blockintAI · Research blog

A $700,000 Deposit That Never Existed: Netzorn Bank, the Fake Online Bank in a Romance Scam

BlockintAI · 2026-10-20T11:42:50.084Z

BlockintAI research. The site's pages were captured on Sunday, October 18, 2026, at 9:58 PM Central Time (CT), and screenshotted at 6:38 AM CT on Monday, October 19. Registration (RDAP), DNS and web checks were re-run on October 19 between 7:12 AM and 7:16 AM CT and again at 7:00 PM CT, and the FDIC BankFind searches were run at 7:13 AM CT. Times are CT unless marked UTC.

On Sunday evening, October 18, 2026, at 8:25 PM CT, someone posted a warning in Reddit's r/Scams forum. Its title said a scammer had their father-in-law's personal information, and that there was "now a fake 700K deposit."

The father-in-law was recently widowed. According to the post, he met a woman on the dating site OurTime.com who said she was in her 40s and lived a few towns away. She said she was a sculptor working on a gallery project in Los Angeles, that a studio was paying her $700,000 for it, and that she wanted to split the money with him. All he had to do was open a bank account. The money would be deposited there, but he couldn't touch it until the project was 30% complete.

He gave her personal and financial details. Then, the poster wrote, "she had him open an account through a website called Netzorn and she sent him a screenshot that shows a $700K deposit, clearly photoshopped."

He opened that account on October 12. His credit report showed new inquiries starting the next day. The family had found all of this out that day. "I can barely find anything about this website online," the poster wrote.

This post is about that website. Netzorn calls itself a bank, and it isn't one. It is a stage prop, and props like it are a regular part of the romance-scam and pig-butchering playbook.

Key facts
The warning Reddit r/Scams, posted Oct 18, 2026, 8:25 PM CT, by a family member. A recently widowed man met a match on OurTime.com, opened an account "through a website called Netzorn" on Oct 12, and was sent a screenshot of a $700K deposit. He had already shared personal and financial details with the match. New credit inquiries started Oct 13. The post doesn't report money sent
The site netzorn[.]com, "Netzorn Bank." It advertises accounts, cards, loans, mortgages, insurance and private banking, and claims "36 Years of Experience," "5 Star Rating Bank," 50K+ personal customers, 400K+ business customers and 98 countries
Registration Registered through Hostinger (HOSTINGER operations, UAB) on Feb 2, 2026 (15:34 UTC). Hosted on Hostinger (AS47583). Earliest TLS certificates Aug 1 and Sept 30, 2026 (Let's Encrypt)
Address shown "531 Vine St. Poplar Bluff, MO 63901." In FDIC BankFind, that is the Poplar Bluff - Vine Street Facility Branch of Southern Bank (FDIC certificate 28332), a real bank with no stated connection to Netzorn
FDIC record for "Netzorn" None. BankFind has no institution or branch named Netzorn (checked Oct 19, 2026, 7:13 AM CT)
Contact details shown info@netzorn[.]com; a displayed number, 840-271-9117, whose click-to-call link in the page header dials a UK mobile number, +44 7897 070112; on the contact page, the email shown as info@netzorn[.]com links to the template placeholder support@example[.]com
Status The registration record was updated at 7:09 AM CT on Oct 19, 2026 and showed "client hold" by 7:12 AM CT (RDAP). By 7:15 AM CT the name no longer resolved. Still on hold and not resolving at 7:00 PM CT
BlockintAI report Netzorn Bank (netzorn[.]com): fake online bank used as a prop in a romance scam, published Oct 18, 2026, 10:27 PM CT

A bank that appeared in February

Netzorn's website looked like a bank's: a banner of a smiling man holding a card, "Open account" and "Log in" buttons, and menus for "Mobile & Web Banking," "Insurance Policies," "Home & Property Loan" and "Private Banking." The pitch is a modern, cross-border digital bank: "Your banking experience anytime, anywhere," and "As good as a bank branch within your phone or computer!"

Next to that sits a badge: "36 Years of Experience." The domain netzorn[.]com was registered on February 2, 2026, through Hostinger, according to its registration record (RDAP). The earliest web certificates for it were issued on August 1 and September 30, 2026. The site's own footer reads "Copyright 2026 by Netzorn Bank."

The counters on the homepage count up to 50K+ personal customers, 400K+ business customers and 98 countries supported. Its About page lists a "Mobile App" as "Coming soon." The testimonials come from "Michael Smith," "Julien Mills" and "Rolier Demonil," with nothing beyond a name and a one-line quote, and no dates.

None of that proves fraud on its own. Here's what does.

The address belongs to someone else

Every page of the site gives the same address: 531 Vine St., Poplar Bluff, MO 63901, United States.

