The US Department of Justice (DoJ) in cooperation with Estonian authorities, has taken action against a web domain and database used in a large-scale bank account takeover fraud targeting Americans.
According to the DoJ, the seized domain (web3adspanels[.]org), served as a backend control panel that stored and managed illegally harvested bank login credentials. Prosecutors said the criminal group behind the scheme used fraudulent ads on search engines such as Google and Bing that closely mimicked legitimate bank ads. Victims who clicked on the ads were redirected to fake bank websites, where their login credentials were stolen. The pilfered information was then used to access real bank accounts and steal funds.
The scheme is believed to have affected at least 19 victims across the United States, resulting in attempted losses of about $28 million and confirmed losses of approximately $14.6 million. Investigators said the seized domain contained login credentials belonging to thousands of victims and was actively facilitating fraud as recently as last month.
In a separate case, federal prosecutors unsealed a nine-count indictment against Zahid Hasan, 29, of Dhaka, Bangladesh. Hasan is accused of operating illegal online marketplaces TechTreek and EGiftCardStoreBD that sold digital templates of fake government-issued identity documents, including US passports, Social Security cards, and driver’s licenses.
Hasan faces six counts of transferring false identification documents, two counts of false use of a passport, and one count of Social Security fraud. If convicted, he could face up to 15 years in prison on each of the first eight counts and up to five years on the Social Security fraud charge, along with substantial fines.
Prosecutors allege that between 2021 and 2025, Hasan sold fraudulent document templates to customers worldwide, accepting cryptocurrency payments such as Bitcoin. Authorities estimate he earned more than $2.9 million from over 1,400 customers. As part of the investigation, the US seized three domains linked to the operation: techtreek[.]com, egiftcardstorebd[.]com, and idtempl[.]com.