Does your private family foundation have a website? If not, you could be at risk for this new cyber threat.
What is it?
The best way to explain is to share what happened to one of our clients.
We received a call from a gentleman saying that his private family foundation (let’s call it the ABC Foundation) had received calls from job seekers asking if the position they were offered was real. The offer was to be an assistant to a board member. There were a few problems with this:
- The private family foundation wasn’t hiring
- The name of the board member wasn’t anyone on their board
The first call didn’t raise too much suspicion at the foundation’s office. They assumed it was either a case of a wrong name or, perhaps, just a scam call. It wasn’t. The calls continued. The foundation knew there was a problem.
When they first contacted us, we suggested they put an announcement on their foundation’s website saying that if someone were to receive a job offer from them, it was a scam, as they were not hiring.
As with other family run foundations, the ABC Foundation didn’t currently have a website, so they decided to create one for the purpose of warning job seekers about the fraudulent offers using the name of their foundation.
However, when they tried to register the domain name for “abcfoundation.org”, they discovered it was already taken. How could that be?
A quick search online using the name of the foundation revealed that not only was the domain taken, but someone had created a website. A website site pretending to be the ABC Foundation.
The site was professional looking and very convincing. It had board members and their photos, solicited donations and volunteers, and had a contact-us form. They also had an address listed on the bottom of the website which was a real address connected to the ABC Foundation.
To anyone not affiliated with the ABC Foundation, this website appeared to be an official site.
Sources of Content
As mentioned earlier, the fake website had a section for the foundation’s Board of Directors. While one board member’s name was correct, the associated photo was not. The remaining “board members” proved to be fake as well.
Further investigation revealed that the images being used to portray the members were stolen from websites of real estate agents. As realtors are relatively easy to find online, we contacted them to inquire if they were aware their images were being used on the website. All four of them said that they had received calls from job seekers regarding a job offer to be their assistant. In fact, one of the realtors said that his photo was used on four different fake private family foundation websites, going back more than a year.
Not The Only One
As we began investigating these other foundations, we discovered they also used the same exact website as the one for the ABC Foundation. The only differences were the name of the foundation listed on the website and the URL. For example, the website for the XYZ Foundation displayed the same website as the ABC Foundation. The only exception was the foundation name listed.
In each instance the imposter had purchased a domain in the name of the foundation and had launched the same website. None of these foundations had considered purchasing the domain for their foundation. They all determined a website was unnecessary and would bring unwanted attention to their organization.
RISKS OF A FAKE WEBSITE
By not purchasing their domain name, it left them vulnerable to imposters. There are risks associated with someone purchasing your domain and posting a fake website. Risks to both the foundation and to the job seekers.
Risks to the foundation
- Donations made to fake website could cause tax issues for foundation
- Damage of reputation by negative review online and complaints of scams
- Increase in unwanted attention, both positive and negative
Risks to job seekers
- Fake job offers
- Stolen identity
- Lose money
- Tricked into laundering money (known as “money mule”) as requested by supposed employer
Steps to Take
This could have been avoided if the foundation had taken one simple step: Registering the URL for their foundation, ABCFoundation.org. By registering the URL, you block someone else from buying and using it.
I also understand you want to keep your private family foundation private. You can.
Just because you buy the URL doesn’t mean you have to post a website. Though, make sure when you buy the URL that you also pay for private registration. If someone were to check the WhoIs Registration and look at the information about the owner of the URL, it will default to the information of your web hosting company.
What to Do if You’re Already a Victim
If in your attempt to purchase the URL for our foundation you discover it is already taken, here are a few steps to take.
- Visit the URL to see if there is a website. If there is, remember that sometimes more than one organization has the same name. However, if they are pretending to be your private family foundation, proceed to the next step.
- Check the WhoIs Registration by visiting www.whois.com and entering the URL in the search bar.
- Identify the web hosting company. This is found by looking at the REGISTRAR section. The REGISTERED ON section tells you when the URL, or domain, was purchased. The Registrant Contact section provides contact information for the URL registrant, or owner. If the owner purchased “private registration” then you’ll only see information for the web hosting company.
- Contact the web hosting company to determine their procedures to report a fraudulent website. Most often it is by sending an email to abuse@ followed by the name of the webhosting company. It is best to contact the web hosting company directly. Visit their website and either get their phone number or use the online chat feature.
- Submit a complaint about the website. Explain that they are using your intellectual property, your foundation, for fraudulent purposes. You could also ask them to remove the URL from the account as they’ve stolen your intellectual property, your trademark – your name. Make sure, in your complaint email, you ask them to confirm receipt of your complaint, otherwise you may never hear from them. Since you are not the account holder, the owner of the URL, they are not permitted to respond to you their findings or update you with what they are doing, like taking down the fraudulent website.
- Now it’s a waiting game. Periodically check the website to see if it was taken down.
Getting the website taken down isn’t the end of it. The imposter still owns your URL, domain address, and he could put up a new website at any time. If he can’t do it at the same web hosting company, he’ll simply transfer the URL to a different web hosting company. To prevent this, you need to get control of the URL.
If the web hosting company didn’t release the URL when they took down the fake website, you may need to consider WIPO – World Intellectual Property Organization. They offer arbitration and mediation services for domain name disputes. You may wish to speak with an intellectual property attorney with experience in WIPO cases.
If you would like assistance in purchasing the domain for your foundation, or if your foundation is already a victim, contact Kerskie Group at 239-435-9111.
