DECISION

 

Bank of America Corporation v. Cash Pro / gfoalertbofacashpro / Marcus Adams / GPO Alert Cash Pro BOFA / Michael Pierre / GPOAlertManagement

Claim Number: FA2403002089756

 

PARTIES

Complainant is Bank of America Corporation ("Complainant"), represented by Georges Nahitchevansky of Kilpatrick Townsend & Stockton LLP, New York, USA. Respondent is Cash Pro / gfoalertbofacashpro / Marcus Adams / GPO Alert Cash Pro BOFA / Michael Pierre / GPOAlertManagement ("Respondent"), Multiple Locations.

 

REGISTRAR AND DISPUTED DOMAIN NAMES 

The domain names at issue are <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> (collectively "Domain Names"), registered with Squarespace Domains II LLC.

 

PANEL

The undersigned certifies that they have acted independently and impartially and to the best of their knowledge have no known conflict in serving as Panelist in this proceeding.

 

Nicholas J.T. Smith as Panelist.

 

PROCEDURAL HISTORY

Complainant submitted a Complaint to Forum electronically on March 21, 2024; Forum received payment on March 21, 2024.

 

On March 22, 2024, Squarespace Domains II LLC confirmed by e-mail to Forum that the <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> domain names are registered with Squarespace Domains II LLC and that Respondent is the current registrant of the names. Squarespace Domains II LLC has verified that Respondent is bound by the Squarespace Domains II LLC registration agreement and has thereby agreed to resolve domain disputes brought by third parties in accordance with ICANN's Uniform Domain Name Dispute Resolution Policy (the "Policy").

 

On March 27, 2024, Forum served the Complaint and all Annexes, including a Written Notice of the Complaint, setting a deadline of April 16, 2024 by which Respondent could file a Response to the Complaint, via e-mail to all entities and persons listed on Respondent's registration as technical, administrative, and billing contacts, and to postmaster@gfoalertbofacashpro.com, postmaster@gpoalertbofacashpro.info and postmaster@gpoalertmanagementcashprobofa.com. Also on March 27, 2024, the Written Notice of the Complaint, notifying Respondent of the e-mail addresses served and the deadline for a Response, was transmitted to Respondent via post and fax, to all entities and persons listed on Respondent's registration as technical, administrative and billing contacts.

 

Having received no response from Respondent, Forum transmitted to the parties a Notification of Respondent Default.

 

On April 17, 2024, pursuant to Complainant's request to have the dispute decided by a single-member Panel, Forum appointed Nicholas J.T. Smith as Panelist.

 

Having reviewed the communications records, the Administrative Panel (the "Panel") finds that Forum has discharged its responsibility under Paragraph 2(a) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") "to employ reasonably available means calculated to achieve actual notice to Respondent" through submission of Electronic and Written Notices, as defined in Rule 1 and Rule 2.  Therefore, the Panel may issue its decision based on the documents submitted and in accordance with the ICANN Policy, ICANN Rules, Forum's Supplemental Rules and any rules and principles of law that the Panel deems applicable, without the benefit of any response from Respondent.

 

RELIEF SOUGHT

Complainant requests that the Domain Names be transferred from Respondent to Complainant.

 

PRELIMINARY ISSUE: MULTIPLE RESPONDENTS

In the instant proceedings, Complainant has alleged that the entities which control the domain names at issue are effectively controlled by the same person and/or entity, which is operating under several aliases.  Paragraph 3(c) of the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") provides that a "complaint may relate to more than one domain name, provided that the domain names are registered by the same domain name holder." 

 

Complainant contends that the registrants for the Domain Names are related because the Domain Names were registered in February 2024 with the same registrar, using the same underlying customer number, same name server and are hosted through the same entity. Each of the Domain Names does not redirect to an active website and is used by the Respondent to send essentially identical e-mails as part of the same fraudulent scheme. This evidence, in the Panel's opinion, strongly suggests that the Domain Names are owned/controlled by a single Respondent; were the named Respondents unrelated, it would be unlikely that three unconnected entities would register 3 similar domain names with the same registrar in a 1-month period, each of which incorporates the same two marks, and use them to target the same entity by sending essentially identical e-mails.     

