MedFinance Inc. Fraud

Don't Bear Internet Fraud

This fraudster should not be confused with any legitimate company of the same or similar name - the following amended stolen website graphics and the evidence of fraud clearly identify the fake MedFinance Inc. website and these criminal fraudsters. The website template is stolen from a genuine company.

MedFinance Inc. screenshot (16-Feb-2010)

MedFinance Inc. This is just a standard serial Russian/Ukrainian scam website that has been set up to form a front for a money laundering job advertisement. The MO and the details clearly link this criminal to many other frauds, including Diamond-Exchange Inc., Silver Services Inc., Active Solutions Inc., Silver Finance Inc. and latterly Platinum Funds., Webeca Payments Inc., Neweca Payments Inc., Med Payments Inc., Paymate Solutions Inc., Den Payments Inc., scam plus a few others in there somewhere. The website domain medfinance.biz has only been registered recently for a one year period, their website is clearly stolen from the genuine Medical Payment Solutions company, the fake MedFinance Inc. are not registered as a company in their supposed country of location, (Finland), their contact details are bogus and they have no web presence whatsoever due to a robots.txt file blocking all search engine access to their website. The purpose of the website is simply to lend an air of legitimacy to the inevitable spamvertised illegal money mule function of 'Transfer Manager' that will get your bank account closed, your assets frozen, lose you a lot of money and could cost you your liberty - don't be tempted. The criminal has alternate identical aliases of My Health Direct Inc., Medical Direct Inc., Medical Finance Inc., World MedFinance Inc., Medical Payments Inc., Med Finance Flow Inc., Medical Payment Solutions Inc. (Stolen Identity), CentroMed Finance Inc. and Healthcare Payments Inc. - this is quite clearly a prolific serial Eastern European fraudster.

MedFinance Inc. : Evidence of Criminal Fraud

i) The MedFinance Inc. 'About Us' page states "With years of experience in healthcare practice management and billing, MedFinance Inc.' goal is to increase cash flow, minimize bad debt, lower the cost of collections and enhance patient satisfaction through its' advanced web-based payment services, expanded payment options and proactive account management", but their website domain medfinance.biz was only registered with DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM on 16-Feb-2010 for the usual 'criminal's domain' minimum period of only one year. A clear indication of a fraud domain.

ii) Stolen website - their website is a stolen copy of this Medical Payment Solutions website apart from the location details. That is clear and irrefutable evidence of site theft and fraud.

iii) This Washington Post article refers to these serial criminals - irrefutable evidence of fraud.

iv) They are supposedly a company registered and located in Finland, but they are not - a search of the Finnish BIS (Business Information System) shows that there is no such company as "MedFinance Inc." registered in Finland - check for yourself - it is undeniably a fake company, (the suffic "Inc." wouldn't be used in Finland anyway - typical suffixes would be OY or OYJ). - irrefutable evidence of fraud.

v) A Google search shows absolutely no internet presence at all for this fake "MedFinance Inc." which is not surprising as the criminals are using a robots.txt file to block all search engine access to their website - only a fraudulent website would do that.

vi) Another alias, another set of very similar fake Website Contact Details:

MedFinance Inc.
Kantsie 14, Helsinki, Finland, 09401
Phone: +358 20 7288 371
E-mail: Barbara@medfinance.biz

• - The above address is just a minor variation on the address as used by the criminals for all of their aliases.
• - A Google search on the fake address of "Kantsie 14, Helsinki, Finland" just returns previous scam details which used a similar fake address. Neither Google nor Google Maps recognise it as a valid address.
• - A Wiki check on Finnish telephone numbers shows that the number "+358 20 7288 371" is incorrectly formatted for an international number and has the wrong number of digits, (the example shown should be of the form +358 2 xxx xxx). It also has the incorrect area code for Helsinki. It is clearly fake.
• - Unsurprisingly, A Google check for the incorrect telephone number "+358 20 7288 371" returns no results.

