Skip to main content

Fraud: LOAN FUNDS from $1 Million USD to $10 Billion and above | Helen Rudoff, Coalfax Holding Ltd

¡ 19 min read
Jagdish Kumawat
Jagdish Kumawat
Founder @ Dewiride

At a glance

Verdict
FraudGet the recipient to reply with a WhatsApp number for a multi-million-dollar loan, so a 'company lawyer' can later extract advance fees.
Subject line
LOAN FUNDS from $1 Million USD to $10 Billion and above
Claimed sender
Helen Rudoff. info@investing.com
Impersonates
No real organisation or personPersona: Ms. Helen Rudoff, secretary to Coalfax Holding Ltd London UK, signing as its Secretary General
Received
¡ Published
Related analyses

Display name as reported by the recipient; the reading pane in the screenshot shows only the address. The body gives no contact address of its own and asks for replies to 'the above email'.

Evidence: the message as received plus passive registry lookups; links and attachments are not opened. How we analyse a scam email.

My name is Ms. Helen Rudoff, secretary to (Coalfax Holding Ltd London UK) a private investor and a big time financial service provider. A cold loan offer sent under Investing.com's address for a London company that the UK companies register does not list, promising $10 Billion and above in the subject and one billion dollars in the body, and asking for only one thing: your WhatsApp number.

Complete Email​

from: Helen Rudoff. info@investing.com
to: info@secure-techie.com
date: 09/15/2026 12:22 AM
subject: LOAN FUNDS from $1 Million USD to $10 Billion and above

The reading pane in the screenshot shows the bare sender address; the display name, Helen Rudoff., full stop included, is as reported by the recipient. The External Email line at the foot of the screenshot is the recipient's mail gateway's tag, not part of the message. The message contains no link, and no attachment is shown.

Email Body​

The line breaks are the sender's: the text arrives with a hard break every eighty or so characters, often in mid-sentence, and each line carries its own background colour, which shows as a dark strip behind it in the screenshot. It is reproduced line for line.

Attn:Sir,
My name is Ms. Helen Rudoff, secretary to (Coalfax Holding Ltd London UK) a private
investor and a big time financial service provider as the company offer businesses
and investment opportunities, long and short term loan services for clients
with a considerable interest rate based on agreement.
You can get back to me immediately if you are interested and
with your direct whatsApp phone number for full details and easy communication.
The Company offer ranges from one million dollars to one billion dollars.
Contact me on the above email for more information before I link you up with the
company lawyer for a conclusion with the Director.
Best regards,
Sincerely yours,
Ms. Helen Rudoff, Secretary General

Attacking email screenshot: a loan offer signed by Ms. Helen Rudoff, Secretary General, with a dark strip behind each line of text

Red Flags​

This is a loan-offer fraud: advance-fee fraud dressed as business lending, the pattern the UK's Financial Conduct Authority calls loan fee fraud, pitched here at a scale no consumer lender would recognise. Its opening move is a number large enough to cover any need, paired with a request small enough to seem harmless: a reply, and a WhatsApp number. It belongs to the same family as the US$10 Million to US$10 Billion loan offer analysed in 2025 — a subject built around a range that ends at ten billion dollars, an info@ address at a finance-themed .com, an Attn: salutation — with a different persona and a different body, and nothing here shows that the same hand wrote both. Everything below comes from the message, the public WHOIS and DNS records, and the UK's register of companies.

1. Three Names for One Sender: a Person, a Website and a Company​

  • Display name: Helen Rudoff.
  • Address: info@investing.com
  • Signature: Ms. Helen Rudoff, Secretary General, of Coalfax Holding Ltd London UK

Read the envelope and the letter side by side. The display name is a person's, typed with a full stop after it as though it ended a sentence. The signature places that person at a London company called Coalfax Holding. The address places her somewhere else entirely: investing.com is the domain of Investing.com, a financial data and news website — market quotes, charts and financial news — which is not a lender and is not Coalfax Holding. A secretary at one company does not send that company's loan offers from another company's info@ mailbox.

The public records, looked up on 27 September 2026, describe a long-established domain, not a disposable one:

  • investing.com was registered on 23 February 1995 through GoDaddy, with the owner's details behind a privacy service. Its mail is handled by Google.
  • Its SPF record authorises Google's servers and four ranges of addresses to send its mail, and ends in ~all — a soft fail rather than a refusal.
  • Its DMARC policy is p=none, which asks receiving servers to take no action when a message claiming the domain fails authentication.