 

In light of these contentions, which none of the identified Respondents deny, the Panel concludes that, on the balance of probabilities, the Domain Names are commonly owned/controlled by a single Respondent who is using multiple aliases.  Hereafter the single Respondent will be referred to as "Respondent" in this Decision.

 

PARTIES' CONTENTIONS

A. Complainant

Complainant is one of the world's largest financial institutions, providing banking, investment, wealth management, and other financial products and services. Complainant has rights in the BOFA and CASHPRO marks through its registration of the marks with the United States Patent and Trademark Office ("USPTO") (e.g. Reg. No. 4,210,429, registered Sep. 18, 2012; Reg. No. 4,747,078, registered June 2, 2015). Respondent's <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> domain names are confusingly similar to Complainant's BOFA and CASHPRO marks. Respondent incorporates the marks in their entirety and adds additional generic terms or acronyms such as "alert", "management" and "gpo" and a generic top-level domain ("gTLD").

 

Respondent lacks rights or legitimate interests in the <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> domain names as Respondent is not commonly known by the Domain Names nor did Complainant authorize Respondent to use the BOFA or CASHPRO marks for any reason. Respondent fails to use the Domain Names in connection to a bona fide offering of goods or services or a legitimate noncommercial or fair use because Respondent makes no active use of the website at the Domain Names. Rather, Respondent uses the Domain Names to impersonate Complainant in furtherance of a fraudulent email scam.

 

Respondent registered and used the <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> Domain Names in bad faith as Respondent attempts to pass off as Complainant in order to perpetuate a fraud. Respondent has actual knowledge of Complainant's rights in the BOFA and CASHPRO marks based on the use of the Domain Names for a fraudulent email scam.

 

B. Respondent

Respondent failed to submit a Response in this proceeding.

 

FINDINGS

Complainant holds trademark rights for the BOFA and CASHPRO marks.  Each of the Domain Names is confusingly similar to the Complainant's BOFA and CASHPRO marks.  Complainant has established that Respondent lacks rights or legitimate interests in the Domain Names and that Respondent registered and has used the Domain Names in bad faith.

 

DISCUSSION

Paragraph 15(a) of the Rules instructs this Panel to "decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable."

 

Paragraph 4(a) of the Policy requires that Complainant must prove each of the following three elements to obtain an order that a domain name should be cancelled or transferred:

 

(1)       the domain name registered by Respondent is identical or confusingly similar to a trademark or service mark in which Complainant has rights; and

(2)       Respondent has no rights or legitimate interests in respect of the domain name; and

(3)       the domain name has been registered and is being used in bad faith.

 

In view of Respondent's failure to submit a response, the Panel shall decide this administrative proceeding on the basis of Complainant's undisputed representations pursuant to paragraphs 5(f), 14(a) and 15(a) of the Rules and draw such inferences it considers appropriate pursuant to paragraph 14(b) of the Rules.  The Panel is entitled to accept all reasonable allegations set forth in a complaint; however, the Panel may deny relief where a complaint contains mere conclusory or unsubstantiated arguments.  See WIPO Jurisprudential Overview 3.0 at ¶ 4.3; see also eGalaxy Multimedia Inc. v. ON HOLD By Owner Ready To Expire, FA 157287 (Forum June 26, 2003) ("Because Complainant did not produce clear evidence to support its subjective allegations [. . .] the Panel finds it appropriate to dismiss the Complaint").

 

Identical and/or Confusingly Similar

Complainant has rights in the BOFA and CASHPRO marks under Policy ¶ 4(a)(i) through its registration of the marks with the United States Patent and Trademark Office ("USPTO") (e.g. Reg. No. 4,210,429, registered Sep. 18, 2012; Reg. No. 4,747,078, registered June 2, 2015). Registration of a mark with the USPTO is sufficient to establish rights in that mark. See DIRECTV, LLC v. The Pearline Group, FA 1818749 (Forum Dec. 30, 2018) ("Complainant's ownership of a USPTO registration for DIRECTV demonstrate its rights in such mark for the purposes of Policy ¶ 4(a)(i).").

