Toronto Dominion (TD) Fintrac Phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wmKBV-000000002HL-1Seg
for dave@doctor.nl2k.ab.ca;
Tue, 21 Jul 2026 17:47:37 -0600
Resent-From: The Doctor
Resent-Date: Tue, 21 Jul 2026 17:47:37 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from 91essay100.com ([35.215.11.58]:55567 helo=my.91essay100.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1wmI3H-00000000Ffh-01r4
for root@nk.ca;
Tue, 21 Jul 2026 15:31:06 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=my.91essay100.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;
i=marketing@ejnqir.my.91essay100.com;
bh=m8gyf0NMnfwSIp9gFIVLFX5UVmh+v6+3GDQs3K9f6oE=;
b=oc+do9yJ4zT2kPHPzbWgv0x7XgukzGYm0p/HX9sbqW3IvFnL2qQe+PlbbW35Hnl6j7sDirmY2kse
mGnZbg6GNm63naz9n/EIYZlnMWN8SZVNvKbZqy7mJWEuObU9eMMFjg51dsx/odrDBtQg3M+gm0sY
bGXaeMAJRmMYD+dwS1Gtd5baN9BCgZURaMkPhjEspSDWpG+XqFTOANUhSwHUqvx8nHJUAjnjlGko
Efl72Nzgu49tjPBvltfbqktFxUNoRFux7aQNQilydxAaUN2tLMBsq9c2FjYhrdUDesmv46zb46Q1
y71MtSnbmdm5IKm/hUG7ZPbzrZ9LcFn12fPrUA==
Content-Type: multipart/alternative;
boundary="===============8405221455944049152=="
MIME-Version: 1.0
From: =?utf-8?b?VOKAi0TigIsg4oCLU+KAi2XigItj4oCLdeKAi3LigItp4oCLdOKAi3k=?=
To: root@nk.ca
Subject: [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &
Beneficial Ownership Audit
Date: Tue, 21 Jul 2026 17:30:10 -0400
Message-ID: <178466941076.3999.4983478520812835849@ejnqir.my.91essay100.com>
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: root, As a reporting entity under the Proceeds of Crime (Money
Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is
required by law to conduct periodic re-verification of client identit [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: ajuevctekvz.top]
[URI: ahbcvichwjwim.top]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: 91essay100.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: www.ahbcvichwjwim.top (top)]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[35.215.11.58 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
Subject: {SPAM?} [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &
Beneficial Ownership Audit
--===============8405221455944049152==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Regulatory Compliance | FINTRAC | PCMLTFA
Compliance Audit
Mandatory FINTRAC Identity &
Beneficial Ownership Verification
Reference: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — S.C. 2000, c. 17
root,
As a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is required by law to conduct periodic re-verification of client identity and, where applicable, beneficial ownership information. This is a statutory obligation administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and applies to all financial entities and securities dealers operating in Canada.
TD Direct Investing has been selected for a routine FINTRAC-mandated audit cycle. As part of this process, a subset of client accounts has been flagged for identity and beneficial ownership re-verification. Your TD WebBroker account has been included in this review cohort, and updated documentation is required to complete the audit.
The re-verification process covers the following items:
1
Government-Issued Photo Identification
Confirm that the passport, driver’s licence, or provincial identification card on file is current and has not expired. A scanned or photographed copy of your current identification document may be required upon request.
2
Residential Address & Tax Residency
Verify that your current residential address in Canada is accurately recorded. For clients with cross-border indicia, confirm your country (or countries) of tax residency and provide any applicable foreign tax identification numbers.
3
Beneficial Ownership Declaration
Confirm or update your declaration regarding beneficial ownership and control structure. If you hold this account on behalf of, or for the benefit of, any other individual or entity, you must disclose the identity of each beneficial owner with 25% or more ownership or control.
4
Employment & Source of Funds Confirmation
Update your current employment information and confirm the source of funds deposited into your WebBroker account. This is a standard FINTRAC requirement for ongoing client due diligence.
