ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION Kroo Bank Ltd v. David Bates Case No. D2023-3030 1. The Parties The Complainant is Kroo Bank Ltd, United Kingdom, represented by Dentons UK and Middle East LLP, United Kingdom. The Respondent is David Bates, United States of America. 2. The Domain Name and Registrar The disputed domain name is registered with NameCheap, Inc. (the "Registrar"). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the "Center") on July 14, 2023. On July 14, 2023, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain name. On July 14, 2023, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the disputed domain name which differed from the named Respondent (Redacted for Privacy) and contact information in the Complaint. The Center sent an email communication to the Complainant on July 17, 2023, providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amended Complaint on July 18, 2023. The Center verified that the Complaint together with the amended Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the "Policy" or "UDRP"), the Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules"), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the "Supplemental Rules"). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on July 26, 2023. In accordance with the Rules, paragraph 5, the due date for Response was August 15, 2023. The Respondent did not submit any response. Accordingly, the Center notified the Respondent's default on August 18, 2023. The Center appointed Warwick Smith as the sole panelist in this matter on August 25, 2023. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. page 2 4. Factual Background The Complainant is a digital-only bank, based in London, United Kingdom. It was incorporated on September 5, 2016. Since then, its business and related activities have been extensively reported on in the media, including in recent articles in The Sunday Times, and in This is Money, and Finextra. The Complainant started its commercial operations with 23,000 users of its prepaid debit cards, but the Sunday Times article (June 25, 2022) noted that the Complainant had by then obtained a full banking license, and that existing users of its prepaid debit cards would soon be able to move to current accounts with overdraft facilities. The Complainant markets its digital banking services through its website at "www.kroo.com". One of the website's features is the use of pink text against a dark background to emphasise particular branding or statements where impact is sought - for example, the depiction of the KROO device mark referred to below, the statement "Let's change banking for good", and the statement "Join Kroo today". The Complainant is the proprietor of a number of registered trade marks, comprising or including the expression "Kroo". It registered the word mark KROO in the United Kingdom on June 28, 2019 (registration number UK00003390486), and in the United States of America on July 21, 2020 (registration number 6104948). In each case, the registrations covered various goods and services in International Classes 9, 35, 36 and 42. A figurative version of the KROO mark (consisting of the word "KROO", in which the letters "KR" appear in stylized, sans serif, upper case type, and the letters "OO" are signified by one shape made up of two connected circles, the second circle being larger than the first) - "the KROO device mark" - was registered in the United States of America on November 8, 2022 (registration number 6891867). This registration covers goods and services in the same classes. The Complainant is also the registered proprietor of the work mark KROO BANK in the United Kingdom (registered on February 17, 2023, under number UK00003844923). The disputed domain name was registered on June 19, 2023. It resolves to a website (the Respondent's "website"), a copy of which was produced by the Complainant with its Complaint. The Respondent's website featured the prominent use of a logo consisting of a small pink circle containing two "inverted arrows" (in the form "<<"), followed by the word "Kroocapitals" in stylized pink lettering, set against a dark grey or black background. In similar style, the statement "Get started today" appeared in pink lettering set against a dark background, as did a click-on "Sign in" box. There was little or no detail of any particular financial services offered by the Respondent, but the Respondent's website did contain the words "Better Loans for your business", partially in pink lettering against the same grey / black background. Immediately below those words, in smaller white lettering, were the words: "Access to a variety of investment opportunities that suit your financial goals." The Respondent's website then contained a "How it works" section. The "How it works" section contained subheadings including "Fund your account", "Request card", and "Send money anywhere". Under the "Fund your account" subheading, it appeared that the Respondent was offering savings accounts for individuals needing reliable and convenient banking services. The "Request card" section advised that a card requested by a user would be delivered to the user's doorstep "anywhere in the world". Under the "Send money anywhere" subheading, the site visitor was told that he or she could carry out banking actions effectively, including sending money to any bank. The Respondent's website also contained the following statement: "Kroocapitals is a subsidiary of Kroocapital Bank, trusted by Many Business, Freelancers and People World Wide. If you like to try us out." There was a copyright claim dated 2023 on the Respondent's website, asserting that the copyright was owned by "Kroocapitals bank". page 3 The other feature of the Respondent's website that should be mentioned, was the "Sign in to account" section on the last page. This section contained spaces for the user to enter a username and password. Immediately below those spaces, the site user was offered "Remember password" and "Forgot password?" options that could be selected by clicking on the appropriate part of the text. In its Amended Complaint, the Complainant noted that the Respondent's website was only a homepage, and contained no effective option to create a new account. The "Sign in" section required the use of an existing username and password. The Complainant says that it ran Google searches on both "Kroocapitals" and "Kroocapital Bank". The searches failed to turn up any evidence of the existence of companies with those names (beyond referring to the Respondent's website). The Complainant says that, aside from the Respondent's website, there is no evidence that either "Kroocapitals" or "Kroocapital Bank" exist. The Complainant confirmed in the Amended Complaint that registration of the disputed domain name was not authorized by it, and that it has no affiliation or connection with the Respondent. 5. Parties' Contentions A. Complainant The Complainant first contends that the disputed domain name is confusingly similar to the KROO mark, in which it has rights. The Complainant's KROO mark is included in its entirety within the disputed domain name, and the mark is clearly the dominant element of the disputed domain name. The word "capital" is a common expression in the context of banking, used to refer to assets that can be liquidated to obtain cash or cash equivalents. The word is devoid of any distinctive character. Next, the Complainant says that the Respondent has no rights or legitimate interests in respect of the disputed domain name. He has no connection with the Complainant, and he has not been licensed or otherwise permitted to use the Complainant's KROO mark. There is no evidence that he is commonly known by the disputed domain name, and the companies or entities purportedly behind the Respondent's "business" appear to be non-existent. No business email address has been provided for the Respondent which might have indicated any association he might have had with the disputed domain name. The disputed domain name is not being used in connection with any bona fide offering of goods or services, or for any other legitimate purpose. Rather, the Respondent has registered the disputed domain name for the purpose of creating the false appearance that he has an affiliation with the Complainant. The Respondent's use of the Complainant's KROO mark, the color scheme adopted on the Respondent's website (pink on a dark background, evoking the Complainant's branding), and the fact that the products purportedly offered through the Respondent's website are similar to the products offered by the Complainant under its KROO mark, all suggest that the Respondent has been deliberately attempting to evoke associations with the Complainant's name, business offering, and branding. Furthermore, the fact that it is not possible to create a new account through the Respondent's website suggests that the Respondent's real target is not to sell financial products, but to collect log in details (and email addresses through the "Forgot password?" feature) of existing customers of the Complainant, with the intention of using these details to log in to the customers' kroo.com accounts and likely conduct fraudulent financial attacks. The use of such a feature is a tactic frequently used by fraudsters to entice users to divulge personal information (in this case, most likely to be login details and email addresses of the Complainant's existing customers, but possibly also addresses, identification, and debit or credit card details). Obtaining such information opens the door to fraudulent attacks on the customer, such as data extraction, identity theft, and unauthorized wire transfers. Finally, the Complainant says that the disputed domain name has been registered and is being used by the Respondent in bad faith. In addition to the contentions set out above, the Complainant contends that it is page 4 famous and that its KROO mark is widely known, and that the mere registration of a domain name that is identical or confusingly similar to a famous or widely known trade mark by an unaffiliated entity can by itself create a presumption of bad faith.0F1 The use of the word "capital" in the disputed domain name also corresponds to the Complainant's area of commercial activity (banking). The use of the Complainant's name as part of the logo on the Respondent's website, and the Respondent's use of almost exactly the same colors as appear on the Complainant's website, are designed to give the false impression that the Respondent's website originates from that Complainant, and that he is authorized to provide these financial products. That may deceive users into providing personal data to gain deeper access to the Respondent's website. B. Respondent The Respondent did not reply to the Complainant's contentions. 