 

The Panel finds that each of the Domain Names is confusingly similar to the Complainant's BOFA and CASHPRO marks as they each incorporate both of the marks while adding generic terms and acronyms and a gTLD. Such changes are insufficient to distinguish a disputed domain name from a mark under Policy ¶ 4(a)(i) analysis. See Microsoft Corporation v. Thong Tran Thanh, FA 1653187 (Forum Jan. 21, 2016) (determining that confusing similarity exists where [a disputed domain name] contains Complainant's entire mark and differs only by the addition of a generic or descriptive phrase and top-level domain); see also Trip Network Inc. v. Alviera, FA 914943 (Forum Mar. 27, 2007) (finding top-level domains are irrelevant for purposes of Policy ¶ 4(a)(i) analysis).

 

The Panel finds Complainant has satisfied Policy ¶ 4(a)(i).

 

Rights or Legitimate Interests

Complainant alleges that Respondent holds no rights or legitimate interests in the Domain Names. In order for Complainant to succeed under this element, it must first make a prima facie case that Respondent lacks rights and legitimate interests in the Domain Names under Policy ¶ 4(a)(ii), and then the burden shifts to Respondent to show it does have rights or legitimate interests. See Hanna-Barbera Prods., Inc. v. Entm't Commentaries, FA 741828 (Forum Aug. 18, 2006) and AOL LLC v. Gerberg, FA 780200 (Forum Sept. 25, 2006) ("Complainant must first make a prima facie showing that Respondent does not have rights or legitimate interest in the subject domain names, which burden is light. If Complainant satisfies its burden, then the burden shifts to Respondent to show that it does have rights or legitimate interests in the subject domain names."). The Panel holds that Complainant has made out a prima facie case.

 

Complainant asserts that Respondent has no rights or legitimate interests in the Domain Names as Respondent is not commonly known by the Domain Names, nor has Complainant authorized Respondent to use the BOFA and CASHPRO marks. Respondent has no relationship, affiliation, connection, endorsement or association with Complainant. WHOIS information can help support a finding that a respondent is not commonly known by the disputed domain name, especially where a privacy service has been engaged. See State Farm Mutual Automobile Insurance Company v. Dale Anderson, FA 1613011 (Forum May 21, 2015) (concluding that because the WHOIS record lists "Dale Anderson" as the registrant of the disputed domain name, the respondent was not commonly known by the <statefarmforum.com> domain name pursuant to Policy ¶ 4(c)(ii)); see also Kohler Co. v. Privacy Service, FA 1621573 (Forum July 2, 2015) (holding that the respondent was not commonly known by the disputed domain name pursuant to Policy ¶ 4(c)(ii) where "Privacy Service" was listed as the registrant of the disputed domain name).  

 

The WHOIS lists various entities as registrant of record that prima facie correspond with the respective Domain Names (i.e. Cash Pro / gfoalertbofacashpro / GPO Alert Cash Pro BOFA / GPOAlertManagement). However, there is no affirmative evidence that the Respondent is actually commonly known under any of the Cash Pro / gfoalertbofacashpro / GPO Alert Cash Pro BOFA / GPOAlertManagement names as opposed to simply registering the Domain Names under various false names for the purpose of asserting rights or legitimate interests.  Even if a respondent appears from the WHOIS record to be known by the domain name, without additional affirmative evidence, it can be concluded that a respondent is not commonly known by the disputed domain name under Policy ¶ 4(c)(ii).  See Google Inc. v. S S / Google International, FA 1625742 (Forum Aug. 4, 2015) ("Respondent did identify itself as 'Google International' in connection with its registration of the Disputed Domain Name, and this is reflected in the WHOIS information.  However, Respondent has not provided affirmative evidence from which the Panel can conclude that Respondent was commonly known by the Disputed Domain Name before Respondent's registration thereof."); see also Hewlett-Packard Co. v. HP Supplies, FA 282387 (Forum July 22, 2004) ("The Panel finds, because of the prominence of the HP mark, that Respondent's registration under the 'HP Supplies' name does not establish that Respondent is commonly known by the <hpsupplies.com> domain name.").  Given the lack of evidence that the Respondent is actually known under a name corresponding to the Domain Names, the use (discussed further below) of the Domain Names for phishing purposes, and Complainant's unrebutted assertions as to absence of any affiliation or authorization between the parties, the Panel finds that Respondent is not commonly known by the Domain Names in accordance with Policy ¶ 4(c)(ii). 

