Skip to main content

Fraud: Investments Corporation | Mrs. Faith Isabella, Investments corporation LTD

· 14 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

I am reaching out on behalf of a group of clients/investors who are seeking opportunities to invest or partner with credible real estate owners, Agents and developers. An anonymous investor approach whose only real question is whether you will reply.

Complete Email​

from: Mrs.Faith Isabella faithisbella01@faithi.com
to: info@secure-techie.com
reply-to: faithisbella01@faithi.com
date: 07/15/2026 2:50 AM
subject: Investments Corporation

Email Body​

Hello,

My name is Mrs. Faith Isabella , and I am reaching out on behalf of a group of clients/investors who are seeking opportunities to invest or partner with credible real estate owners , Agents and developers, industry/manufacturer in your country.

Before proceeding, I would like to inquire if your country’s investment and property laws permit foreign investors in your country.

Once I receive your confirmation, I will be pleased to connect directly with my Principal Mr. Towers Michael who has direct access to the investors.

Thank you for your attention, and I look forward to your response.

Warm regards,
Mrs. Faith Isabella
Facilitator
Investments corporation LTD
External Email

Attacking email screenshot

Red Flags​

This is advance-fee fraud in its opening posture — the 419 family, dressed for business rather than for a bereaved widow. There is no attachment, no link, and nothing to click, which is exactly why it survives filters that hunt for payloads. The entire message is engineered to extract one thing: a reply. Everything that costs the victim money happens later, after the correspondence has been established and a second, more senior character has been introduced.

1. There Is No Company Here — Only a Description of One​

  • Signature: "Investments corporation LTD"

This is not a company name. It is the category of company, capitalised inconsistently — a proper noun ("Investments") followed by a common noun in lowercase ("corporation") and a suffix in capitals ("LTD"). A registered entity has a distinct name precisely so it can be told apart from every other firm doing the same thing.

And that is the whole signature block. There is no registered address, no company registration number, no telephone number, no website, no jurisdiction of incorporation, and no regulator. A firm claiming to move investor capital across borders is one of the most heavily regulated things a business can be. This one cannot name the country it is registered in.

2. The Corporation Sends Mail From a Personal Domain​

  • Sender: faithisbella01@faithi.com

The domain is faithi.com — built from the sender's own first name, not from "Investments Corporation" in any form. A genuine facilitator writes from the firm's domain, because that is what a firm's domain is for. Here the "corporation" has no email presence at all; only the individual does, on a domain that reads as disposable.

3. She Misspells Her Own Name in Her Own Address​

Line the two up character by character:

  • Display name and signature: Faith Isabella
  • Email local part: faithisbella01 — "isbella"

The letter "a" is missing. Someone typing an address they have used every working day for years does not drop a letter out of their own surname. The trailing 01 compounds it: a sequence number is what you append when the address you wanted was taken, or when you are creating the first of several accounts in a series.

4. The Mail Client Had Already Ruled On It​

Two verdicts appear above the message before a single line of it is read:

  • Unverified next to the sender — the message failed authentication checks. Mail from a real corporate domain carries valid SPF, DKIM, and DMARC records; this did not.
  • "This message appears to be Junk. Links and other functionality will not work." — the provider's own filter, with link handling already disabled as a precaution.

The infrastructure reached the correct conclusion unaided. The only way this email causes harm is if a human overrules it.

5. The Central Question Is One a Real Investor Would Never Ask​

  • "I would like to inquire if your country's investment and property laws permit foreign investors in your country."

Consider what is being claimed: a facilitator representing a group of investors, seeking property and industrial partnerships abroad, who does not know whether the destination country admits foreign investment — and who intends to find out by asking a stranger who is trying to sell them something.

Foreign investment rules are public. Every country publishes them; India's are on the RBI and DPIIT websites. Firms that place capital internationally answer this question with counsel and due diligence before approaching anyone, because the answer determines whether the approach is legal. Outsourcing that question to the target inverts the entire relationship — and it exists only because a factual question is the easiest possible thing to get a busy person to answer.

6. "Your Country" — Because They Do Not Know Which One It Is​

The phrase appears twice in a single sentence, and never once as a name. Nowhere in the message is there a country, a city, a company name, a property, a sector, or the recipient's name. The greeting is "Hello,".

This is what a mass-mailed template looks like when the merge fields have been removed rather than filled in. The sender does not know where you are, which is why the letter cannot say — and the question in flag 5 is the mechanism by which you volunteer it.

