ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Commonwealth Bank of Australia v. Privacy Service Provided by Withheld for Privacy ehf / Josef Salminger Case No. D2022-1280 1. The Parties The Complainant is Commonwealth Bank of Australia, Australia, represented by Herbert Smith Freehills, Australia. The Respondent is Privacy Service Provided by Withheld for Privacy ehf, Iceland / Josef Salminger, China. 2. The Domain Name and Registrar The disputed domain name (the "Domain Name") is registered with NameCheap, Inc. (the "Registrar"). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the "Center") on April 11, 2022. On April 11, 2022, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Domain Name. On April 11, 2022, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Domain Name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on April 12, 2022, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on April 21, 2022. The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the "Policy" or "UDRP"), the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules"), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the "Supplemental Rules"). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on April 29, 2022. In accordance with the Rules, paragraph 5, the due date for Response was May 19, 2022. The Respondent did not submit any response. Accordingly, the Center notified the Respondent's default on May 20, 2022. page 2 The Center appointed W. Scott Blackmer as the sole panelist in this matter on June 3, 2022. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. 4. Factual Background The Complainant is one of the largest banks in Australia, established in 1911 by the Australian Government. It offers a wide range of retail financial services in Australia and internationally. In 2008, the Complainant acquired the Bank of Western Australia Limited, which traded under the name Bankwest, for AUD 2.1 billion. The Complainant has since operated Bankwest as a discrete division, with "Bankwest" as a registered business name. The Complainant operates 86 physical BANKWEST branches in Australia. The Complaint attaches records showing recognition of Bankwest as Australia's 2021 Bank of the Year at the Australian Mortgage Awards, one of Australian Broker's 2021 "5-Star Banks", the 2020 Bank of the Year award from MPA Magazine Brokers of Banks and 2018 best National Non-Major Bank of the Year. The Complainant holds numerous BANKWEST formative trademark registrations as a word mark or composite marks in which BANKWEST is the dominant textual element, including the following: MARK JURISDICTION REGISTRATION NUMBER REGISTRATION DATE BANKWEST (word) Australia 628382 April 26, 1994 BANKWEST (composite) Australia 628385 April 26, 1994 BANKWEST (word) Australia 628389 April 26, 1994 BANKWEST (word) Australia 628390 April 26, 1994 BANKWEST SENIORS EQUITY RELEASE (word) Australia 1056975 May 24, 2005 BANKWEST EQUITY ACCESS (word) Australia 1094479 January 13, 2006 BANKWEST (word) New Zealand 791641 March 12, 2009 The record shows that BANKWEST marks have been used in online advertising since 1996. They are used to label and promote the Complainant's BANKWEST banking services at its branches, in print and broadcast advertising, on its website at "www.bankwest.com.au" and on linked social media accounts with tens of thousands of followers. The Registrar's WhoIs database indicates that the Domain Name was created on June 29, 2021. The Domain Name is associated with a website that is blocked by common Internet security software as a "known dangerous webpage". In July 2021, shortly after the Domain Name was registered, it was used for phishing emails sent to BANKWEST customers purportedly from a "Bank West" account manager. The fraudulent emails attached an application form to give customers "access to all of our available fixed term deposit and bond options", to be accompanied by scanned color copies of the customer's identification in the form of "passport, Medicare card or driving license". The email included the Complainant's standard BANKWEST email footer, with the Complainant's name, Australian Business Number, credit licence number, and head office address, as well as the Complainant's logo. 5. Parties' Contentions A. Complainant The Complainant asserts that the Domain Name incorporates the Complainant's BANKWEST mark in its entirety and that the Respondent has no permission to use the mark or other rights or legitimate interests in the Domain Name. The Respondent has used the Domain Name only to misrepresent itself as associated page 3 with the Complainant. The Complainant argues that the Respondent acted in bad faith, demonstrating its awareness of the Complainant's mark and deliberately using it for a targeted phishing scheme to mislead the Complainant's customers, attracting business to itself or simply in furtherance of fraud and identification theft. B. Respondent The Respondent did not reply to the Complainant's contentions. 6. Discussion and Findings 6.1. Preliminary Issue - Respondent's identity The Domain Name was registered in the name of a domain privacy service. After receiving notice of the Complaint in this proceeding, the Registrar identified the underlying registrant as Mr. Salminger, with no organization listed, showing a postal address in Hong Kong, China. The Complainant chose not to amend the Complaint to add Mr. Salminger as a respondent. However, based on the information from the Registrar, the Panel views Mr. Salminger as the holder of the Domain Name in the sense of the Rules, paragraph 1. The Panel therefore exercises its discretion to add Mr. Salminger as the Respondent and he is referred to as the Respondent hereafter in this Decision. 