The Complainant is The Royal Bank of Scotland Group Plc of London, United Kingdom of Great Britain and Northern Ireland (“UK”), represented by Melbourne IT Digital Brand Services, Sweden.
The Respondent is PrivacyProtect.org Domain Admin of Nobby Beach, Queensland, Australia / lois duncan (mmg lois) of Austin, Texas, United States of America (the “United States”).
The disputed domain name <rbssbk.com> (the “Domain Name”) is registered with The Registry at Info Avenue, LLC d/b/a Spirit Telecom (the “Registrar”).
The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on February 8, 2013. On February 8, 2013, the Center transmitted by email to the Registrar a request for registrar verification in connection with the Domain Name. On February 15, 2013, the Registrar transmitted by email to the Center its verification response disclosing registrant and contact information for the Domain Name which differed from the named Respondent and contact information in the Complaint. The Center sent an email communication to the Complainant on February 19, 2013 providing the registrant and contact information disclosed by the Registrar, and inviting the Complainant to submit an amendment to the Complaint. The Complainant filed an amendment to the Complaint on February 24, 2013.
The Center verified that the Complaint together with the amendment to the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”).
In accordance with the Rules, paragraphs 2(a) and 4(a), the Center formally notified the Respondent of the Complaint, and the proceedings commenced on February 26, 2013. In accordance with the Rules, paragraph 5(a), the due date for Response was March 18, 2013. The Respondent did not submit any response. Accordingly, the Center notified the Respondent’s default on March 19, 2013.
The Center appointed Nicholas Smith as the sole panelist in this matter on April 4, 2013. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7.
The Complainant is a banking company incorporated in Scotland. The Complainant was founded in Edinburgh by Royal Charter in 1727 and is one of the oldest banks in the UK. It was incorporated as a public limited company in the UK in 1968. The Complainant offers retail banking services throughout Scotland and offers its financial services worldwide.
The Complainant offers its services under the name RBS (the “RBS Mark”) and has registered the RBS Mark as a trade mark since at least 2006. It holds trade mark registrations for RBS in over 100 countries around the world, including in the United States and Australia, the locations of the Respondent.
The Domain Name <rbssbk.com> was created on November 8, 2012. It is currently inactive however prior to the commencement of this proceeding, on November 9, 2012, it revolved to a web site (“Respondent’s Website”) that mimicked the design of the Complainant’s website and was used as part of a “phishing” attack on the Complainant’s customers, seeking to persuade the Complainant’s customers to divulge sensitive financial data to the Respondent.
The Complainant makes the following contentions:
(i) that the Domain Name is identical or confusingly similar to the Complainant’s RBS Mark;
(ii) that the Respondent has no rights nor any legitimate interests in respect of the Domain Name; and
(iii) that the Domain Name has been registered and is being used in bad faith.
The Complainant is the owner of the RBS Mark. It owns trade mark registrations for the RBS Mark in the UK, United States and around the world. The RBS Mark is in possession of substantial inherent and acquired distinctiveness. The awareness of the trademark RBS is considered in large parts of the European Union to be significant.
The dominant part of the Domain Name comprises the term “RBS”. The addition of the suffix “sbk” will not have any impact on the overall impression of the dominant part of the Domain Name. In Dr. Ing. h.c. F. Porsche AG v. Rojeen Rayaneh, WIPO Case No. D2004-0488, it was stated that it is long-established under UDRP that confusing similarity is generally recognized when well-known trademarks are paired up with different kinds of generic prefixes and suffixes. The likelihood of confusion includes an obvious association with the trademark of the Complainant. With reference to the reputation of the RBS Mark, there is a considerable risk that Internet users will perceive the Domain Name either as a domain name owned by the Complainant or that there is some kind of commercial relation between the Respondent and the Complainant.
