Internet investment scams in China How to protect your business s reputation in China You get a call. Your offices in Beijing and Shanghai have been inundated with complaints from distressed members of the public. They say they have bought investment products from your company but their money has disappeared. Investments range from tens of thousands of US dollars to RMB10m or more. You are told: We need to take action now! Many financial institutions have found themselves in this position in recent months. Here are our top tips on what to do if it happens to you. Internet investment scams are one of the latest forms of online scams in Asia. With the boom in Asian IPOs, small investors are continually looking for the next big thing and can be easily tempted by offers of unmissable investment opportunities. These scams can take several forms, including alleged investments offered in the local branch of a global financial institution and investment products issued by companies claiming to be backed by, sponsored by or in partnership with global financial institutions. Typically, at the centre of these scams there is a fake website that resembles the target global institution s own website or that has a similar domain name. Many of these frauds are centred in and directed at China. Scams like this often work on pyramid selling principles and offer commission to victims for introducing other investors. Rumours spread like a virus through online bulletin boards, live chat rooms or by mass emails, and before you know it the net of victims has been cast very wide indeed. The diagram below shows how a typical internet investment scam operates. Fake front website A fake website is set up. Initial promotion of the scam The investment opportunity is promoted by press releases relayed by fake blogs containing links to the website. News spreads. Chat room/instant message service Users receive an email inviting them to join a chat room for inside information on the investment opportunity. Pyramid selling A user joins the chat room and is offered commission to introduce other investors. Payments Payments for (non-existent) investments are made to a designated account. Investments and commissions are never received. Unfortunately, the first you are likely to hear about a scam like this is when you receive the kind of call described above. What do you do? If you fail to take action to protect investors and members of the public from the scam being carried out in the guise of your company, its reputation in the market place could be badly damaged. We have put together this quick checklist of what to do when an investment scam targets your business. It is based on our recent experience of helping clients respond to these types of scams.
Identify the scam: what, who, where? What s the story? Get to the bottom of the facts fast: how is the scam operating? Is there a fake website? Members of the public caught up in the scam can be a mine of information. By getting instructions and a checklist of questions out to frontline sales and customer service staff right away you can quickly gain information about the operation of the scam that could prove very useful to trace it and have it shut down. Instruct staff to find out as much as possible about the scam, including details of any website or bank account. Take names and contact details so you can follow up complaints. Who are you dealing with? Identify the registrant (the owner of the domain name). You can do this through an online whois search. Although the owner s details are most likely to be bogus, they may nevertheless give clues to the identity and whereabouts of the fraudsters. You will also find out the domain name registrar (ie the entity that allocated the domain name to the fraudster) and the IP address, which is the first step in locating the ISP that hosts the site. People complaining about the scam should again be able to give you information on the ways in which the scam is being perpetrated. Some may even have had direct contact with the fraudsters. Where are the domain name registrar, web-hosting provider and ISPs? The fake website is at the heart of these investment scams. It exists to give a veneer of legitimacy to the scam. But the website also offers the first line of attack in your fightback. If you succeed in having the website taken down, you remove a very important part of the fraud. At the same time you could also alert potential victims that all may not be as it seems with the investment opportunity. Understanding the identity and location of the domain name registrar, web hosting providers and other ISPs involved is an important first step in identifying the legal and practical options (see below). A single website might be hosted by a long chain of ISPs located around the world. Hit back fast Speed is essential Internet fraudsters aim to make their money as quickly as possible and move on before they can be traced. The scam may have already been in operation for several weeks by the time you hear about it. Pursuing traditional legal remedies (eg claims for intellectual property infringements or libel) is often too slow and not suited to the task. 2
Bring in investigators In the absence of a strong internal IT forensics team, one of the first things you should do is to brief and bring in investigators to follow up with the complainants and pursue leads on the ground. Make sure the investigator has specialist internet forensic capabilities and is able to locate ISPs. Instruct your lawyers to send take down demands to the ISPs involved Under both PRC and Hong Kong law, ISPs that knowingly host fraudulent websites may be jointly liable. Notifying the ISP of the scam is an important first step to establish its liability. Contacting an ISP direct is faster and cheaper than suing. Ask the ISP to block or disconnect the site. Point out the (likely) non-compliance by the fraudster with the ISP s terms of use policy (eg IP infringement or criminal acts) and the ISP s own secondary liability for the fraudster s acts. Large ISPs will generally act quickly if it is clear that there is a scam or your IP rights are being infringed. Smaller ISPs can be less responsive and sometimes even unscrupulous, in our experience. Intermediate ISPs can be switched very quickly, so you may need to persevere. The fraudsters need to know that you are on to them and that you will not let up in your efforts to stop the scam. Instruct your lawyers to write to the registrar Depending on the registrar s terms of use for a domain name, it may be willing to disable the offending domain name. Registrars generally publish their terms of use and abuse policies on their own website. Filing a police complaint In some cases, making a complaint to the police offers the only long-term solution to track down fraudsters and put a stop to the scam. However, internet investment scams are effective because the fraudsters are difficult to track down. So it is important to be realistic about the speed at which any investigation will move forward. We have found that the Economic Investigation Bureau of the Ministry of Public Security (MPS) often takes two or three weeks to acknowledge a complaint and several weeks more to launch an investigation. Even then, the MPS will often rely on you to produce evidence of the scam and leads for them to follow up. 3