That leaves two explanations, and the screenshot cannot choose between them because it does not include the full headers. Either the address was forged, and the domain's p=none policy gave the receiving server no instruction to refuse it; or a real mailbox at investing.com was in someone else's hands. Either way, the message is not Investing.com's business, and the choice of domain is the point. A loan offer that arrives from an address with investing in it borrows the credibility of the word before the reader has read a line.

2. "Contact Me on the Above Email" — and the Only Email Above Is Investing.com's​

  • "You can get back to me immediately if you are interested"
  • "Contact me on the above email for more information"

The message asks for a reply twice and never gives an address to send it to. There is no email address anywhere in the body, so the above email can only mean the one in the header: info@investing.com. Press Reply, and unless the message carries a Reply-To header pointing somewhere else, the answer goes to Investing.com's own mailbox — not to whoever sent this.

That cannot be what the sender intends, because the reply is the whole point: it is where the WhatsApp number is supposed to go. Messages of this family typically close the gap with a Reply-To header set to a free webmail address, so that the answer leaves for a different address from the one the message appears to come from, and the only place that shows is the To field of the reply itself. The headers were not captured for this post, so where a reply would actually have gone is not known. That is exactly the check worth making on any message like this: before sending anything, read the address the reply is about to go to.

The phrase is also a seam. The above email points at an address the body does not contain. It reads like a line kept from a version of the template that printed one.

3. A London Holding Company That the UK Register Does Not List​

  • "(Coalfax Holding Ltd London UK)"
  • "a private investor and a big time financial service provider"

Ltd is a legal status, and it can be checked. A search of Companies House, the UK's register of companies, on 27 September 2026 returns no company with Coalfax in its name. Web searches for Coalfax Holding and for Helen Rudoff turn up no lender, and no financial firm, under either name.

UK rules exist precisely so that a company can be checked. A limited company must show its registered number, its registered office address and the part of the UK it is registered in on its business letters, order forms and website. This letter gives none of them. Its entire address is London UK, written inside the company's name, in brackets. There is no registration number, no street, no telephone number, no website, and no name for the Director. A company offering loans of up to a billion dollars would have all of these, and would want you to see them.

The self-description does not help. A private investor and a big time financial service provider describes two different things — someone who invests their own money, and a business that sells financial services to others — in slang rather than in the language of a regulated business. As the company offer businesses and investment opportunities — the company offer, twice in the message, never offers — does not say what is offered, to whom, or on what terms.

4. Ten Billion Dollars in the Subject, One Billion in the Body​

  • Subject: LOAN FUNDS from $1 Million USD to $10 Billion and above
  • Body: "The Company offer ranges from one million dollars to one billion dollars."

The subject and the body disagree about the size of the offer by a factor of ten. The subject says ten billion dollars, then adds and above: no ceiling at all. The body, a few lines later, says one billion. A lender that cannot say, within one message, whether its limit is one billion, ten billion or nothing in particular is not describing a loan book.

Even the body's range makes no sense as a product. One million dollars to one billion is a thousandfold span; the subject's version is ten-thousandfold. Loans in the billions are typically syndicated across groups of banks and negotiated for months, for borrowers whose accounts have been examined line by line. They are not offered in the same sentence as a one-million-dollar loan, to an unnamed reader, by a secretary. The range does not describe what Coalfax lends. It is there so that any reader's need, whatever it is, falls inside it.

5. No Rate, No Term, No Conditions — Only a "Considerable Interest Rate"​

  • "long and short term loan services for clients"
  • "with a considerable interest rate based on agreement."

A lender's first approach describes a product: what kind of loan, over what term, at what rate, against what security, and for whom. This one describes none of it. The terms are long and short, the clients are unnamed, and the price is a considerable interest rate based on agreement.

Considerable means large. Taken at its word, the only thing the message says about the cost of the money is that it will be high, and negotiable. The writer probably meant reasonable, but the slip matters less than the gap around it: there is no figure anywhere to check. Everything that would let a reader compare this offer with a real one is deferred to the conversation, because the conversation is what the email is for.

6. What It Asks For: Your WhatsApp Number​

  • "with your direct whatsApp phone number for full details and easy communication."

The one piece of information the message asks for is a phone number on WhatsApp. That moves the conversation off email — where the recipient's gateway had already tagged this message External Email — to an encrypted chat that no mail filter reads and no colleague sees. It is easy communication for the sender: voice notes, forwarded "documents" and pressure, delivered straight to a phone.