6.2. Discussion and Findings on the Merits Paragraph 4(a) of the Policy provides that in order to divest a respondent of a domain name, a complainant must demonstrate each of the following: (i) the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; and (ii) the respondent has no rights or legitimate interests in respect of the domain name; and (iii) the domain name has been registered and is being used in bad faith. Under paragraph 15(a) of the Rules, "[a] Panel shall decide a complaint on the basis of the statements and documents submitted and in accordance with the Policy, these Rules and any rules and principles of law that it deems applicable". A. Identical or Confusingly Similar The first element of a UDRP complaint "functions primarily as a standing requirement" and entails "a straightforward comparison between the complainant's trademark and the domain name". See WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition ("WIPO Overview 3.0"), section 1.7. The Domain Name incorporates in its entirety the Complainant's registered BANKWEST word marks, which is also the dominant element of its BANKWEST formative word marks and composite marks. As usual, the Top-Level Domain ".investments" is disregarded as a standard registration requirement. See id. section 1.11.2. The Panel finds, therefore, that the Domain Name is confusingly similar to the Complainant's registered marks for purposes of the Policy, paragraph 4(a)(i) and concludes that the Complainant has established the first element of the Complaint. page 4 B. Rights or Legitimate Interests Paragraph 4(c) of the Policy gives non-exclusive examples of instances in which a respondent may establish rights or legitimate interests in a domain name, by demonstrating any of the following: (i) before any notice to it of the dispute, the respondent's use of, or demonstrable preparations to use, the domain name or a name corresponding to the domain name in connection with a bona fide offering of goods or services; or (ii) that the respondent has been commonly known by the domain name, even if it has acquired no trademark or service mark rights; or (iii) the respondent is making a legitimate noncommercial or fair use of the domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue. Because a respondent in a UDRP proceeding is in the best position to assert rights or legitimate interests in a domain name, it is well established that after a complainant makes a prima facie case, the burden of production on this element shifts to the respondent to come forward with relevant evidence of its rights or legitimate interests in the domain name. See WIPO Overview 3.0, section 2.1. The Complainant has established trademark rights, a lack of permissive use, and the Respondent's use of the Domain Name for an email phishing scheme seeking personal information and copying the appearance of the Complainant's emails. Thus, the Complainant has made a prima facie case, and the burden of production shifts to the Respondent. The Respondent has not come forward with evidence of rights or legitimate interests, and none are apparent on this record. The Panel finds that the Respondent has not met the burden of production and concludes that the Complainant prevails on the second element of the Complaint. C. Registered and Used in Bad Faith The Policy, paragraph 4(b), furnishes a non-exhaustive list of circumstances that "shall be evidence of the registration and use of a domain name in bad faith", including the following (in which "you" refers to the registrant of the domain name): "(iv) by using the domain name, you have intentionally attempted to attract, for commercial gain, Internet users to your web site or other on-line location, by creating a likelihood of confusion with the complainant's mark as to the source, sponsorship, affiliation, or endorsement of your web site or location or of a product or service on your web site or location." This example is apposite in the circumstances of this proceeding, because the Respondent's email using the Domain Name is deliberately confusing as to source or affiliation (copying the Complainant's name, logo, address, and licensing details) and solicits financial business for the Respondent. But there is also the distinct possibility that the Respondent does not genuinely offer financial services and only used the Domain Name to phish for personal information, requesting detailed information and color copies of official identification documents, in furtherance of and ID theft and fraud scheme. This, too, would constitute bad faith within the meaning of the Policy. See WIPO Overview 3.0, section 3.4: "Panels have held that the use of a domain name for purposes other than to host a website may constitute bad faith. Such purposes include sending email, phishing, identity theft, or malware distribution." Notably, the Respondent began making such use of the Domain Name within a few days after registering the Domain Name, suggesting a considered plan and reinforcing the inference of bad faith in the registration as well as use of the Domain Name. page 5 The Panel finds bad faith on this record and concludes that the Complainant has established the third element of the Complaint. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Domain Name, , be transferred to the Complainant. /W. Scott Blackmer/ W. Scott Blackmer Sole Panelist Date: June 17, 2022
Full & Egal Universal Law Academy