Report
Executive Summary
This investigation identifies fineretcreditunion.com as an entity suspected of operating a "Bank-in-a-Box" scheme. The platform utilizes a template that appears designed to collect personally identifiable information (PII) and facilitate unauthorized advance-fee solicitations. Currently, the entity shows no confirmed legal standing or regulatory oversight and appears to utilize content and physical addresses that correlate with previously flagged activities.
Scam Type Analysis
The platform's characteristics suggest a classification of potential advanced-fee loan solicitation and phishing. Key indicators include regulatory impersonation through the unverified use of the protected term "Credit Union" to imply NCUA insurance, and template reuse, as the site structure appears to be a clone of other identified operations such as Glumbo Citi Bank, Xeus National, and Utah Offshore. Furthermore, the site claims unverified asset backing, asserting it is gold-backed to project an image of financial stability.
Evidence Analysis
Evidence supporting these suspicions includes the absence of "Fineret" from the NCUA Credit Union Locator, indicating it is unchartered and uninsured. Cross-contamination is present via support emails for other entities, specifically support@xeusnational.com and support@Glumboscitibank.com, which remain on the site. Additionally, the listed head offices at 265 Warren St and 348 North End Ave in New York correspond to residential apartment buildings. The site also contains highly similar content in its "Gold Loan" and "Construction Loan" descriptions to that found on legitimate institutional websites.
Correlated IOCs
Associated infrastructure includes the emails support@fineretcreditunion.com, support@xeusnational[.]com, and support@Glumboscitibank.com, as well as the physical addresses at 265 Warren St and 348 North End Ave, New York, NY 10282. The primary domains linked to this activity are fineretcreditunion.com, xeusnational.com, and Glumboscitibank.com.
Recommendations
Recommended actions involve filing reports with the FBI Internet Crime Complaint Center (IC3) and the NCUA Fraud Hotline for further official review. If PII has been shared with the site, individuals are advised to consider freezing their credit and enabling an IRS Identity Protection PIN.
Findings
Zeusnationalbank.com
mediumThis is a exact copy of Fineret
Evidence
Template Remenant
The support email contains a completly unrelated company name most likely left over from a scam template.
Uninsured and Unlicensed
Fineret doesn't show up on NCUA's database. Even when searching by the addresses of their main offices there's no result. By law a entity claiming to be a credit union must be licensed and insured.
Fake Head Quarter Addresses
Two separate addresses for the main offices on different pages of the website. Both locations do not have Fineret Credit Union at the loctaions and they show residential buildings instead.
Domain Name Change
After clicking the blog tab the tab name and support email changes to Xeus National Bank.
Leftover Name From Past Template
In the car loan description they call themselves "Utah Offshore Proof Bank".
Correlated IOCs
| Type | Value | Status |
|---|---|---|
| Phone Number | +1-720-310-1849 | Confirmed |
| Domain | apex-creditunion[.]com | Confirmed |
| Domain | glumboscitibank[.]com | Confirmed |
| Domain | greenwellsbank[.]com | Confirmed |
| Domain | xeusnational[.]com | Confirmed |
| Domain | skyway-finance[.]com | Confirmed |
| Domain | fineretcreditunion[.]com | Confirmed |
Stay Protected
Use our free tools to protect yourself from the threats discussed in this investigation.