What happened:: We are a German cosmetics business. We received an unsolicited “partnership” approach where the scammers claimed they were an intermediary for a client who would wire a large payment for product at retail price, and then we would pay the intermediary’s “commission” (requested only in crypto). They impersonated a legitimate UK company (Dream Property Holdco Limited; Company No. 10638851) by using real directors/address details, but contacted us from a mismatching Spanish phone number and a look-alike email domain. They then redirected us to a second impersonated “Swiss finance” entity (“CFT Swiss”) to “finalize the contract.” After months of calls, they pushed for an in-person meeting in Barcelona and later attempted to get us on a live Google call to scan a QR code shown on a second phone. The decoded QR was a WalletConnect pairing URI; the next step was intended to prompt a small token transaction (e.g., “1 USDC”) but function as a malicious DApp approval/drain. We did not scan/approve, did not send funds, and ceased communication. We reported this to the authorities in Spain and Switzerland; their domains have been taken down and multiple fraud teams are investigating. The Domain registrant has provided data to the police team, but I wanted to make these details searchable to is someone ChatGPTs this, these names and domains are flagged as fraudulant
Scammers Profile Link: N/A (not a forum user; contact was via email/WhatsApp/Google call).
Identifiers used by the scammers:
* Email domain: dream-property-holdco.com (used as “[
info@dream-property-holdco.com](mailto:info@dream-property-holdco.com)”)
* Phone/WhatsApp: +34 610 757763
* Impersonated names used in signature: “Mr. Russell Morris” / “Mrs. Emma L. Morris”
* Impersonated entity name used: “Dream Property Holdco Limited” (UK)
Reference Link: Impersonation / look-alike domains used:
* [https://www.cft-swiss.com/](
https://www.cft-swiss.com/)
Legitimate companies being impersonated (for comparison):
* Dream Property Holdco Limited (UK Companies House listing for Company No. 10638851)
* Compagnie Financière Tradition / Tradition: [https://www.tradition.com/](
https://www.tradition.com/)
Amount Scammed: 0 (attempted scam; no payment made). Intended target: large bank wire for goods + crypto “commission,” followed by a WalletConnect/DApp approval drain attempt.
Payment Method: Planned flow pushed by scammers:
* Bank wire to us (purported “client funds” for cosmetics order)
* Crypto transfer from us to scammers (“commission”)
* WalletConnect pairing + subsequent DApp approval/USDC prompt intended to enable wallet draining
Proof of Payment: None (no payment sent).
Technical artifact from the attempt (decoded QR / WalletConnect URI):
wc:387b98840d043403e7d640f47622b1cb415ad5c2a8dc3e71ae30b31b0e696401@2?relay-protocol=irn&symKey=3ca831d23b3529a0fdec57d6a3bb837bb32c93e4e6d9862c2ed0b3f711188639&expiryTimestamp=1767022423
PM/Chat Logs: Available but not posted here (email thread(s), WhatsApp messages, and Google call details). We also have a meeting record from Barcelona and an image of one participant (not posted publicly).
Additional Notes: * Indicators of impersonation: legitimate UK company details reused, but mismatching phone number (+34) and mismatching email domain (dream-property-holdco.com).
* Second-stage impersonation: “CFT Swiss” using cft-swiss.com while the legitimate firm is Compagnie Financière Tradition (tradition.com).
* Names presented by the scammers as “team members” included a mix of apparently stolen identities (real people unrelated to the transaction) and fabricated names (e.g., “Hans Muster” as a placeholder-style name).
* The QR was displayed on a second phone during a live call, consistent with an attempt to reduce traceability and push rapid scanning/approval.
* Location: Barcelona, Spain; main communication language: German.
