info@ifcglb.com

[firefly]

Recovery scam

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment

Payment Amount $5.8 M USD

Attn: Fund beneficiary,

To: xxx,

We wish to inform you that your Compensation Fund Payment of $5.8 M USD has been approved via Auto-Cash Atm Visa Card for daily ATM cash withdrawal globally and local bank fund transfers in your country only. The Auto Cash Atm Visa card will be issued by the authorized bank and delivered to your door step via dhl to commence transaction upon receipt, this procedure is stress free to enable you secure your fund payment respectively, we shall step ahead once we hear back from you for further directives.
The attachment is your fund payment certificate for your perusal.

Best Regards,
Mr. Haman Francis
(International Payment Department)

Header:

Return-Path: <info@ifcglb.com>
Received: from us2-ob2-7.mailhostbox.com (us2-ob2-7.mailhostbox.com. [208.91.199.208])
Received-SPF: pass (google.com: domain of info@ifcglb.com designates 208.91.199.208 as permitted sender) client-ip=208.91.199.208;
Authentication-Results: mx.google.com;
dkim=pass header.i=@ifcglb.com header.s=20190825 header.b=J2sIqk6K;
spf=pass (google.com: domain of info@ifcglb.com designates 208.91.199.208 as permitted sender) smtp.mailfrom=info@ifcglb.com
Received: from 172.16.214.73 (unknown [172.16.214.73]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: info@ifcglb.com) by us2.outbound.mailhostbox.com (Postfix) with ESMTPSA id BE0D1781A97 for <xxx>; Mon,
3 Feb 2020 09:51:24
Date: Mon, 3 Feb 2020 15:21:24
From: info Department <info@ifcglb.com>
Reply-To: info Department <info@ifcglb.com>
To: xxx
Message-ID: <157539718.43873.1580723484703@webmail.ifcglb.com>
Subject: Re: APPROVED PAYMENT

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment

Payment Amount $5.8 M USD

Attn: Fund beneficiary,

Sorry, see attachment for your perusal.


Best Regards,
Mr. Haman Francis
(International Payment Department)

Header:

Return-Path: <info@ifcglb.com>
Received: from us2-ob2-1.mailhostbox.com (us2-ob2-1.mailhostbox.com. [162.210.70.55])
Received-SPF: pass (google.com: domain of info@ifcglb.com designates 162.210.70.55 as permitted sender) client-ip=162.210.70.55;
Authentication-Results: mx.google.com;
dkim=pass header.i=@ifcglb.com header.s=20190825 header.b=Te9UPSo7;
spf=pass (google.com: domain of info@ifcglb.com designates 162.210.70.55 as permitted sender) smtp.mailfrom=info@ifcglb.com
Received: from 172.16.214.51 (unknown [172.16.214.51]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: info@ifcglb.com)
Date: Sun, 9 Feb 2020 00:51:35
From: info Department <info@ifcglb.com>
Reply-To: info Department <info@ifcglb.com>
To: xxx <xxx>
Message-ID: <770492338.599.1581189695511@webmail.ifcglb.com>
In-Reply-To: <CAE1KDhm+BpxHTVnEtcCx=N-njjeMwCQW=Ftjc+==Q8W2K-kUzw@mail.gmail.com>
References: <157539718.43873.1580723484703@webmail.ifcglb.com> <CAE1KDhm+BpxHTVnEtcCx=N-njjeMwCQW=Ftjc+==Q8W2K-kUzw@mail.gmail.com>
Subject: Re: APPROVED PAYMENT
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_597_1890745344.1581189695503"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v7.8.3-Rev22

Originating IP: 162.210.70.55
Originating ISP: Public-domain-registry
Country of Origin: United States

Fake document received with the message:

[firefly]

The fraudulent domain name used in scam pretends to be the International Finance Corporation, a sister organization of the World Bank and member of the World Bank Group, the largest global development institution focused on the private sector in developing countries.

The real IFC was founded in 1956 and is headquartered in Washington, D.C. in the United States.

The fake one was created in August 2019 by someone supposedly located in the UK.

There is no content, the fraudulent domain name is used only for the email address as in info@ifcglb.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=142058.

From the domain name registration:

Domain Name: IFCGLB.COM
Updated Date: 2019-10-25
Creation Date: 2019-08-25
Registrar Registration Expiration Date: 2020-08-25
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: GDPR Masked
Registrant Name: GDPR Masked
Registrant Organization: GDPR Masked
Registrant Street: GDPR Masked
Registrant City: GDPR Masked
Registrant State/Province: Other
Registrant Postal Code: GDPR Masked
Registrant Country: GB
Registrant Phone: GDPR Masked
Registrant Fax: GDPR Masked
Registrant Email: gdpr-masking@gdpr-masked.com

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment

Payment Amount $5.8 M USD

Attn: Fund beneficiary,

Kindly forward your your full name with your scan passport/ID Card,house/Office Address, occupation and telephone number to enable us proceed with your fund payment accordingly.
Then choose your option below for your payment

1. Atm Card for daily cash withdrawal

2. Secure online account for online fund transfers

Once you forward the requested details in which we shall submit to the authorized bank to proceed with your fund payment respectively.

Thank you for your understanding as we look forward to hear from you soon.

