How family firm Menken Orlando fell victim to domain name fraud
"It doesn't matter what line of business you're in. It isn't only banks that the fraudsters go after."
"It doesn't matter what line of business you're in. It isn't only banks that the fraudsters go after."
Menken Orlando is a family business in the Netherlands. They supply Asian snacks, nuts, seeds and chocolate products to supermarket chains and food service customers throughout Europe. They also have a subsidiary called Foodlink, which sells Asian snacks on the B2B market. Operating in such specialist fields, Menken Orlando isn't well known to the general public. Nevertheless, cybercriminals chose the company as a cover for fraud. CEO and co-owner Robert Menken discovered what was happening and decided he had to act. As well as taking legal proceedings, he started using SIDN BrandGuard to monitor his company's brands.
The fraudsters that targeted Menken Orlando were very methodical. First, they registered domain names such as foodlinkbv and foodlinkfmcg.nl, which look a lot like Foodlink's real domain name foodlink.nl. They even used Menken Orlando's details when making the registrations, right down to using the owners' names for e-mail addresses. Next, the scammers linked professional-looking fake webshops to their lookalike domain names. To boost the visibility of the scam sites, they also invested in SEO for the malicious domain names. Several months were spent preparing the ground. Mail addresses and phone numbers were registered and Trade Register extracts relating to the real Menken Orlando were obtained from the Chamber of Commerce to help the crooks convince potential victims.
Once everything was in place, the fraudsters started selling to businesses in a variety of countries. First, it was food and drink products. From March 2020, they started offering facemasks as well. Always to businesses that weren't existing customers of the real Foodlink. And always asking for a down payment to be made into a money launderer's bank account. Firms all over the world were targeted, and none of the products ever arrived. That, of course, led to victims getting in touch with the real Foodlink.
"A businessman in Poland contacted us after smelling a rat," recounts Robert Menken. "He sent us various documents and we had a WhatsApp conversation. It was clear that someone had impersonated us, so we acted immediately. We contacted the fraud reporting desks and informed the police. But, unfortunately, not much came of that. The bank accounts belonged to intermediaries, and the people behind the fraud couldn't be traced."
At that point, Menken decided to take matters into his own hands. Through a lawyer, he got a court order freezing the money laundering accounts used by the fraudsters. Some of the accounts had already been emptied, but large sums held in others were secured. Civil proceedings led to one money launderer being found liable and ordered to pay €60,000. Menken paid the legal costs and divided the recovered money amongst the victims. Criminal charges were never brought, however. The total cost of the fraud to the victims was estimated to be €182,000.
As well as pursuing the fraudsters through the courts, Robert Menken decided to do something about the online abuse of his company's brands. First, he began a notice-and-take-down procedure with GoDaddy, the US company through which the fraudsters had registered their lookalike domain names. When progress there proved slow, he contacted us, and we were able to help him get the domain names disabled. Menken Orlando also started monitoring for lookalike domain names using SIDN BrandGuard. That led to two malicious domain names being disabled in quick succession. After that, the fraudsters stopped trying to pass themselves off as Foodlink.
"That was good news for us, but we found out later that the scammers had started using another firm's identity instead," says Robert Menken. "We informed the business in question, in the hope of saving them a lot of trouble."
Menken hopes that his company's story can be a lesson to others. "Big businesses are increasingly well protected," he says. "So cybercriminals are switching to easier targets. Don't be tempted to think that it won't ever happen to you. Monitor the use of your brand and domain name. And keep a lookout. If you see anything odd, sound the alarm immediately."