Timeshare Owner? Mexican Drug Cartels Want You – Krebs on Security

The FBI is warning timeshare owners to beware of a widespread telemarketing scam involving a violent Mexican drug cartel that attempts to trick senior citizens into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 in an ongoing timeshare fraud scheme that involves at least two dozen bogus escrow, title and real estate companies.

One evening in late 2022 someone called Mr. and Mrs. Dimitruka retired couple from Ontario, Canada and asked if they had ever considered selling their timeshare in Florida. The person on the phone referred to their timeshare address and said they had an interested buyer in Mexico. Would they possibly be interested in selling?

The Dimitruks had bought the timeshare years ago, but it wasn’t fully paid off — they still had to pay about $5,000 before they could legally sell it. That wouldn’t be a problem for this buyer, the man on the phone assured them.

Within a few days, their contact at an escrow company in New York called currencyescrow(.)llc faxed them forms to fill out and return to begin the process of selling their timeshare to the potential buyer who had offered an amount that was higher than the value of the property.

After certain forms were signed and faxed, the Dimitruks were asked to make a small wire transfer of over $3,000 to cover “administrative” and “processing” costs, supposedly so the sale wouldn’t be held up by red tape in Mexico.

These document exchanges continued for nearly a year, during which time the agents made additional financial demands, such as tax payments on the sale and various administrative fees. Mrs. Dimitruk even sent them a $5,000 wire to pay off her remaining balance on the timeshare they thought they were selling.

In a telephone interview with KrebsOnSecurity, Mr. Dimitruk said they lost more than $50,000.

“They kept calling me after that and saying, ‘Hey, your money is waiting for you here,’” she said Willem Dimitruka 73-year-old retired long-haul truck driver. “They said, ‘We’re going to have problems if the money isn’t returned to you,’ and gave me a toll-free number to call them.”

During the last conversation he had with the scammers, the man on the other end of the line confessed that bad people had worked for them in the past, but that those employees had been fired.

“Towards the end of the conversation he said, ‘You’ve been dealing with some bad people and we fired all those bad guys,’” Dimitruk recalled. “So they were like, yeah, it’s all good. You can pay us more and we’ll send you your money.”

According to the FBI, there are indeed some very bad people behind these scams. The FBI warns that the timeshare fraud schemes have been linked to the Jalisco New Generation drug cartel in Mexico.

In July 2024, the FBI and the Treasury Department Financial Crime Enforcement Network (FinCEN) warned that the Jalisco Cartel runs boiler room-like call centers that target elderly timeshare owners:

“Mexico-based (transnational criminal organizations) such as the Jalisco New Generation Cartel are increasingly targeting U.S. timeshare owners in Mexico through complex, often multi-year telemarketing, impersonation, and prepayment schemes. They use the illicit proceeds to diversify their revenue streams and fund other criminal activities, including the production and trafficking of illicit fentanyl and other synthetic drugs in the United States.”

A July 2024 CBS News article on the scam said that U.S. and Mexican officials confirmed last year that as many as eight young workers were killed after trying to quit their jobs at a Jalisco Cartel call center.

The fake escrow company the Dimitruks dealt with — currencyescrow(.)llc — is no longer online. But the documents their contact there sent pointed to a few other still-active domains, including real estate assets(.)com

The original registration data of both domains points to a different domain: datasur(.)host — which is associated with dozens of other real estate and escrow-themed domains going back at least four years. Some of these domains are no longer active, while others were previously suspended by various hosting providers.

061nyr(.)net
061-newyorkrealty(.)net
1nydevelopersgroupllc(.)com
1oceanrealtyllc(.)com
advancedclosingservicesllc(.)com
americancorporatetitle(.)com
asesorialegalsiglo(.)com
atencion-tributaria.()com
carolinasctinc(.)net
closingandsettlementservices(.)com
closingandsettlementsllc(.)com
closingsettlementllc(.)com
crefaescrowslimited(.)net
currencyescrow(.)llc
empirerllc(.)com
fiduciarocitibanamex(.)com
fondosmx(.)org
vrachtescrowcollc(.)com
goldmansachs-investment(.)com
hgvccorp(.)com
infodivisionfinanciera(.)com
internationaladvisorllc(.)com
jadehillrealtyllc(.)com
lewisandassociaterealty(.)com
nyreputable(.)org
privateinvestment.com(.)co
real estate assets(.)com
vastgoedisinc(.)com
settlementandmanagement(.)com
stllcservices(.)com
stllcservices(.)net
thebluehorizonrealtyinc(.)com
walshrealtyny(.)net
windsorre(.)com

By loading ecurrencyescrowllc(.)com into the Wayback Machine at archive.org, we can see text at the top of the page that reads: “Visit our Resource Library for videos and tools designed to make managing your escrow payouts a breeze.”

If you search for that piece of text on publicwww.com, you will see that the same text appears on the website of an escrow company called Escshieldsecurity network (escshieldsecurity(.)com). This entity claims to have been around since 2009, but the domain itself is less than two years old and there is no contact information associated with the site. The Pennsylvania Secretary of State also has no record of a business with this name at the listed address.

Incredibly, Escshieldsecurity presents itself as a solution to timeshare scams.

“By 2015, cyber thieves had realized the scale of the money involved and targeted the real estate, title and settlement industries,” the company’s website states. “As financing became more complex and risky, agents and underwriters had little time or resources to keep up. The industry needed a simple solution that would help them keep pace with the new demands of financing security.”

The domains associated with this scam often point to legitimate companies and licensed professionals in the real estate and closing industry, but those real professionals often have no idea they are being impersonated until someone asks around. The truth is that the original reader tip that caused KrebsOnSecurity to investigate this scheme came from one such professional whose name and reputation was being used to scam others.

It’s unclear whether the Dimitruks were robbed by people working for the Jalisco Cartel, but it’s clear that whoever was responsible for managing many of the domains mentioned above — including the DNS provider datasur(.)host — recently compromised their computers with information-stealing malware.

That’s according to data collected by breach-tracking service Constella Intelligence (Constella is currently an advertiser on KrebsOnSecurity). Constella discovered that someone using the email address listed in the DNS records for datasur(.)host — [email protected] — was also stripped of credentials for managing most of the aforementioned domains at a Mexican hosting provider.

It is not uncommon for victims of these scams to remain silent about their misfortune. Sometimes it is shame and embarrassment that prevents victims from reporting the crime to local authorities. But in this case, victims who learn they have been robbed by a violent drug cartel have even more reason to remain silent.

William Dimitruk acknowledged that he and his wife have not yet filed a police report. But after recognizing that it could help prevent harm to other potential victims, Dimitruk said he would consider it.

There’s another reason why victims of these scams should alert the authorities: Every once in a while, federal authorities will bust one of these scams and seize money stolen from victims. But those investigations can take years, and it can take years more for the government to figure out who was scammed and how to reward victims. All too often, the real obstacle to recouping some of those losses is that federal authorities have no idea who the victims are.

If you are a victim of such a timeshare scam, consider filing a report with the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov. Other places victims may want to file a complaint include:

Federal Trade Commission – https://www.ftccomplaintassistant.gov
International Network for Consumer Protection and Enforcement – https://www.econsumer.gov/nl
Profeco – Mexican Attorney General – https://consulmex.sre.gob.mx/montreal/index.php/en/foreigners/services-foreigners/318-consumer-protection