All clear evidence of fake details and fraud.

vii) The Spam:

CareerBuilder Resume xxxxxxx
From: Nolan Getty <nolangetty11@gmail.com>
nolangetty11@gmail.com
Date: Tue, Feb 16, 2010

Dear xxxxxxxxx,

We have reviewed your resume at careerbuilder.com resume-base, and consider you to be a great candidate for the position which we suggest.

Our Company is in the business of processing payments to medical companies with services designed specifically to help physicians, healthcare facilities and medical billing companies collect the patient portion of medical care.

Position Description:
The task of the "Transfer Manager" is receiving payments (to your checking account) from our clients in timely manner, sending them to our company in Finland via bank transfers, and solving issues associated with these tasks.
If you don't have bank account, We will find the nearest bank, and help to open a new checking account there.
Every transfer will be accompanied with detailed instructions.

Income: $800-$1500 per week.
It is a commission based position - 8% from each completed transaction.

General requirements:

Age from 22 to 62 ;
Microsoft Word skills;
Honesty, responsibility and promptness in operations;
5-10 hours per week
Willingness to work from home, take responsibility and achieve higher goals;

If you want to join our team, please fill this form .

All fees are paid by the company

That is a crystal clear illegal money mule function of accepting funds into a private account and transferring them back to the criminals less your percentage and on its own defines the company without doubt as criminal and bogus and is clear evidence of criminal fraud. It will get your account closed, your assets frozen and could earn you a criminal record - do not be tempted.

No legitimate company is going to advertise for this sort of illegal part time, 'work from home' money transfer position among the untrained, inexperienced and uncertified general population overseas, to do so defines the company as both bogus and criminal.

The above evidence clearly demonstrates beyond any doubt that the MedFinance Inc. website has been set up by money laundering criminal fraudsters purely for the purpose of spamvertising an illegal money laundering 'mule' job. If you are an abuse team that has received an abuse report regarding these fraudsters, please consider immediate termination of their services in view of the absolutely undeniable evidence of criminal fraud - please don't delay - these criminals will not respond to any communication from you, (all their whois data is false), but will simply take advantage of any attempt at communication as a delaying tactic to allow them time to carry on their criminal activity and prepare their next network.

MedFinance Inc. Fraudsters - hosting details

Main Domains, Registrars and Hosts

Domain

medfinance.biz

Registrar

DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM - 16-Feb-2010

Host Network

ilyopicha (ilyopicha - Ilia Iliev)/hosting.ua of "Sofia, Bulgaria"

Host IP

78.109.31.25

Key:
Active
Suspended or Inactive
Parked

Please notify me of any other current domains used by this criminal.

Domain Whois Data [These are criminal registered domains - the whois details are fake or stolen - personal details redacted]