 

The Domain Names are presently inactive which by itself does not show a bona fide offering of goods and services. Complainant alleges, and provides evidence supporting its allegations, that Respondent uses email addresses associated with Domain Names to attempt to pass itself off as Complainant in furtherance of a phishing scam, requesting particular banking and transaction details from recipients that can be used to impersonate those recipients. Use of a disputed domain name to pass off as a complainant through emails is not a bona fide offering of goods or services or a legitimate noncommercial or fair use per Policy ¶¶ 4(c)(i) or (iii). See Emerson Electric Co. v. Adilcon Rocha, FA 1735949 (Forum July 11, 2017) (finding that respondent's attempt to pass off as complainant through emails does not constitute a bona fide offering of goods or services and, as such, respondent lacked rights or legitimate interests in the disputed domain name); see also Caterpillar Inc. v. ruth weinstein, FA 1770352 (Forum Mar. 7, 2018) ("Use of a disputed domain name in an attempt to pass itself off as a complainant and to conduct a phishing scheme is indicative of a failure to use said domain name in connection with a bona fide offer of goods and services per Policy ¶ 4(c)(i) or a legitimate noncommercial or otherwise fair use per Policy ¶ 4(c)(iii).").

 

The Panel finds Complainant has satisfied Policy ¶ 4(a)(ii).

 

Registration and Use in Bad Faith

The Panel finds that, at the time Respondent registered the Domain Names, February 2024, Respondent had actual knowledge of Complainant's BOFA and CASHPRO marks. In the same month as the Domain Names were registered, the Respondent used each of the Domain Names for the purpose of sending e-mails to pass itself off as Complainant for financial gain. In the absence of rights or legitimate interests of its own this demonstrates registration in bad faith under Policy ¶ 4(a)(iii).

 

The Panel finds that Respondent registered and uses the Domain Names in bad faith as Respondent used email addresses associated with the Domain Names to attempt to pass itself off as the Complainant to disrupt the Complainant's business or for financial gain. Using a disputed domain name to pass off as a complainant via email can demonstrate bad faith under Policy ¶¶ 4(b) (iii) and (iv). See Abbvie, Inc. v. James Bulow, FA 1701075 (Forum Nov. 30, 2016) ("Respondent uses the <abbuie.com> domain name to impersonate Complainant's CEO. Such use is undeniably disruptive to Complainant's business and demonstrates bad faith pursuant to Policy ¶ 4(b)(iii), and/or Policy ¶ 4(b)(iv)"); see also Qatalyst Partners LP v. Devimore, FA 1393436 (Forum July 13, 2011) (finding that using the disputed domain name as an e-mail address to pass itself off as the complainant in a phishing scheme is evidence of bad faith registration and use).  Accordingly, the Panel finds that Respondent registered and uses the Domain Names in bad faith pursuant to Policy ¶ 4(b)(iv).

 

 The Panel finds Complainant has satisfied Policy ¶ 4(a)(iii).

 

DECISION

Having established all three elements required under the ICANN Policy, the Panel concludes that relief shall be GRANTED.

 

Accordingly, it is Ordered that the <gfoalertbofacashpro.com>, <gpoalertbofacashpro.info> and <gpoalertmanagementcashprobofa.com> domain names be TRANSFERRED from Respondent to Complainant.

 

 

 

Nicholas J.T. Smith, Panelist

Dated: April 17, 2024