7. The Target List Is Everyone​

  • "credible real estate owners , Agents and developers, industry/manufacturer"

Four unrelated business categories in one clause, joined so that no recipient can read it and conclude "this isn't meant for me." Real investment mandates are narrow — a sector, a ticket size, a geography, a stage — because narrowness is what makes them credible. Breadth here is not ambition; it is the absence of any actual mandate.

The recipient makes the point for us. This arrived at info@secure-techie.com — a cybersecurity awareness blog. Not a property owner, not an agent, not a developer, not a manufacturer. It matched none of the four categories and was sent anyway.

8. The Investors Have No Identity, No Money, and No Criteria​

  • "a group of clients/investors" — how many, from where, managing what?
  • No fund name, no amount, no ticket size, no sector focus, no track record, no prior deal.

The clients/investors slash is telling on its own: a real facilitator knows whether the people they represent are clients or investors, because the distinction is a legal one that governs how they may be approached. Vagueness is load-bearing here. Specific claims can be checked; a "group of investors" cannot be disproved, and the reader's own imagination supplies a figure far more persuasive than anything the sender could safely write down.

9. The Gatekeeper Structure Is the Signature of the Genre​

  • "I will be pleased to connect directly with my Principal Mr. Towers Michael who has direct access to the investors."

This is the tell that identifies the family with near-certainty. Note the chain: a Facilitator, who reports to a Principal, who has access to the investors — three layers, and the money is behind all of them. Nobody with authority is reachable in the first email.

It does two jobs. It manufactures status, because being escalated to "the Principal" feels like progress and progress is what keeps a mark engaged. And it hands the operator a clean role change — the second character can introduce fees, forms, and lawyers that a mere "facilitator" would have no standing to demand.

"Towers Michael" is a surname-forename pair presented in the wrong order, which is how this genre's invented names almost always read. "Mrs. Faith Isabella" is two given names with no surname at all. Neither is a name a real person's colleagues would use.

10. Sent at 2:50 AM, With Punctuation From a Different Keyboard​

  • Timestamp: Wednesday, 15 July 2026 at 2:50 AM — outside business hours in the recipient's timezone, consistent with bulk sending on a schedule or from a distant one.
  • Spaces before commas: "Faith Isabella ," and "real estate owners ," — an artifact of French and West African typing conventions, or of text pasted between documents. English typesetting never puts a space before a comma, and no corporate mail template would preserve one twice.
  • Hard-wrapped lines at a fixed narrow width, the shape of text composed in a plain-text editor and pasted in rather than written in a mail client.

11. The Gateway's Own Warning Bled Into the Signature​

The message ends:

Investments corporation LTD
External Email

"External Email" is not part of the sender's signature. It is the banner injected by the receiving mail gateway, marking the message as originating outside the organisation, and it has been absorbed into the body text. A warning label about the sender is now the last line of the sender's own sign-off.

How This Scam Works​

Nothing in this email asks for money, and that is deliberate. It is a qualification test: the reply separates live, attended, business-owning inboxes from the dead addresses on the same scraped list, and only the ones that answer receive the real approach.

  1. The Bait: An unlimited pool of foreign investment capital, with no conditions attached and nothing asked for. The offer is calibrated to be attractive to any business and disqualifying to none.
  2. The Qualifier: A single, easy, flattering question — are foreign investors allowed in your country? — that any owner can answer in one line. Answering costs nothing, feels like normal business courtesy, and marks you as a live target who reads and replies.
  3. The Escalation: "Mr. Towers Michael" arrives, and the tone changes. A specific mandate appears — a figure, a timeline, a memorandum of understanding — tailored to whatever you disclosed about your business in your reply.
  4. The Paperwork: Non-disclosure agreements, "investor profile" forms, and due-diligence questionnaires begin to circulate. Their real function is harvesting: company registration documents, financial statements, director identity papers, and bank account details, collected under cover of a process that looks like the one a genuine deal would follow.
  5. The Fee: The money is approved and the deal is ready — but it is held by one final obstacle that only you can clear. A "capital transfer levy," an "anti-money-laundering clearance certificate," a lawyer's retainer, a notary or stamp-duty payment, a fee to a fictitious regulator, or the cost of flying the investor delegation over for a site visit. The sums start small and are always smaller than the prize, which is the entire arithmetic of advance-fee fraud.
  6. The Ratchet: Each payment unlocks the next obstacle. Sunk cost does the work from here — every fee already paid becomes the reason to pay the next one, and the victim's own commitment, not the fraudster's pressure, drives the escalation.
  7. The Residue: Even for a target who pays nothing, the documents already surrendered have value. Company papers, financials, signatures, letterheads, and banking details support invoice fraud, business email compromise against your customers, and a far more convincing second approach months later from an unrelated address.