The FDIC's BankFind database lists that exact address. It belongs to the Poplar Bluff - Vine Street Facility Branch of Southern Bank, FDIC certificate 28332. BankFind gives the branch's start date as July 1, 2019. Southern Bank itself is headquartered elsewhere in Poplar Bluff, at 2991 Oak Grove Road. BankFind lists it as established in 1887, FDIC-insured since August 9, 1989, with 69 offices. Its website is bankwithsouthern.com.

Netzorn doesn't use Southern Bank's name, logo or website. It just takes the street address of one of its branches. To anyone who looks it up on a map, that makes "Netzorn Bank" seem to have a real building in a real Missouri town. The building is someone else's.

We then searched BankFind for "Netzorn" itself, in both the institution list and the branch list. Neither had a match on the morning of October 19 (the FDIC data was last refreshed October 16, 2026). A search on that street address returns exactly one office, Southern Bank's.

FDIC-insured banks are listed in BankFind, and the FDIC says you can look them up "by name or website address." A "bank" with no BankFind record that borrows another bank's branch address is not a bank.

What the site never says

On its homepage, About, Contact and FAQ pages, as captured on October 18, Netzorn doesn't mention FDIC insurance, a bank charter, a regulator, a routing number or a SWIFT code. It names no executives and no parent company.

Its contact details don't line up either. Every page's header shows a phone number, 840-271-9117, but the click-to-call link behind it dials +44 7897 070112. That is a mobile number in the United Kingdom, for a "bank" that says it is on Vine Street in Missouri. On the contact page, the email address shown as info@netzorn[.]com actually links to support@example[.]com, a placeholder address reserved for documentation and left over from a website template.

The FAQ is template text too, and it contradicts the menu. It says you must be "16 years or older" to open an account. It says Netzorn doesn't check your credit history, because "we don't believe in making money based on debt and therefore don't support overdrafts." The same site's menus advertise overdrafts, personal loans, credit cards, residential mortgages and buy-to-let mortgages.

The site ran on a stock web-application setup, Laravel on Hostinger's servers, with Hostinger's default nameservers (dns-parking.com) and Hostinger mail servers. Its "Open account" and "Log in" buttons led to a member area at /user/register and /user/login. A member area like that can show whatever balance its operator types in.

Why a scammer needs a bank of their own

It's easy to see a fake bank as a fake bank and stop there. In this story it does several jobs at once, and each of them shows up in official warnings about romance scams.

1. The balance is the bait. A $700,000 deposit shown on a "bank" the scammer controls costs nothing to create. The poster called the screenshot "clearly photoshopped." Whether it was edited or the site really displayed that number, it was made to be shown, not spent. This is the same move fake trading platforms make. An investor alert issued jointly by the SEC, CFTC, FINRA and NASAA on September 10, 2024 warns that relationship scammers send "fake screenshots" or manipulate the target's online account so the gains look real, and that "depictions of skyrocketing account balances often are fake." In a pig-butchering case it's a trading dashboard showing profits. Here it's a bank showing a deposit.

2. Locked money sets up the fees. The money "can't be accessed until the project is 30% complete." A balance you can see but can't withdraw is how these scams build the next request. The same investor alert describes the pattern: when the target tries to withdraw, they're told "for the first time that they must pay more to cover fees or taxes." One person answering the Reddit post warned that the next step would be a request to send money back for "fees" or "taxes" before he could access it.

3. "Open an account" is a classic script. The FBI's Internet Crime Complaint Center (IC3) described this exact setup in a public service announcement on August 5, 2019. After a few months of building trust, the scammer "will tell the victim about a lucrative business opportunity," says investors are ready to fund it but "need a U.S. bank account to receive funds," and has the victim open an account in their own name. The FBI also warns that scammers "groom their victims over time and convince them to open bank accounts," and lists "claims to be recently widowed" among the common techniques. A studio paying $700,000 for an art project, split with a new partner, fits that script closely.

4. Identity first, credit next. The father-in-law handed over personal and financial details, and new credit inquiries began the day after he opened the Netzorn account. That is the part with real money at stake: credit and loans taken out in his name. The CFTC's romance-fraud page describes victims pushed into "emptying your retirement savings, getting a loan on your house, or borrowing from others." The FDIC Office of Inspector General's public service alert on money mules says the victims whose funds flow through mule accounts "are frequently older adults targeted through romance scams, 'pig butchering' cryptocurrency schemes" and impersonation schemes.

5. Accounts in the victim's name can be used to move other people's money. The CFPB defines a money mule as someone who "receives and moves money that came from victims of fraud." Its first rule for avoiding that is: "Don't open a bank account or cryptocurrency account at someone else's direction." The FDIC OIG adds that mules "can be criminally prosecuted and held financially accountable for victims' losses." Nothing in the Reddit post says the father-in-law's accounts were used this way. But an older adult who is told to open accounts and wait for incoming money is exactly who these schemes look for.