Best Regards,
Mr. Haman Francis
(International Payment Department)

Header:

Return-Path: <info@ifcglb.com>
Received: from us2-ob4-7.mailhostbox.com (us2-ob4-7.mailhostbox.com. [199.79.62.66])
Received: from 172.16.214.51 (unknown [172.16.214.51]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: info@ifcglb.com) by us2.outbound.mailhostbox.com (Postfix)
Date: Tue, 11 Feb 2020 11:28:11
From: info Department <info@ifcglb.com>
Reply-To: info Department <info@ifcglb.com>
Message-ID: <1838896465.60348.1581400691476@webmail.ifcglb.com>
Subject: Re: APPROVED PAYMENT
X-Mailer: Open-Xchange Mailer v7.8.3-Rev22


Originating IP: 199.79.62.66
Originating ISP: Public-domain-registry
Country of Origin: United States

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment

Payment Amount $5.8 M USD

Attn: Fund beneficiary,

To: xxx,

The difference is that option 1 has daily cash withdrawal limit while option 2 is unlimited.
Option 1 is the process whereby you will receive from the bank Atm Card to withdraw cash daily in any Atm machine globally while option 2 is the process whereby you will have your login details from the bank to access the fund and transfer huge amount to any account of your choice globally.
Let us know the option of your kind along with your details as demanded on the previous email to enable us proceed to the authorized bank for your fund payment.


Best Regards,
Mr. Haman Francis
(International Payment Department)

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment

Payment Amount $5.8 M USD

Attn: Fund beneficiary,

To: xxx,

Thank you for your email and also your option of payment, you are now requested to forward the below details,

We await to hear from you soon with your scan passport/ID Card,house/Office Address, occupation and telephone number in which we shall submit to the authorized bank to proceed with your fund payment.


Best Regards,
Mr. Haman Francis
(International Payment Department)

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG
RE: Compensation Payment
Payment Amount $5.8 M USD
Attn: Fund beneficiary,

To: xxx,

Your details will be kept confidential and the bank requested for it to process your online account for your access to the fund as the beneficiary, you have not send the details earlier as you said, I advise you to comply and you shall receive your compensation fund payment.

You are to send your details and we shall proceed.

Best Regards,
Mr. Haman Francis
(International Payment Department)

[firefly]

Email received:

IFC GLOBAL,
Transaction Ref.#: 67231/20/TG

RE: Compensation Payment
Payment Amount $5.8 M USD

Attn: Fund beneficiary,

To: xxx,

I received your email with the content well understood, I shall forward your details to the bank and explained to the bank on your behalf to proceed with your fund payment arrangement, Merci.

Thank you
Best Regards,
Mr. Haman Francis
(International Payment Department)

[firefly]

Email received:

BTCI,Lome-Togo,
Address: 169, Boulevard du 13 janvier
BP 363 Lomé, TOGO

For online account

Attn: Mrs. xxx,

We have been instructed by the IFC Global to proceed with your fund payment of $5,800,000.00 USD accordingly and we request you to fill the attached form and forward it back for immediate arrangement to secure your online account enabling your acesss to the fund as the beneficiary.


Best Regards,
Mr. Roselyn Veddi
(Foreign Transfer Department)
THANK YOU FOR BANKING WITH US

Header:

Return-Path: <info@onlinebbplc.net>
Received: from us2-ob3-7.mailhostbox.com (us2-ob3-7.mailhostbox.com. [208.91.199.220])
Received-SPF: pass (google.com: domain of info@onlinebbplc.net designates 208.91.199.220 as permitted sender) client-ip=208.91.199.220;
Authentication-Results: mx.google.com;
dkim=pass header.i=@onlinebbplc.net header.s=20160728 header.b=Nle8zuXI;
spf=pass (google.com: domain of info@onlinebbplc.net designates 208.91.199.220 as permitted sender) smtp.mailfrom=info@onlinebbplc.net
Received: from localhost (unknown [162.215.241.208]) (Authenticated sender: info@onlinebbplc.net) by us2.outbound.mailhostbox.com (Postfix) with ESMTPA id C069BD29F9 for <xxx>; Wed, 19 Feb 2020 08:15:41
Date: Wed, 19 Feb 2020 10:15:41
From: info@onlinebbplc.net
To:
Subject: B T C I Lome-Togo
Message-ID: <9c06cce678f5a62ce2e9313d110951f9@onlinebbplc.net>
X-Sender: info@onlinebbplc.net
User-Agent: Roundcube Webmail/1.3.8

162.215.241.208
Originating IP: 162.215.241.208
Originating ISP: Public-domain-registry
Country of Origin: United States

Fake document received with the message:

[firefly]

The fraudulent domain name used in scam impersonates BTCI - Banque Togolaise du Commerce et de l'Industrie.

There is no content on the fake website, the domain name is used only for the email address, as in info@onlinebbplc.net.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=142151.

From the domain name registration:

Domain Name: ONLINEBBPLC.NET
Updated Date: 2019-08-08
Creation Date: 2016-07-28
Registrar Registration Expiration Date: 2020-07-28
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: owark chambers
Registrant Organization: ionlinetbb.com
Registrant Street: 12 hill avenue, fl
Registrant City: manila
Registrant State/Province: Cavite
Registrant Postal Code: 88201
Registrant Country: PH
Registrant Phone: +63.9295884027
Registrant Email: owarkchambers@yahoo.com