A subversive Italian artist has accessed information about companies registered in the Cayman Islands and is offering fake certificates of incorporation of these firms for sale for 99 cents online.
The Cayman Islands Companies Registry has denied reports that its servers were hacked by artist Paolo Cirio, who says he launched a website selling the documents as part of an art project protesting offshore financial centres.
In a statement released Monday, the Cayman Islands Companies Registry’s senior official registrar Donnell Dixon said reports that the servers had been hacked were “erroneous”.
He said that not only had the servers not been hacked, there has been no interference with the Cayman Islands Online Registry Information Service, known as CORIS, through which information is shared between local financial services agents and the registry. Rather, the information was “scraped” from the registry’s public search engine.
“Just like any member of the public is able to do, the person who claims to have hacked our servers conducted a search for companies on the registry’s website,” Mr. Dixon said. “He then cut and pasted the names of these companies onto a template, in order to create bogus certificates. To the unsuspecting public, these fake certificates appear to be authentic.”
Mr. Dixon added that it is impossible to obtain the certificate image from the registry’s website, as the image is not stored on the server.
“Not storing the image on the server is one of the simpler ways in which we protect data, but just like any other organisation – whether it’s a government department or a private-sector company – the registry’s website features robust security features that avert information theft,” he said.
Members of the public can set up a user name and password that allows them to carry out a basic search of companies in the companies registry and it appears this is how Mr. Cirio got the company names, Mr. Dixon told the Caymanian Compass.
Mr. Cirio set up a website last week called Loophole4All which purports to sell identities of companies registered in Cayman at a low cost “to democratise offshore business for people who don’t want to pay for their riches”. He said on the site that this empowers everyone “to evade taxes, hide money and debt, and get away with anything by stealing the identities of real offshore companies”.
He claims to have the names and details of some 200,000 companies registered in the Cayman Islands and placed their information on the site, at which anyone can get a Cayman Islands postal address and use the company name to conduct business.
According to the companies registry, it has only about 92,000 companies registered in Cayman.
Mr. Cirio claims on his website that visitors can “hijack” an offshore-registered company for 99 cents for which they will receive a fake digital certificate of incorporation for one of the real companies, and for higher payments – up to $49 – can get a physical copy of the certificate or even a Cayman Islands mailbox with mail rerouting services for a year.
He lists four steps through which visitors to the site can use an offshore company. This involves choosing the name of one of the 200,000 listed companies, entering their own contact information, such as an e-mail or actual address, purchasing a digital or printed certificate of incorporation and start invoicing using the hacked tax identification number immediately.
However, Mr. Dixon said the entire project is a scam and is illegal.
“Basically, the guy is scamming people,” said Mr. Dixon, adding that no legal, taxation or accountancy professional would fall for the counterfeit certificates as they do not contain the information that one would expect to see on a typical certificate of incorporation. “You just wouldn’t be able to pass off something like that … The due diligence that takes place nowadays between the customer and the firms is very stringent,” he added.
Nonetheless, he fears that people may fall for what the site offers. “I’m not saying there aren’t gullible people out there who might pay him what he is asking for the certificates … It’s illegal. He’s asking people to pay him for a fraudulent certificate,” he said.
The artist claims on the site that Loophole4All exploits tax and legal accountability loopholes available by registering a company in an offshore centre, so that the service is no longer only available to the rich or to large corporations.
He said that ordinary individuals, “armed with as little as a company name and a number” can hijack these companies and use them for “public advantage”.
“This corporate identity theft benefits from the anonymous nature of those offshore companies. Everyone can pretend to be them because of their real owners’ secrecy. And even if it’s illegal to steal an identity of a company, the courts of offshore centres don’t have any power or credibility onshore. And meanwhile, onshore authorities don’t have the resources to verify the real owners of companies offshore — even less to chase everybody down,” he claims on the website.
The information of the companies taken from the Cayman Islands Companies Registry was obtained in a process known as “scraping”.
Mr. Cirio said that at the moment the Loophole4All site only has access to Cayman Islands companies. But he said he plans to add companies registered in other offshore financial centres, including Bermuda, Jersey, Seychelles and Delaware later.
The artist is known for previously scraping a million profiles from Facebook to create the Face to Facebook, in which he filtered the profiles with facial recognition software and published them onto Lovely-Faces.com, a mock dating website he designed himself. He claims that project led to 11 lawsuit threats, five death threats and several letters from the lawyers of Facebook.