A fake bank is useful to a scammer because it looks like the safest kind of institution there is. People who would never send money to a crypto exchange they'd never heard of will open a bank account, especially when someone they trust tells them it's how the money will reach them.

The scale behind one family's story

Romance fraud is one of the costliest scams reported to U.S. agencies, and it falls hardest on older people.

  • The FBI's 2025 Internet Crime Report, released April 6, 2026, counts 23,159 confidence/romance fraud complaints in 2025, with $929,287,469 in reported losses. People aged 60 and over filed 10,188 of those complaints and reported $584,032,745 in losses. Across all crime types, people 60 and over reported about $7.7 billion lost.
  • The FTC said on April 27, 2026 that nearly 60% of people who reported losing money to a romance scam in 2025 said it started on social media. It noted that romance scammers often tailor their act to the target's profile, then invent a crisis or offer investment advice "to draw them onto a fake investment platform."

Those figures count only losses that people reported. The Netzorn warning came from a family member who caught it early, before any money was reported lost.

Netzorn's status on October 19

BlockintAI published a report on netzorn[.]com at 10:27 PM CT on October 18, about two hours after the Reddit warning.

At 7:09 AM CT on October 19, the domain's registration record changed, and by 7:12 AM CT it carried the status "client hold," which only the registrar, Hostinger, can set. A domain on client hold is pulled from the internet's address book. At 7:12 AM CT the hosting server, reached at its last known address, returned "403 Forbidden." By 7:15 AM CT Google's and Cloudflare's public DNS both returned "no such domain" for netzorn[.]com and www.netzorn[.]com. The registration itself runs until February 2, 2027. At 7:00 PM CT on October 19 the hold was still in place and the name still did not resolve.

A hold stops new people from reaching the site. It doesn't undo what was already handed over. The people running Netzorn still have whatever was typed into its account form, and the contact behind it still has the documents that were sent. They can also set up a new site under a new name. That's why the steps below matter more than any single takedown.

How to check a "bank" in two minutes

  • Search FDIC BankFind at banks.data.fdic.gov/bankfind-suite/bankfind. Search the bank's name, and also its web address: The FDIC says BankFind lets you look up banks "by name or website address." The FDIC warns that criminals "create fake bank websites to mislead and entice people into transferring money or disclosing personal information," some even using the "Member FDIC" logo. If nothing comes up, call the FDIC at 1-877-ASK-FDIC (1-877-275-3342) and ask.
  • Search the address, too. In BankFind, look up branches in the city on the site. If the street address belongs to a different bank, that settles it.
  • For credit unions, use the NCUA's Credit Union Locator at mapping.ncua.gov.
  • Check the domain's age. The CFTC suggests looking up "the site's domain registration to see if its age matches its claims." A bank claiming 36 years on a domain that's eight months old fails that test.
  • Never open an account because someone you met online asked you to, and never open one through a link they sent. A real bank is one you find yourself, in BankFind or through the phone number on your own card.
  • A screenshot is not money. Neither is a balance on a website you were sent to. If money really arrived, your own bank, the one you already use, will show it.

If personal details have already been shared

The FBI's advice is simple: "Never share your Social Security number or other personally identifiable information that can be used to access your accounts with someone who does not need to know this information." If that has already happened:

  • Freeze credit at all three bureaus, Equifax, Experian and TransUnion. The FTC notes it's free, doesn't affect the credit score, and "nobody can open a new credit account in your name" while it's in place. A fraud alert can be added on top.
  • Report the identity theft at IdentityTheft.gov, which gives a personal recovery plan.
  • Contact any lender that pulled credit to stop pending applications, and call any loan servicer, using numbers you look up yourself. Ask the person's bank to watch for new payees, large transfers and new accounts.
  • Stop sending money and stop moving money for anyone. If you suspect you've been used to move funds, the FDIC OIG says to "stop all transactions at once," contact your bank and report it to the FBI's IC3; the IC3 says to ask your bank to stop or reverse the transactions.
  • Call the National Elder Fraud Hotline at 833-FRAUD-11 (833-372-8311), run by the U.S. Department of Justice for victims aged 60 and over. It's free and staffed Monday to Friday, 10 AM to 6 PM Eastern.
  • Report it. In the U.S., report to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, and tell the dating site where the contact started. If you've been scammed, also file a report at blockint.ai with the website, the profile names, the phone numbers and any payment details. It's free, and anonymous reports are accepted.

The hardest part of this story is in the post's last lines. The father-in-law "genuinely believes she's real and isn't receptive to warnings." That is common, and it's what the scammer counts on. The FTC's advice is to talk to someone you trust, and to search the person's story and photos online. In this case the family had already done that: a reverse image search turned up the woman's photo on someone else's social media page. Family members who keep the conversation open, without blame, often get further than any single piece of evidence.

#RomanceScam #ElderFraud #FakeBank

Sources

The public warning

The site, its registration and current status

FDIC records

Official warnings and guidance