6. Discussion and Findings Under paragraph 4(a) of the Policy, a Complainant is required to establish each of the following: (i) the domain name is identical or confusingly similar to a trade mark or service mark in which the Complainant has rights; (ii) the Respondent has no rights or legitimate interests in respect of the domain name; and (iii) the domain name has been registered and is being used in bad faith. A. Identical or Confusingly Similar The Complainant has proved this part of the Amended Complaint. The Complainant is the registered proprietor of the word mark KROO in the United Kingdom, the European Union, and the United States. Those registrations are sufficient to establish rights in that mark for the purposes of paragraph 4(a)(i) of the Policy. The question under this part of the Policy is whether the disputed domain name is confusingly similar to the Complainant's KROO mark. The disputed domain name includes the Complainant's KROO mark without alteration, followed by the common English word "capitals". The consensus view of UDRP panels on the issue of confusing similarity where a complainant's mark is incorporated within a disputed domain name, is described as follows in The WIPO Overview of WIPO Panel Views on Selected UDRP Questions, third edition ("WIPO Overview 3.0"):1F2 "Where the relevant trade make is recognizable within the disputed domain name, the addition of other terms (whether descriptive, geographical, pejorative, meaningless, or otherwise) would not prevent a finding of confusing similarity under the first element." In this case, the KROO mark is clearly recognizable within the disputed domain name. The mark appears at the beginning of the disputed domain name, and it is followed by the English word "capitals". The confusing similarity between the disputed domain name and the Complainant's KROO mark is clear. 1 WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (WIPO Overview 3.0), at section 3.1.4. 2 WIPO Overview 3.0 at section 1.8. page 5 Finally under this heading, the Panel notes that generic Top-Level Domains ("gTLDs") such as ".com" are not normally taken into account in the comparison that is required by paragraph 4(a)(i) of the Policy. The gTLD is a technical requirement of registration, and is not normally considered to have legal significance in applying paragraph 4(a)(i).2F3 B. Rights or Legitimate Interests Paragraph 4(c) of the Policy set out a number of circumstances which, without limitation, may be effective for a respondent to demonstrate that it has rights to, or legitimate interests in, a domain name for the purposes of paragraph 4(a)(ii) of the Policy. The circumstances are: (i) Before any notice to [the respondent] of the dispute, use by [the respondent] of, or demonstrable preparations to use, the disputed domain name or a name corresponding to the disputed domain name in connection with a bona fide offering of goods or services; or (ii) Where [the respondent] (as an individual business or other organization) [has] been commonly known by the disputed domain name, even if [the respondent has] acquired no trade mark or service mark rights; or (iii) Where [the respondent is] making a legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain to misleadingly direct consumers or to tarnish the trade mark or service mark at issue. WIPO Overview 3.0 states the following on the burden of proof under paragraph 4(a)(ii) of the Policy: "While the overall burden of proof in UDRP proceedings is on the Complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the [often impossible] task of 'proving a negative', requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the disputed domain name. If the respondent fails to come forward with such relevant evidence, the complainant is deemed to have satisfied the second element." In this case, the Respondent has elected not to respond to the Complaint, and the issue is whether the Complainant has produced sufficient prima facie case that the burden of production should shift to the Respondent. If the Complainant's evidence does meet the prima facie case standard, the Respondent's failure to file a Response means that the Complainant must succeed on this part of the Amended Complaint. The Panel is satisfied that the Complainant has provided sufficient prima facie case that the Respondent has no rights or legitimate interests in respect of the disputed domain name. First, the disputed domain name is confusingly similar to the Complainant's KROO mark, and the Complainant has not authorized the Respondent to use that mark, whether in a domain name or otherwise. In the absence of any Response, it appears that the Respondent has not been using the disputed domain name in connection with any bona fide offering