Conclusion and Recommendations​

There are no investors. There is no corporation — the signature names a category of business rather than a company, and lists no address, no registration number, and no regulator to check it against. A facilitator with no firm behind her, writing from a personal domain that misspells her own name, is asking a cybersecurity blog whether foreign investment is legal in a country she cannot name, so that a "Principal" with a reversed name can take over the conversation.

Immediate Actions:​

  • Do Not Reply: This is the one thing the email is built to obtain, and it is the only step the victim has to get wrong. Answering the legal question — even to say "yes, we permit foreign investment" or "you have the wrong business" — confirms an attended mailbox at a real company and promotes you from a scraped address to a qualified target.
  • Do Not Send Company Documents: Registration certificates, financial statements, director identity papers, and letterheads are the raw material for impersonating your company later. Any "investor profile" or NDA arriving from this thread is a collection form.
  • Never Pay a Fee to Receive Money: No legitimate investor charges you for the privilege of accepting their capital. Reverse the direction of any payment request and the fraud is visible from the first rupee.
  • Report It as Phishing or Fraud: Flag it in your mail client so the pattern is learned. In India, report to the National Cyber Crime Reporting Portal at cybercrime.gov.in or the helpline 1930.
  • Tell Whoever Watches the Shared Inbox: info@ is monitored by someone whose job is to be helpful and responsive. Helpfulness is precisely the reflex this email is aimed at.

Verification Steps:​

  • Look the Company Up Before Anything Else: A firm handling investor capital appears in a companies register — MCA in India, Companies House in the UK, the equivalent elsewhere — and, in most jurisdictions, in a financial regulator's register too. "Investments corporation LTD" cannot be looked up, which is the reason it was named that way.
  • Check the Domain, Not the Display Name: faithi.com belongs to no corporation. Run a WHOIS lookup: a registration created weeks or months ago, behind privacy protection, is decisive for an entity claiming an established investment practice.
  • Ask the Questions Only a Real Firm Can Answer: Registered address, incorporation number, regulator and licence number, the name of the fund, the sectors it invests in, and the size of its last three deals. Genuine firms answer these in one email because the answers are already public. Fraudsters go quiet or escalate to the Principal.
  • Search the Exact Sentences: Paste a full line — "who has direct access to the investors" — into a search engine. Templates from this family appear verbatim across scam-reporting forums, often with the names swapped.
  • Verify Through an Independent Channel: If a firm named in the correspondence turns out to exist, find its number yourself through a directory or search engine and call it. Never use contact details supplied inside the email.

Additional Protection Tips​

  • Treat Unsolicited Money With More Suspicion Than Unsolicited Sales: An inbound offer of capital lowers defences in a way a sales pitch never does, because it flatters the recipient into believing they were selected. Nobody was selected — the same message went to a list.
  • Make the Absence of Detail Disqualifying, Not Something to Ask About: The instinct on receiving a vague offer is to reply and request specifics. That reply is the product. A serious first approach names your company, its sector, and what the sender wants; anything less should be deleted, not answered.
  • Learn the Two-Character Structure: Facilitator introduces Principal. Assistant introduces Director. Agent introduces the Barrister handling the estate. Whenever the person writing to you has no authority and the person with authority is one email away, the genre is identified regardless of the story wrapped around it.
  • Adopt a Standing Rule on Advance Fees: No fee, deposit, retainer, levy, or clearance charge is ever paid to release money owed to you — no exceptions, decided in advance so that no one has to make the judgement call while excited about a deal.
  • Route Investment Approaches Through One Person: Decide who evaluates inbound partnership and funding offers, and require that everything reaching a shared inbox goes to them unanswered. This removes the individual reply that starts the whole sequence.
  • Enforce SPF, DKIM, and DMARC on Your Own Domain: It will not stop mail from faithi.com, but it prevents the next operator from sending an approach like this to your staff and customers using your own company's address.
  • Keep Company Documents on a Need-to-Send Basis: Registration certificates and financials should leave the business only against a counterparty you have independently verified — not against a promise of investment from someone you cannot look up.

Remember: Real investors know which country they are investing in. When the first email cannot name your company, your sector, or even the jurisdiction it is asking about, the offer is not addressed to you — you are simply the next address on a list, and the only thing being sought is proof that someone is reading.

Share this post