The State Administration of Industry and Commerce and China Internet Illegal Reporting Centre may also accept complaints about illegal behaviour on the internet. But its response times can be equally slow. The Commercial Crimes Bureau of the Hong Kong police is considerably more responsive. However, it will be reluctant, and often unable, to act under the Pyramid Selling Prohibition Ordinance without clear evidence of a connection to Hong Kong. For these reasons, filing a police complaint is not likely to offer a complete solution and you should also consider taking the other actions we recommend in this guide. What are your regulatory responsibilities? If you operate in a regulated industry, consider whether you have a responsibility to notify your regulators. China The China Securities Regulatory Commission and China Banking Regulatory Commission operate complaint lines for illegal activities. However, they do not have the capacity to investigate an internet scam. Hong Kong The Securities and Futures Commission has issued a circular advising licensed organisations that are affected by fraudulent websites to notify it, file a police complaint in Hong Kong and warn the investing public. This circular is not a formal regulation and you should consider in each case whether there is a strong enough link to Hong Kong for the advice in the circular to apply. Damage limitation Public relations Your public relations team should consider how to get a clear message that you have no connection to the fraudulent entity out to your key stakeholders. They should also let people know what action you have taken, eg reporting the scam to regulators and law enforcement authorities. This can be an effective way to counter reputational risk and show that you are taking steps to protect the public. Consider a disclaimer on your own website Consider placing a notice on your own website to warn people about the fake site and direct enquiries to a central contact point in your office. 4
If victims of the fraud are believed to be primarily Chinese-speaking, you will have the option to publish a disclaimer in Chinese only. This has the added advantage of limiting possible negative perceptions among your non-chinese-speaking customers. Legal action Recapturing hijacked domain names The most cost-effective way to recover domain names is through the Uniform Domainname Dispute Resolution Policy (UDRP), a relatively effective procedure to recover unlawfully registered domain names. A decision in a UDRP action will typically take three or four months. So this is a second line of response if the website cannot be taken down more quickly another way. Disclosure actions US federal courts are empowered to compel ISPs and web-hosting providers to disclose information that will help proceedings in other jurisdictions. These entities may or may not have reliable information to help identify and locate perpetrators. A Norwich Pharmacal order in Hong Kong will be available in appropriate circumstances against, for instance, a bank in the territory that provides an account connected to the scam. The order requires the bank to disclose the identity of the account holder and details of transactions through the account. Orders have been granted in the past in support of potential foreign proceedings as well. Other civil proceedings Civil proceedings are more likely to be appropriate if there has been a deliberate infringement of your intellectual property rights or malicious or libellous reputational damage. As discussed above, a tortious action against an ISP that refuses to take down connections to a website might also be an option, depending on the jurisdiction in which the ISP is located. Stop Online Piracy Act The Stop Online Piracy Act bill being considered by the US House of Representatives may also provide new remedies that can be applied against internet scams, although it is primarily directed at fighting copyright infringement and online distribution of counterfeit goods. For instance, in its current version the bill would allow the US Department of Justice to seek orders against US directed internet service providers to cut off service to foreign websites that are accused of infringing activities. 5
Prevention is better than cure Standing instructions Brief your customer relations departments, sales teams and call centre staff to ensure you have a consistent approach to managing future complaints and getting information about possible scams. Create standing instructions (including a checklist of questions) for front-line staff to record critical information about a suspected scam, how and where it is operating, how contact was made and details of any bank account into which funds are to be deposited. Keep a detailed record of all complaints. Ring-fence domain names Register country code top-level domains for your main brand names and ring-fence variations that are most likely to be used for a scam website in your key markets and jurisdictions where fraud is a high risk. Many domain name registrars offer bulk registration of domain names at a discount. In truth it can be difficult to spot all possible variations that could potentially be hijacked, but it is better to make an attempt to claim the domain names that are most vulnerable than to do nothing. Track online discussions about your firm Spotting potential frauds early on can help prevent potential PR disasters and allow an early fightback. Use the array of software available to monitor public sites and domain names to identify unauthorised use of your company s name that might be connected with an internet scam. We recommend you give your risk and compliance department standing instructions to carry out routine internet searches on at least a quarterly basis. Your Freshfields contacts Connie Carnabuci Partner T +852 2846 3300 E connie.carnabuci@freshfields.com Richard Bird Counsel T +852 2913 2660 E richard.bird@freshfields.com www.freshfields.com Freshfields Bruckhaus Deringer LLP is a limited liability partnership registered in England and Wales with registered number OC334789. It is authorised and regulated by the Solicitors Regulation Authority. For regulatory information please refer to www.freshfields.com/support/legalnotice. Any reference to a partner means a member, or a consultant or employee with equivalent standing and qualifications, of Freshfields Bruckhaus Deringer LLP or any of its affiliated firms or entities. This material is for general information only and is not intended to provide legal advice. January 2012, 31916 6