of goods or services. On the limited evidence available, it appears that the Respondent has probably not been offering any goods or services at all through the Respondent's website. The fact that it is apparently impossible to create a new account through the Respondent's website, or contact the Respondent to do so by some other means, suggest that this is indeed a scam operation, designed to trick the Complainant's existing customers into believing that they are at a website operated or approved by the Complainant, and to obtain from them personal details (when they use the "Forgot password?" function on the Respondent's website) for later fraudulent use. That view is 3 WIPO Overview 3.0, section 1.11.1. page 6 supported by the absence of any independent Google record of the existence of a "Kroocapitals", or "Kroocapital Bank", and the adoption of a color scheme on the Respondent's website for the "Kroocapitals" stylized name and logo, the "Sign in" icon, and the "Get started today" statement, that does seem to have been intended to evoke the style of parts of the Complainant's website. If (contrary to the appearance referred to above) some banking services are being provided through the Respondent's website, the Panel's view on the evidence provided is that the provision of such services has not been bona fide. First, the Respondent was obviously aware of the Complainant and its digital banking services when he registered the disputed domain name. The Complainant's KROO mark was registered in the United States of America (where the Respondent apparently resides) when the disputed domain name was registered, and it is most unlikely that he would have thought of the name "kroo" if he were not aware of the Complainant and its mark. And the fact that he intended to establish a website for a digital banking operation at the disputed domain name, which business would compete online in the same commercial field as the Complainant, makes it even less likely that he was unaware of the Complainant and its digital banking business. The confusing similarity between the disputed domain name and the Complainant's KROO mark, coupled with the use on the Respondent's website of the same color scheme to depict the logo and "Kroocapitals" name (and some prominent "action" statements) as is used on the Complainant's website to depict the KROO device mark and comparable "action" statements ("Get started today" (Respondent's website) versus "Join Kroo today" (Complainant's website), leave very little doubt that the Respondent was attempting to create the false impression of affiliation with the Complainant for which the Complainant contends. If the Respondent was in fact selling or attempting to sell financial services, the only sensible inference is that his intention in creating that false impression was to derive commercial gain from it, by trading off the Complainant's reputation in its KROO mark. That could never have been a bona fide use of the disputed domain name. There is nothing to suggest that the Respondent might have a right or legitimate interest under paragraph 4(c)(ii) of the Policy (respondent commonly known by the domain name). Nor does paragraph 4(c)(iii) of the Policy (legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain) appear to have any application. For the reasons set out above under this heading, the Respondent's use of the disputed domain name has been neither fair nor legitimate. Those matters in combination are sufficient to establish a prima facie case under paragraph 4(a) (ii) of the Policy. In the absence of any Response, the Complainant has therefore made out its case under paragraph 4(a) (ii) of the Policy. C. Registered and Used in Bad Faith Under paragraph 4(b) of the Policy, the following circumstances, without limitation, are deemed (if found by the Panel to be present) to be evidence of the registration and use of a domain name in bad faith: (i) Circumstances indicating that the holder has registered or has acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trade mark or service mark or to a competitor of that complainant, for valuable consideration in excess of the holder's documented out-of-pocket costs directly related to the domain name; or (ii) The holder has registered the domain name in order to prevent the owner of the trade mark or service mark from reflecting the mark in a corresponding domain name, provided that the holder has engaged in a pattern of such conduct; or (iii) The holder has registered the domain name primarily for the purpose of disrupting the business of a competitor; or (iv) By using the domain name, the holder has intentionally attempted to attract, for commercial gain, Internet users to the holder's website or other online location, by creating a likelihood of confusion with the complainant's mark as to the source, sponsorship, affiliation or endorsement of the holder's website or location or of a product or service on the holder's website or location. page 7 The Complainant has also sufficiently proved this part of the Amended Complaint. Substantially for the reasons set out in the preceding section of this decision, the Panel finds that the Respondent was almost