⚠ Account Restriction Pending — Withdrawal Hold
Should the FINTRAC identity and beneficial ownership re-verification remain incomplete, TD Direct Investing is required, pursuant to its obligations under the PCMLTFA and FINTRAC Guideline 6A, to impose a temporary restriction on all external fund withdrawals from your TD WebBroker account. This withdrawal hold will remain in effect until the required verification is completed and approved. Internal transfers between linked TD accounts, dividend reinvestment, and securities trading within the account will not be affected by this restriction.
Regulatory Framework: PCMLTFA (S.C. 2000, c. 17) and its associated Regulations; FINTRAC Guideline 6A (Record Keeping and Client Identification for Financial Entities); FINTRAC Guideline 6B (Ongoing Monitoring and Beneficial Ownership). As a Dealer Member of CIRO, TD Direct Investing is obligated to comply with all applicable anti-money laundering and counter-terrorist financing legislation. Failure to comply with a FINTRAC audit requirement may result in regulatory sanctions against the institution and mandatory reporting obligations.
The re-verification is completed entirely online through a secure portal. It typically takes between seven and ten minutes. Your information is encrypted, stored in compliance with PIPEDA, and used exclusively for regulatory compliance and identity verification purposes.
Log In to Complete Identity Verification
If you have submitted updated identity or beneficial ownership documentation within the past 60 days, this request may have crossed with our internal processing cycle. Please contact TD Direct Investing Client Services through the Secure Message Centre for confirmation. This communication is issued pursuant to TD Direct Investing’s regulatory obligations under the PCMLTFA.
Yours truly,
TD Direct Investing
Compliance & Anti-Money Laundering Division
TD Direct Investing | Dealer Member of CIRO | Member of CIPF
This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.
Please direct all inquiries through the Secure Message Centre within your WebBroker account.
© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wmKBV-000000002HL-1Seg
for dave@doctor.nl2k.ab.ca;
Tue, 21 Jul 2026 17:47:37 -0600
Resent-From: The Doctor
Resent-Date: Tue, 21 Jul 2026 17:47:37 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from 91essay100.com ([35.215.11.58]:55567 helo=my.91essay100.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1wmI3H-00000000Ffh-01r4
for root@nk.ca;
Tue, 21 Jul 2026 15:31:06 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=my.91essay100.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;
i=marketing@ejnqir.my.91essay100.com;
bh=m8gyf0NMnfwSIp9gFIVLFX5UVmh+v6+3GDQs3K9f6oE=;
b=oc+do9yJ4zT2kPHPzbWgv0x7XgukzGYm0p/HX9sbqW3IvFnL2qQe+PlbbW35Hnl6j7sDirmY2kse
mGnZbg6GNm63naz9n/EIYZlnMWN8SZVNvKbZqy7mJWEuObU9eMMFjg51dsx/odrDBtQg3M+gm0sY
bGXaeMAJRmMYD+dwS1Gtd5baN9BCgZURaMkPhjEspSDWpG+XqFTOANUhSwHUqvx8nHJUAjnjlGko
Efl72Nzgu49tjPBvltfbqktFxUNoRFux7aQNQilydxAaUN2tLMBsq9c2FjYhrdUDesmv46zb46Q1
y71MtSnbmdm5IKm/hUG7ZPbzrZ9LcFn12fPrUA==
Content-Type: multipart/alternative;
boundary="===============8405221455944049152=="
MIME-Version: 1.0
From: =?utf-8?b?VOKAi0TigIsg4oCLU+KAi2XigItj4oCLdeKAi3LigItp4oCLdOKAi3k=?=
To: root@nk.ca
Subject: [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &
Beneficial Ownership Audit
Date: Tue, 21 Jul 2026 17:30:10 -0400
Message-ID: <178466941076.3999.4983478520812835849@ejnqir.my.91essay100.com>
X-Spam_score: 11.5
X-Spam_score_int: 115
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: root, As a reporting entity under the Proceeds of Crime (Money
Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is
required by law to conduct periodic re-verification of client identit [...]
