Carrefour SA successfully recovered three domains (carrefour-cuentas.com, carrefour-gestion-web.com, and carrefour-ingreso.com) used by an unauthorized party. The panel ordered the transfer of these domains after finding the respondent acted in bad faith and had no legitimate interest in the trademarks.
Case Snapshot
| Case Number | D2026-2506 |
|---|---|
| Complainant | Carrefour SA |
| Respondent | paco manelas, perpe |
| Disputed Domain | carrefour-cuentas.comcarrefour-gestion-web.comcarrefour-ingreso.com |
| Threat Tactic | Passive Holding |
| Decision Date | 2026-07-29 |
| Panelist | Edward C. Chiasson K.C. |
| Outcome | Transfer |
| Official Source | https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2026-2506 |
Business Threat: Operational Risk and Customer Trust Vulnerability
The registration of domain names such as carrefour-cuentas.com, carrefour-gestion-web.com, and carrefour-ingreso.com presents a multi-layered risk to the brand and its global customer base. By incorporating the CARREFOUR trademark alongside keywords related to account management and financial access, the registrant created a deceptive environment capable of misleading retail consumers. Even in instances where the domains, such as carrefour-ingreso.com, did not resolve to active content at the time of the UDRP filing, the potential for future weaponization remains high. Such passive holding serves as a strategic placeholder that can be rapidly activated for phishing campaigns, thereby exposing customer credentials and sensitive personal information to third-party exploitation.
Furthermore, the reliance on privacy-protected WHOIS data complicates enforcement and obscures the true identity of the actors, which is a common tactic used to delay discovery of infringement. This anonymity, coupled with the use of domain strings that mimic official Carrefour service portals, directly impacts the brand’s customer trust and operational efficiency. When legitimate users are redirected or encounter these unauthorized portals, it necessitates additional resources from brand support teams to mitigate confusion. The proactive recovery of these assets via the UDRP process is essential to prevent brand dilution and to maintain the integrity of the official digital ecosystem, ensuring that consumers can distinguish legitimate retail touchpoints from potential fraudulent impersonators.
Legal Reasoning: Analyzing Confusing Similarity, Legitimate Interests, and Bad Faith
The panel determined that the disputed domains (carrefour-cuentas.com, carrefour-gestion-web.com, and carrefour-ingreso.com) satisfy the first UDRP element because they incorporate the globally recognized CARREFOUR trademark in its entirety as the dominant, distinctive element. Following established principles under WIPO Overview 3.1, the inclusion of descriptive, account-related terms such as ‘cuentas’, ‘gestion’, and ‘ingreso’ does not mitigate the risk of confusing similarity; rather, these suffixes serve to increase the likelihood of consumer deception by creating a false association with the Complainant’s actual financial and administrative services.
Regarding rights or legitimate interests, the panel found no evidence to suggest the respondent is authorized to use the CARREFOUR mark or is commonly known by that name. The respondent failed to demonstrate any bona fide offering of goods or services, and the use of privacy-protected data further underscored a lack of transparency. The absence of legitimate commercial activity, combined with the domain selection, confirms that the respondent lacks any actionable interest in the disputed strings.
Bad faith registration and use were confirmed by the panel, noting that the respondent was clearly aware of the complainant’s well-established reputation when registering the domains. The panel emphasized that the passive holding of these domains—particularly where they were registered to mimic account-related web portals—constitutes a bad faith practice. Even where one domain, carrefour-ingreso.com, did not resolve to an active site at the time of filing, such inactivity does not shield a respondent from a finding of bad faith under the third element when the domain clearly targets a high-profile brand for future exploitation or impersonation.
Strategic Enforcement Against Passive Domain Holding
The success of the Carrefour SA complaint was driven by a proactive strategy that prioritized early intervention, even when disputed domains appeared inactive. By demonstrating the global scale of the Carrefour retail operations, the complainant effectively established that the respondent’s choice of domain names—incorporating descriptive terms like ‘cuentas’ (accounts), ‘ingreso’ (login), and ‘gestion-web’ (web management)—could not be a coincidence. This established a clear pattern of targeted brand impersonation, enabling the panel to conclude that the respondent was acting in bad faith despite the lack of active content on one of the registered domains.
A key element of the persuasive evidence was the identification of discrepancies during the registrar verification process. While the respondent utilized privacy-protected contact information to conceal their identity, the registrar’s disclosure revealed data inconsistent with the information provided in the initial filing. By leveraging this procedural anomaly alongside the respondent’s failure to provide any defense, Carrefour successfully highlighted the lack of legitimate interests. This approach serves as a reminder to brand owners that aggressive documentation of registrar data, even when it appears obscured, is essential for demonstrating bad faith in cases involving passive holding and potential future account-related fraud.
Practical Recommendations
- Implement proactive monitoring for new domain registrations containing your brand name combined with service-oriented keywords like ‘cuentas’, ‘gestion’, or ‘ingreso’ to identify potential phishing infrastructure early.
- Prioritize UDRP filings even for passively held domains, as Panels consistently recognize that passive holding of trademark-infringing domains constitutes bad faith use under current WIPO precedents.
- Utilize registrar verification early in the dispute process to pierce privacy shields and capture accurate registrant data, which can be critical for establishing a pattern of bad-faith conduct if the respondent is linked to other infringing assets.
- Draft Cease and Desist or UDRP materials to explicitly highlight how domains mimicking account management portals create immediate confusion, increasing the risk of credential harvesting and unauthorized access for your customers.
- Centralize your domain portfolio intelligence to correlate identity discrepancies found during registrar verification, which can serve as evidence to prove a recurring strategy of impersonation by the same registrant entity.
Frequently Asked Questions (FAQ)
Why were domains like ‘carrefour-cuentas.com’ and ‘carrefour-ingreso.com’ considered confusingly similar to the Carrefour trademark?
The panel found that each domain fully incorporated the ‘CARREFOUR’ trademark as its dominant element. Under UDRP standards, adding descriptive Spanish terms like ‘cuentas’ (accounts) or ‘ingreso’ (login/entry) does not negate the confusing similarity, as these terms typically lead consumers to believe the sites are authorized extensions of the brand.
How did the panel conclude that the respondent acted in bad faith despite some domains being passively held?
The panel determined it was ‘inconceivable’ that the respondent registered these specific domains without prior knowledge of the well-known Carrefour brand. The use of privacy-protected registration details to hide their identity, combined with the lack of any bona fide commercial interest, supported the finding that the domains were held in bad faith with the potential to mislead customers.
What does this case teach businesses about the risks of passive domain holding?
This case highlights that passive holding is not a shield against UDRP actions. By proactively filing against inactive domains (such as carrefour-ingreso.com), Carrefour prevented the respondent from weaponizing these sites for future phishing or credential-harvesting attacks, thereby mitigating the long-term risk of customer trust erosion.
Did the discrepancy between the registrar’s records and the initial complaint impact the case outcome?
While the registrar’s verification disclosed contact information that differed from the original filing, it did not hinder the UDRP process. Instead, it underscored the respondent’s attempt to obfuscate ownership, reinforcing the panel’s conclusion that the respondent lacked legitimate interests and was acting to impersonate the Complainant.
Is someone blocking your brand domain?
Passive holdings often serve as dormant staging grounds for future phishing or credential harvesting. Take action to reclaim infringing domains before they become active threats to your customer trust.
This case note is for informational purposes only and is not legal advice.