certainly aware of the Complainant and its KROO mark when he registered the disputed domain name. The Panel is also satisfied that the Respondent registered the disputed domain name, and has been using it, in bad faith. The confusing similarity between the disputed domain name and the Complainant's KROO mark, the Respondent's use of the pink on dark color combination in some of the important branding devices used on the Respondent's website, and the claim on the Respondent's website that "Kroocapitals" is a subsidiary of a "bank" with a name incorporating the word "Kroo", all create the strong impression that the Respondent has intentionally attempted to attract Internet users to the Respondent's website by creating a likelihood of confusion with the Complainant's KROO mark as to the source, sponsorship, affiliation or endorsement of the Respondent's website. That is precisely the kind of bad faith registration and use described in paragraph 4(b)(iv) of the Policy, subject only to the requirement of the paragraph that the Respondent must have attempted to create the confusion for commercial gain. There can be little doubt about the Respondent's motive being for commercial gain. The first possibility is that the Respondent's intention was to set up a phishing or similar scam, obtaining personal identification details and other information from the Complainant's existing customers, who would provide that information (through the "Forgot password?" feature on the Respondent's website) in the mistaken belief that they were dealing with the Complainant. Anyone embarking on such a fraudulent scheme would almost certainly be doing so to (ultimately) make a commercial gain. The second possibility is that the Respondent has been selling genuine financial products. If he has, it may be readily inferred that he has been doing so with a view to making a profit on the sales, trading off the goodwill the Complainant has established in its KROO mark (including goodwill associated with the Complainant's status as a registered bank that is subject to prudential oversight in the United Kingdom). In either scenario, it appears to the Panel that the requirements of paragraph 4(b)(iv) of the Policy would be met. The Panel adds that if the Respondent's intention in registering and using the disputed domain name was to engage in a phishing or similar fraudulent scheme, that conduct would separately constitute bad faith registration and use of the disputed domain name, quite apart from the express provisions of paragraph 4(b)(iv) of the Policy. WIPO Overview 3.0 states at section 3.4: "Panels have held that the use of a domain name for purposes other than to host a website may constitute bad faith. Such purposes include sending email, phishing, identity theft. . . . Many such cases involve the respondent's use of the domain name to send deceptive emails. . .." An example of one such case is Aria Foods Amba v. Michael Guthrie M. Guthrie Building Solutions, WIPO Case No. D2016-2213.3F4 In that case, the respondent used the domain name in issue to send several emails impersonating an employee of the complainant to one of the complainant's customers, in furtherance of a fraudulent scheme. The panel in Aria Foods Amba noted that the examples of bad faith registration and use set out in paragraph 4(b) of the Policy are not meant to be exhaustive of all circumstances from which bad faith may be found. The overriding objective of the Policy was said to be to curb the abusive registration of domain names in circumstances where the registrant seeks to profit from and exploit the trade mark of another. On the facts of the case, the panel considered that bad faith registration and use was established under paragraph 4(b)(iii) of the Policy. The respondent's motive had been to capitalize on, or otherwise take advantage of, the complainant's trade mark rights, by creating a likelihood of confusion with the complainant's mark, with 4 Referred to by this Panel in his decision in Tetra Laval Holdings & Finance SA v. Evelyn Bryant Gen Cleaning, WIPO Case No. D2022-4264. page 8 the intention to unlawfully profit from what was an unlawful and fraudulent scheme directed at one of the complainant's customers. There are other indications of bad faith on the part of the Respondent in this case. The apparent absence of any online references to "Kroocapitals" or "Kroocapital Bank" (other than the sole Google hit referring to the website at the disputed domain name) raises an obvious question as to whether such entities really exist. Also, the Respondent's use of a privacy service in registering the disputed domain name is consistent with the overall impression of bad faith on the part of the Respondent. In combination, those matters provide sufficient proof on this part of the Amended Complaint. The Complainant having made out its case on all three of the elements of paragraph 4(a) of the Policy, there will be an order transferring the disputed domain name to the Complainant. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain name, , be transferred to the Complainant. /Warwick Smith/ Warwick Smith Sole Panelist Date: September 8, 2023
Full & Egal Universal Law Academy