The Respondent has no rights or legitimate interests in the Domain Name. The Respondent has no trade mark rights or licence to use the RBS Mark, nor is it commonly known by the Domain Name. The Respondent has not used or made preparations to use the Domain Name in connection with a bona fide offering of goods and services, nor is the Respondent making a legitimate noncommercial or fair use of the Domain Name.
In fact, the Respondent has used the Domain Name to pass itself off as the Complainant in order to defraud Complainant’s customers through a fraudulent website identical to the Complainant’s. The Respondent used the Domain Name to “phish” for financial information in an attempt to defraud the Complainant’s customers.
The Respondent’s attempt to pass itself off as the Complainant and “phish” for customers’ financial information is neither a bona fide offering of goods or services, nor a legitimate noncommercial or fair use pursuant to Policy.
The Domain Name was registered and is being used in bad faith. By including the RBS Mark in the Domain Name, the Respondent was using the Domain Name to deceive the Complainant’s customers and manipulate them into divulging sensitive financial information. Thus, the Respondent’s use of the Domain Name constitutes bad faith registration and use under the Policy. Even if the Domain Name is currently inactive, such passive holding could still constitute an act of bad faith and any realistic use of the Domain Name by the Respondent would constitute passing off and/or trademark infringement. The Respondent is committing a criminal offence and misleadingly diverting Internet users for his own commercial gain.
The Respondent did not reply to the Complainant’s contentions.
To prove this element, the Complainant must have trade or service mark rights and the Domain Name must be identical or confusingly similar to the Complainant’s trade or service mark.
The Complainant is the owner of the RBS Mark, having registrations for RBS as a trade mark across the European Union.
The Domain Name consists of the RBS Mark “RBS” combined with the suffix “sbk”.
The case of Dr. Ing. h.c. F. Porsche AG v. Rojeen Rayaneh, WIPO Case No. D2004-0488 sets out the broad principle that the addition of a generic suffix to a complainant’s trade mark will not prevent a finding of confusing similarity. The present proceeding involves a generic suffix being added to the RBS Mark.
Furthermore, in determining whether a domain name and complainant’s mark are confusingly similar, in some circumstances a respondent’s conduct can be relevant in making such a determination, see Fort Lee Chamber of Commerce v. Carmine A DeMarco, WIPO Case No. D2002-0291 and BAA plc, Aberdeen Airport Limited v. Mr. H. Hashimi. WIPO Case No. D2004-0717. If it is clear that a respondent registered a domain name with a specific intention of creating Internet user confusion between it and a complainant, it may be relevant to the Panel’s determination that a domain name is confusingly similar to that complainant’s mark, see paragraph 1.2 of the WIPO Overview WIPO Panel Views on Selected UDRP Questions (“WIPO Overview 2.0”).
In the present proceeding the Respondent has used the Domain Name for a phishing web site. Potential customers of the Complainant have been directed to the Respondent’s Website by link and encouraged to part with confidential information. The Respondent’s Website has presented itself as that of the Complainant and reproduces the RBS Mark.
When deciding to register the Domain Name the Respondent presumably came to the conclusion that there would be a risk that Internet users who see the Domain Name would believe there to be a real connection between the Domain Name and the Complainant and/or its goods and services. In such circumstances, the Panel finds this relevant to its assertions of intention to create confusion, and that the Domain Name is confusingly similar to the Complainant’s RBS Mark. Consequently, the requirement of paragraph 4(a)(i) of the Policy is satisfied.
To succeed on this element, a complainant must make out a prima facie case that a respondent lacks rights or legitimate interests in a domain name. If such a prima facie case is made out, then the burden of production shifts to the respondent to demonstrate rights or legitimate interests in the domain name.
