is no business legally registered in Seattle using that location.

About the phone number used:

+12064556279
Type: Non-Fixed VoIP (e.g. Skype or Google Voice)
Original carrier: Level 3 Communications, Llc - Wa

Their team:

"SARAH ANDERSON MANAGER HR" is a template picture stolen from the Internet.

The image of "MATT PETTERS PROJECT MANAGER" is also stolen from media articles. The real owner of that picture is Dr. René Umlauft, a member of the MAN SE Executive Board and Chief Executive Officer of MAN Diesel & Turbo SE.

"MR POLO MURILLO MD/CEO" is also a stolen image of a Spanish politician, José Manuel García Ballestero. Stolen pictures of the same person are used online not only on this fake site but also on dating sites where he claims to be someone else.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143596.

From the domain name registration:

Domain Name: POLOMURILLOCONSTRUCTIONS.COM
Updated Date: 2020-01-06
Creation Date: 2019-11-06
Registrar Registration Expiration Date: 2020-11-06
Registrar: Hostinger, UAB

Registry Registrant ID: Not Available From Registry
Registrant Name: polo murillo
Registrant Organization: polo murillo
Registrant Street: 280 WESTLAKE, AVE N SEATLE, WA 98109
Registrant City: N SEATLE
Registrant State/Province: SEATLE
Registrant Postal Code: 98124
Registrant Country: US
Registrant Phone: +234.12064556279
Registrant Email: polomuriconstructions@gmail.com

This is what the fake website looks like:

As seen above, the person registering the "company" website, pretends to be located at the same address in "Seatle" where the "company" is apparently located... while using a Nigerian country code for the same VOIP phone number.

[firefly]

On a Russian social platform, the same stolen picture is used by someone pretending to be:

Clinton Mark
Date of birth: June 4, 1962

Career
Companies: Civil Engineering 1999-2019
manager

Political attitude: Liberal
Religion: Catholic
Personal priorities: Family and children
Other people's priorities: Humor and zest for life

Stolen pictures used:

[DarkTalonProject]

I asked about text messages and it seems with Google Hideout that it does not keep the messages for a long period and so she only has to early april available.

[SlapHappy]

the ones where he is talking about his business and the ones where he is talking about money.

If they have these elements in the conversation, then post them here, please.

[Steph13]

I am writing on behalf of a friend.
She was scammed by someone using the same name, construction website, etc.

He texted her sweet and long romantic messages (even pictures of "him and his son") for about 2 weeks. He said he lives in Seattle and is on a trip to Istanbul to get his money for his last job. He even sent his "ticket" for a charter plane. Afterwards he wanted to come to Germany to visit her.
Two days ago he said he finally received his money and is now traveling in Istanbul. My friend who is usually a very critical person, asked for pictures of his hotel room (out of curiosity) and never got a direct answer just romantic texts. Yesterday he said he will go out for the day to go shopping. In the evening she didn't hear back from him.

This morning he texted her saying he was in an accident with a bike and his wallet got stolen. He had to have surgery which cost 25k$. He paid 22k$ in cash but needed her to log in on his bank account to transfer more so he could pay the rest. She clicked on the link he sent and was directed to a "bank website" where she saw his bank statement with 6 million US$. While she tried to do the transfer the account was locked because apparently someone tried to log in from an unusual location. He then asked her to send him the rest of the money. I told her "DO NOT SEND HIM ANY MONEY" which luckily she listened to!

After digging deeper and looking for the people on his website I found this website and could finally tell my friend what was going on.

[SlapHappy]

Steph13,

Please post the scammer's email account and the fake bank link.
Please post any other information that people could search for here: pictures, documents, samples of his emails.

Please read: viewtopic.php?f=20&t=24589

viewtopic.php?f=20&t=26504

[Steph13]

Here are the information my friend got from him

phone number: +1 (206) 455-6279
birthday: 04.06.1960
email address: anthonymanfordd@gmail.com

IP Address: 209.85.210.169

His addresses:
- 65th Ave Seattle NW 2820 NW USA
- 8201 Stanley Road Minneapolis Minnesota 55437 USA

His bank account info:
- Online Bank website: https: // reliancebank.onl-pa.com/online/
- ID: xxx
- Password: xxx

charter plane ticket.png (146.99 KiB) Viewed 4288 times

Phone:
+12064556279
Number billable as geographic number
Country or destination United States
City or exchange location Seattle, WA
Original network provider* Level 3 Communications, Llc - Wa
Type: Non-Fixed VoIP (e.g. Skype or Google Voice)

[Steph13]

Here are also the account information of the doctor the money should've been sent to:

ACCOUNT NAME: M. C. K.
BANK NAME: AK BANK
BANK ADRESS: MECIDIYEKOY SUBE
ACCOUNT TYPE: EURO
ACCOUNT NO: 0133020XXXX
IBAN: TR60 0004 6001 3303 6000 20XXXX
BENEFCIARY ADDRESS: ISTANBUL
SWIFT CODE: AKBKTRIS