The number is worth something on its own, too. A reply with a mobile number confirms a live business contact who answers loan offers, and numbers like that are typically passed on to the next campaign.

A company lending in millions works through channels that leave a record: letters on its own letterhead, a named relationship manager, an office you can visit. It does not open by asking a stranger for a WhatsApp number.

7. "Attn:Sir," — Sent to the Contact Address of a Website About Scam Email​

  • "Attn:Sir,"
  • To: info@secure-techie.com

The salutation addresses no one. Attn: belongs on the outside of an envelope, and Sir is a guess. There is no name, no company, and no mention of what the recipient does or might need. The message went to info@secure-techie.com, the public contact address of this website, which publishes analyses of scam email. Nothing in the message shows that the sender knew that, or anything else about the recipient: what it does, whether it borrows, or who reads its mail. The address came off a list, and the same text goes to every address on it.

A real lender approaching a business about a loan of a million dollars or more would have looked at that business first. The only research behind this offer is the harvesting of a mailbox.

8. A Secretary Who Signs as "Secretary General", and a Lawyer Before the Director​

  • "My name is Ms. Helen Rudoff, secretary to (Coalfax Holding Ltd London UK)"
  • "before I link you up with the company lawyer for a conclusion with the Director."
  • "Best regards, / Sincerely yours, / Ms. Helen Rudoff, Secretary General"

In the first line she is secretary to the company. By the signature she is its Secretary General — a title used by international organisations and some associations, not an office in a UK private limited company, whose officers are its directors and, if it chooses to appoint one, a company secretary. Above the signature sit two sign-offs, one after the other, as though two closings had been pasted in and neither removed. The doubled and tripled spaces between words, visible in the screenshot, point the same way: a text put together from parts.

The last lines map out what comes next: first the secretary, then the company lawyer, then a conclusion with the Director. Each step is a new person, and none of them has a name. In advance-fee fraud the chain of intermediaries is the mechanism. The "lawyer" is typically where the agreements, the certificates and the fees come from, so that the request for money arrives from someone other than the friendly first contact, dressed as a legal formality. The email has already told you who will ask.

How This Scam Works​

The email is bait for one reply. It carries no link and no attachment, asks for no money and names no fee, which is why it looks harmless and why it reached the inbox. What happens after a reply was not observed — we do not reply — but loan-offer fraud is well documented, and the UK's Financial Conduct Authority describes its core as loan fee fraud: a loan is offered, a fee is demanded first, and the loan never arrives. At business scale it typically runs like this:

  1. The List: One template is sent to addresses harvested in bulk, typically the info@ and contact@ mailboxes that companies publish on their websites. It names no recipient and describes no product, so it fits any business that has ever wanted funding.
  2. The Borrowed Address: The message goes out under an address on a finance-themed domain — here investing.com, and in the 2025 specimen investmentbank.com — typically forged, sometimes a hijacked mailbox. A domain whose DMARC policy is p=none gives receiving servers no instruction to refuse the forgery.
  3. The Handover: Replies are typically routed by a Reply-To header to a webmail address the sender controls, and the conversation moves to WhatsApp as fast as possible, beyond the reach of the mail gateway and of anyone else who reads the company's mail.
  4. The Application: A "loan application" follows, asking for company registration documents, directors' identity documents, bank statements, and the project and amount wanted. Much of it has value in its own right, and filling it in makes the borrower feel vetted.
  5. The Approval: The loan is approved, quickly, often for exactly the amount requested. An offer letter, a loan agreement and a certificate appear on letterhead, and the "company lawyer" joins the thread with paperwork for the Director to sign.
  6. The Fee: Before the money can be released, something must be paid: legal fees, stamp duty, insurance, a processing or registration charge, a transfer tax. The FCA names deposits, administration fees and insurance among the usual labels. The amount is always small against the loan, which is what makes it feel worth paying.
  7. The Escalation: Each fee clears one obstacle and reveals the next — a compliance certificate, a currency conversion charge, an anti-money-laundering clearance. Every payment makes stopping harder, because stopping would mean the earlier payments were wasted.
  8. The End: No loan arrives. Contact stops, and the documents collected along the way — identity papers, bank details, signatures — stay in the fraudster's hands, useful for fraud in the borrower's name. Those who paid are typically contacted again later, with an offer to recover the money for a fee.