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
[35.215.11.58 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[35.215.11.58 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
[35.215.11.58 listed in will-spam-for-food.eu.org]
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: ajuevctekvz.top]
[URI: ahbcvichwjwim.top]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: 91essay100.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: www.ahbcvichwjwim.top (top)]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[35.215.11.58 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
Subject: {SPAM?} [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &
Beneficial Ownership Audit
--===============8405221455944049152==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Regulatory Compliance | FINTRAC | PCMLTFA
Compliance Audit
Mandatory FINTRAC Identity &
Beneficial Ownership Verification
Reference: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — S.C. 2000, c. 17
root,
As a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is required by law to conduct periodic re-verification of client identity and, where applicable, beneficial ownership information. This is a statutory obligation administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and applies to all financial entities and securities dealers operating in Canada.
TD Direct Investing has been selected for a routine FINTRAC-mandated audit cycle. As part of this process, a subset of client accounts has been flagged for identity and beneficial ownership re-verification. Your TD WebBroker account has been included in this review cohort, and updated documentation is required to complete the audit.
The re-verification process covers the following items:
1
Government-Issued Photo Identification
Confirm that the passport, driver’s licence, or provincial identification card on file is current and has not expired. A scanned or photographed copy of your current identification document may be required upon request.
2
Residential Address & Tax Residency
Verify that your current residential address in Canada is accurately recorded. For clients with cross-border indicia, confirm your country (or countries) of tax residency and provide any applicable foreign tax identification numbers.
3
Beneficial Ownership Declaration
Confirm or update your declaration regarding beneficial ownership and control structure. If you hold this account on behalf of, or for the benefit of, any other individual or entity, you must disclose the identity of each beneficial owner with 25% or more ownership or control.
4
Employment & Source of Funds Confirmation
Update your current employment information and confirm the source of funds deposited into your WebBroker account. This is a standard FINTRAC requirement for ongoing client due diligence.
⚠ Account Restriction Pending — Withdrawal Hold
Should the FINTRAC identity and beneficial ownership re-verification remain incomplete, TD Direct Investing is required, pursuant to its obligations under the PCMLTFA and FINTRAC Guideline 6A, to impose a temporary restriction on all external fund withdrawals from your TD WebBroker account. This withdrawal hold will remain in effect until the required verification is completed and approved. Internal transfers between linked TD accounts, dividend reinvestment, and securities trading within the account will not be affected by this restriction.
Regulatory Framework: PCMLTFA (S.C. 2000, c. 17) and its associated Regulations; FINTRAC Guideline 6A (Record Keeping and Client Identification for Financial Entities); FINTRAC Guideline 6B (Ongoing Monitoring and Beneficial Ownership). As a Dealer Member of CIRO, TD Direct Investing is obligated to comply with all applicable anti-money laundering and counter-terrorist financing legislation. Failure to comply with a FINTRAC audit requirement may result in regulatory sanctions against the institution and mandatory reporting obligations.
The re-verification is completed entirely online through a secure portal. It typically takes between seven and ten minutes. Your information is encrypted, stored in compliance with PIPEDA, and used exclusively for regulatory compliance and identity verification purposes.
Log In to Complete Identity Verification
If you have submitted updated identity or beneficial ownership documentation within the past 60 days, this request may have crossed with our internal processing cycle. Please contact TD Direct Investing Client Services through the Secure Message Centre for confirmation. This communication is issued pursuant to TD Direct Investing’s regulatory obligations under the PCMLTFA.
Yours truly,
TD Direct Investing
Compliance & Anti-Money Laundering Division
TD Direct Investing | Dealer Member of CIRO | Member of CIPF
This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.
Please direct all inquiries through the Secure Message Centre within your WebBroker account.
© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.