Paragraph 4(c) of the Policy enumerates several ways in which a respondent may demonstrate rights or legitimate interests in a domain name:
“Any of the following circumstances, in particular but without limitation, if found by the panel to be proved based on its evaluation of all evidence presented, shall demonstrate your rights or legitimate interests to the domain name for purposes of paragraph 4(a)(ii):
(i) before any notice to you of the dispute, your use of, or demonstrable preparations to use, the domain name or a name corresponding to the domain name in connection with a bona fide offering of goods or services; or
(ii) you (as an individual, business, or other organization) have been commonly known by the domain name, even if you have acquired no trademark or service mark rights; or
(iii) you are making legitimate non-commercial or fair use of the domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue.”
The Respondent is not affiliated with the Complainant in any way. It has not been authorized by the Complainant to register or use the Domain Name or to seek the registration of any domain name incorporating the RBS Mark or a mark similar to the RBS Mark. There is no evidence that the Respondent has used or made demonstrable preparations to use the Domain Name in connection with a bona fide offering of goods or services or for a legitimate noncommercial use.
Rather it appears that the Respondent is using the Domain Name to operate a website that, without the permission of the Complainant, passes itself off as the Complainant’s official website in order to defraud the Complainant’s customers by persuading them to provide them with their banking details. Such conduct is generally known as “phishing” and does not amount to a bona fide offering of goods and services.
The Complainant has established a prima facie case that the Respondent lacks rights or interests in the Domain Name. The Respondent has had an opportunity to rebut the presumption that it lacks rights or legitimate interests but has chosen not to do so. The Panel finds that the Respondent has no rights or legitimate interests in respect of the Domain Name under paragraph 4(a)(ii) of the Policy.
For the purposes of paragraph 4(a)(iii) of the Policy, the following circumstances, in particular but without limitation, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith:
(i) circumstances indicating that the Respondent has registered or has acquired the Domain Name primarily for the purpose of selling, renting, or otherwise transferring the Domain Name’ registration to the Complainant who is the owners of the trade mark or service mark or to a competitor of the Complainant, for valuable consideration in excess of its documented out-of-pocket costs directly related to the Domain Name; or
(ii) The Respondent has registered the Domain Name in order to prevent the owner of the trade mark or service mark from reflecting the mark in a corresponding domain name, provided that the Respondent has engaged in a pattern of such conduct; or
(iii) The Respondent has registered the Domain Name primarily for the purpose of disrupting the business of a competitor; or
(iv) by using the Domain Name, the Respondent has intentionally attempted to attract, for commercial gain, Internet users to its web site or other on-line location, by creating a likelihood of confusion with the Complainant’s mark as to the source, sponsorship, affiliation, or endorsement of the Respondent’s web site or location or of a product or service on the Respondent’s web site or location. (Policy, paragraph 4(b))
The Panel finds that it is likely that the Respondent was aware of the Complainant and its reputation in the RBS Mark at the time the Domain Name was registered. The Respondent’s Website contains numerous references to the Complainant, its RBS Mark and attempts to pass itself off as the Complainant. The registration of the Domain Name in awareness of the Complainant’s Mark and in the absence of rights or legitimate interests amounts under these circumstances to registration in bad faith.
The Respondent had used the Domain Name to intentionally attempt to attract, for commercial gain, Internet users to the Respondent’s web site, by creating a likelihood of confusion with the Complainant’s Mark as to the source, sponsorship, affiliation or endorsement of its website. The Respondent’s Website has been used as part of a broader phishing campaign, to deceive the Complainant’s customers and manipulate them into divulging sensitive financial information. This means that the Respondent likely receive a financial reward from Internet users who visit the Respondent’s Website under the impression (created by the Domain Name and the content of the Respondent’s Website) that it is somehow connected to the Complainant. The Panel finds that such use amounts to use in bad faith. The Panel’s finding is not changed by the fat that the Domain Name appears to presently be passively held.
Accordingly, the Panel finds that the Respondent has registered and is using the Domain Name in bad faith under paragraph 4(a)(iii) of the Policy.
For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the Domain Name <rbssbk.com> be transferred to the Complainant.
Nicholas Smith
Sole Panelist
Date: April 15, 2013