Domain Name:                                 MEDFINANCE.BIZ
Domain ID:                                   D38282007-BIZ
Sponsoring Registrar:                        DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Sponsoring Registrar IANA ID:                303
Domain Status:                               clientTransferProhibited
Registrant ID:                               DI_11196323
Registrant Name:                             ***************
Registrant Organization:                     N/A
Registrant Address1:                         Gustaf Hallstromin katu 29
Registrant City:                             Helsinki
Registrant State/Province:                   Etelä-Suomenlääni
Registrant Postal Code:                      FI-00014
Registrant Country:                          Finland
Registrant Country Code:                     FI
Registrant Phone Number:                     +358.919115
Registrant Email:                            ftbowmandaunt@yahoo.com
Administrative Contact ID:                   DI_11196323
Administrative Contact Name:                 ***************
Administrative Contact Organization:         N/A
Administrative Contact Address1:             Gustaf Hallstromin katu 29
Administrative Contact City:                 Helsinki
Administrative Contact State/Province:       Etelä-Suomenlääni
Administrative Contact Postal Code:          FI-00014
Administrative Contact Country:              Finland
Administrative Contact Country Code:         FI
Administrative Contact Phone Number:         +358.919115
Administrative Contact Email:                ftbowmandaunt@yahoo.com
Billing Contact ID:                          DI_11196323
Billing Contact Name:                        ***************
Billing Contact Organization:                N/A
Billing Contact Address1:                    Gustaf Hallstromin katu 29
Billing Contact City:                        Helsinki
Billing Contact State/Province:              Etelä-Suomenlääni
Billing Contact Postal Code:                 FI-00014
Billing Contact Country:                     Finland
Billing Contact Country Code:                FI
Billing Contact Phone Number:                +358.919115
Billing Contact Email:                       ftbowmandaunt@yahoo.com
Technical Contact ID:                        DI_11196323
Technical Contact Name:                      ***************
Technical Contact Organization:              N/A
Technical Contact Address1:                  Gustaf Hallstromin katu 29
Technical Contact City:                      Helsinki
Technical Contact State/Province:            Etelä-Suomenlääni
Technical Contact Postal Code:               FI-00014
Technical Contact Country:                   Finland
Technical Contact Country Code:              FI
Technical Contact Phone Number:              +358.919115
Technical Contact Email:                     ftbowmandaunt@yahoo.com
Name Server:                                 NS1.EVERYDNS.NET
Name Server:                                 NS2.EVERYDNS.NET
Name Server:                                 NS3.EVERYDNS.NET
Name Server:                                 NS4.EVERYDNS.NET
Created by Registrar:                        DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar:                   DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Domain Registration Date:                    Tue Feb 16 11:05:39 GMT 2010
Domain Expiration Date:                      Tue Feb 15 23:59:59 GMT 2011
Domain Last Updated Date:                    Tue Feb 16 11:05:40 GMT 2010

DNS Lookup: medfinance.biz A record
Searching for medfinance.biz A record at b.root-servers.net [192.228.79.201]: Got referral to C.GTLD.biz. (zone: biz.)
Searching for medfinance.biz A record at C.GTLD.biz. [209.173.60.65]: Got referral to NS3.EVERYDNS.NET. (zone: medfinance.biz.)
Searching for medfinance.biz A record at NS3.EVERYDNS.NET. [208.76.63.100]: Reports medfinance.biz.
Response:

Domain	Type	Class	TTL	Answer
medfinance.biz.	A	IN	3600	78.109.31.25
medfinance.biz.	NS	IN	86400	ns1.everydns.net.
medfinance.biz.	NS	IN	86400	ns2.everydns.net.
medfinance.biz.	NS	IN	86400	ns3.everydns.net.
medfinance.biz.	NS	IN	86400	ns4.everydns.net.
ns1.everydns.net.	A	IN	86400	208.76.61.100
ns2.everydns.net.	A	IN	86400	208.76.62.100
ns3.everydns.net.	A	IN	86400	208.76.63.100
ns4.everydns.net.	A	IN	86400	208.76.60.100

Looking up at the 4 medfinance.biz. parent servers:

Server	Response
ns3.everydns.net [208.76.63.100]	78.109.31.25
ns4.everydns.net [208.76.60.100]	78.109.31.25
ns2.everydns.net [208.76.62.100]	78.109.31.25
ns1.everydns.net [208.76.61.100]	78.109.31.25

As listed, this criminal's website is still hosted by the Bulgarian host ilyopicha (ilyopicha - Ilia Iliev)/hosting.ua of Sofia, Bulgaria on IP address 78.109.31.25 - last time I checked the hosting details for the crook's previous alias's (Med Finance Flow Inc.) hosting on the adjacent IP address 78.109.31.23 they were serverofsv (Dmitriy Serdyuk)/hosting.ua. of St Petersburg. Make of that what you will. It is the same host as for other aliases of this crook.

***Latest News*** Initial entry 16th. February 2010

***Latest News*** 19th. February 2010
News from Simon Bear - the domain medfinance.biz has been deleted - please notify me of any active domains for this criminal.