This cluster centers on 2764 connected domains tagged as BeaverTail, Kaiji, fbf543. 645 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1132 phone numbers (7638857447, 8664372914, 2157987305) with 10266 FTC complaints; 146 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8616274 CFPB complaints; 298 email addresses (xxxxxxxxxxxxxxxxxxxxxxxx@vm...
(267) 917-8506
Last reported Mar 26, 2026
- 1 community report from users
Campaign Intelligence
This cluster centers on 2874 connected domains tagged as QuasarRAT, StealitStealer, pw-k53mv9bc. 652 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1375 phone numbers (2157987305, 2025069230, 2028641298) with 14635 FTC complaints; 160 companies (JPMORGAN CHASE & CO., Advanced Resolution Services Inc., EVERBANK, NATIONAL ASSOCIATION) with 8680419 CFPB complaints; 299 email addresses (abuse@fb.com, ...
This cluster centers on 1486 connected domains tagged as None, keylogger. 5 of these domains have been flagged by threat intelligence feeds including Google Safe Browsing and URLhaus. The connected infrastructure includes 1364 phone numbers (3124141737, 3163966869, 8553892999) with 17909 FTC complaints; 170 companies (EQUIFAX, INC., TRANSUNION INTERMEDIATE HOLDINGS, INC., BANK OF AMERICA, NATIONAL ASSOCIATION) with 8747332 CFPB complaints; 187 email addresses (xxxxxxxxxxxxxxxxxxxxxxxx@vmh5.grup...
This scam campaign operates through a coordinated network of six phone numbers that target consumers with impersonation schemes designed to steal personal and financial information. The primary number 2124795212 has generated 24 FTC complaints, while supporting numbers 2124973972 (11 complaints), 8883526864 (5 complaints), and 7712473441 (4 complaints) work in conjunction as part of the same campaign operations. Two additional numbers, 6026792050 and 2679178506, have been reported together with ...
Details
Linked Company Activity
Connected Entities
Community Reports
I was contacted by someone on a Chase Bank phone number: 212-497-3972. Note that this is an official Chase phone number as I called it back. They said they were from Chase Fraud and that my Zelle account had suspicious activity with two charges: one for $3k and one for $2k. He also said an iPhone 6 or 9 had attached itself to my account. He said that to remove the charges we would have to get into Zelle and initiate a cancellation process for each charge. He said that the Chase Fraud Case ID# was JPM2679178506. He then transferred my to someone named Mark Stevenson at a second Chase phone number: 212-479-5212. Again I checked this number out and it is a Chase phone number. Thus Chase's Phone system was hacked which allowed for this Fraud to happen. Mark led me through process in Zelle where IU input the numeric values of this 'cancellation' code into the $ amount window: CVC0049900. When I put this into the $ amount window it came out to $499. I questioned him about this and he said that it was part of the process. The person he had me send it to was Sherline Lherisson at (267)917-8506. He also asked me to put 5 capital letter in the notes section which he told me stood for something, and he said Sherline was the Chase fraud case manager. He had me take a picture of the transfer screen and txt it to (561)3136-6429 which he said was Sherline's number. He then had me get back into Zelle to try and initiate the second cancellation but Zelle only had $1 transfer capability for the rest of the day. Then he asked my what other online banking services I used and I told him Paypal and Venmo, and also told me I would need to go into a Chase branch at some point to show my ID. He then had me do a similar thing in Paypal where I input a 'cancellation code' that ended up totaling $1998. This time it was to Noricene Norelien and in the notes section he had me type 'F [BBB Scam Type: Bank/Credit Card Company Imposter] [Business: Chase Imposter]
Share Your Experience
What's Your Exposure?
Know your risk exposure to this message with a Thorough Analysis. It returns a detailed report covering the complaint history, your data breach exposure, related scam entities, and risk signals tied to this email message. Check the box and enter your email address now.
NordProtect — Identity theft monitoring and recovery
NordProtect watches for your personal info on the dark web, monitors your credit, and covers up to $1M in identity theft insurance.