Conclusion and Recommendations​

There is no Coalfax Holding on the UK's register, no lender behind info@investing.com, and no loan. There is a display name with a full stop after it, a London company with no number and no address, a loan range that grows tenfold between the subject and the body, a price described only as considerable, a request for your WhatsApp number, and a promise of a lawyer and a Director — the people who, in schemes of this kind, typically deliver the fees.

The message is short and asks for very little, and that is its design. Nothing in it can be verified, and everything it wants — the reply, the number, the conversation — leads away from the places where it could be.

An offer with no ceiling, no price and no company behind it is not an offer of money. It is a request for your attention, and the fees come later.

Immediate Actions:​

  • Do Not Reply, and Do Not Send a Phone Number: A reply confirms a live mailbox read by someone interested in funding, and a WhatsApp number moves the conversation somewhere no filter can follow. Neither can be taken back.
  • Never Pay a Fee to Receive a Loan: Legal fees, stamp duty, insurance, processing, registration, transfer or clearance charges — a loan that has to be paid for before it arrives does not arrive. The fee is the fraud.
  • Do Not Send Company or Identity Documents: Registration certificates, directors' IDs, bank statements and signed forms are useful to a fraudster whether or not a loan is ever mentioned again.
  • Report It: Use your mail client's phishing or junk report so the campaign is scored, and forward the message to CERT-In at incident@cert-in.org.in. If money was lost, report it on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930. If you want Investing.com to know its address is being used, reach it through its own website, typed in yourself — not by replying to this.
  • If Anyone Has Already Engaged, Stop Now: Keep every message and receipt, do not pay the "final" fee that will supposedly release the funds, and tell your bank at once if money has moved.
  • Warn Whoever Reads the Shared Mailbox: Messages like this go to info@ addresses read by several people, and the one who opens the next copy may be the one looking for funding.

Verification Steps:​

  • Look Up the Company in Its Own Country's Register: A UK limited company is on Companies House, with its number, registered office, directors and filings, free to search. Coalfax Holding is not there. A company that says it is registered and cannot be found is not the company it claims to be.
  • Read the Domain to the Right of the @: investing.com belongs to a financial news and data website, not a lender and not Coalfax Holding. When the address, the display name and the signature describe three different parties, none of them sent the message.
  • Check Where a Reply Would Go: Press Reply and read the To field before typing anything. An address different from the sender's is a Reply-To header at work, and the address you were not shown is the one the sender reads.
  • Ask for the Numbers a Real Lender Gives: Rate, term, fees, security, eligibility, and the lender's registration and regulator. A genuine offer has them in writing before any conversation. This one has a considerable interest rate based on agreement.
  • Compare the Subject With the Body: Ten billion dollars in one, one billion in the other. When a message cannot keep its own central figure straight, the figure is decoration.
  • Know How Real Cross-Border Borrowing Works: For an Indian business, borrowing from a lender abroad is regulated by the Reserve Bank of India and runs through your own bank, with paperwork on both sides. None of it begins with a stranger's email and a WhatsApp number.

Additional Protection Tips​

  • Learn the Shape of the Offer: Unsolicited money, a range wide enough to fit anyone, no terms, and a request to move to a phone. The cover story changes — a loan, an investment, a partnership, a donation — and the shape stays the same.
  • Treat a Famous Domain as a Claim, Not a Credential: Anyone can put a well-known domain in the From line. Whether it was forged is shown by the authentication results in the full headers, which most mail clients can display, and by whether the sender's own story matches the domain at all.
  • Publish a DMARC Policy That Refuses Forgeries: If you own a domain, p=none is a monitoring setting, not a protection. Once your legitimate senders are authenticated, move to p=quarantine or p=reject, so that mail forged in your name is not delivered on your reputation.
  • Keep Funding Conversations on the Record: Borrow through banks and advisers you approached yourself. A lender that needs to move to WhatsApp before it will tell you its rate has already told you enough.
  • Adopt a Two-Person Rule for Fees: Any payment tied to an unexpected offer of money — a loan, a grant, a prize — should need a second person's approval and a call to a number from your own records.
  • Give Shared Mailboxes a Rule: Functional inboxes receive more of this mail than anyone. A standing rule — unsolicited offers of money are reported, never answered — costs nothing.

Remember: Real lenders ask what you need before they tell you what they can lend. When a stranger opens with the second, the loan is the bait and the fee is the catch.

Share this post