The dealership website looks real. The car and seller may not be

The website shows a forecourt full of cars, VINs, customer reviews and photographs of a building with the dealer’s logo. The salesperson answers the telephone, knows the vehicle and promises delivery to your home. The price is attractive without being ridiculous. You only need to send a quick deposit because “another buyer is on the way”.

The genuine dealer may know nothing about that website, car or payment. Scammers copy the appearance, listings and materials of an existing business, then replace the only parts that matter to them: the contact route and destination for the money.

A professional website is not proof

Logos, staff photographs and terms can be copied in minutes. Even reviews may lead to the real business being impersonated. Do not ask only whether the dealership exists. Establish whether this domain, telephone number and bank account belong to it.

Find the company independently through a map, public business register or the vehicle manufacturer’s dealer directory. Call a number obtained from that second source and ask it to confirm the particular car, salesperson and payment account. Do not rely on details in the message or a number that appears only on the questionable website.

Read the actual domain name, not merely its first familiar word. An extra hyphen, different ending or words such as “auto”, “group” and a city name can make another address look convincing. A browser padlock means the connection to that site is encrypted; it does not authenticate the dealership.

Ask to inspect the particular vehicle

Arrange a viewing and ask for the car to be present at the business address. If distance makes that difficult, propose an independent mobile inspection chosen by you. A seller who permits only their own “inspector”, suddenly moves the vehicle or refuses access before payment gives you more reasons to leave.

A VIN can help check vehicle history, but does not prove that the person speaking owns the car. It may come from a genuine listing copied from another country. Request a current photograph of a specific detail chosen by you, then compare the paperwork, seller and payment recipient.

Do not let a “rare model” or “last day of the offer” remove the time needed for verification. An honest seller of an expensive item understands why a buyer needs to inspect the goods and agreement.

Payment says more than promises

Stop if the only method is an urgent transfer to somebody unrelated to the business, cryptocurrency, gift cards or another route that makes recovery difficult. The recipient should match the other party to the contract, and any last-minute account change needs fresh confirmation through a known telephone number.

Read the agreement, return terms and exactly what the deposit reserves. A printed promise of a “100% guarantee” is worthless when the document comes from a fictional company. Do not send identity documents merely so the seller can “confirm you are serious”.

If the money has already gone

Contact the bank immediately and ask whether the transfer can be stopped or recalled. Preserve the site address, contract, payment record, messages, telephone numbers and advertisement. Report the case to law enforcement, the platform carrying the advert and the genuine dealership whose identity was used.

Do not pay a second “recovery fee” to somebody promising to retrieve the vehicle or money. The first loss can trigger more messages exploiting the same details and emotions.

What the source says and what Breachroad recommends

On 1 September 2026, the US Federal Trade Commission warned about websites impersonating car dealerships. It describes copied brands, photographs, listings and reviews used to secure payment for a car the buyer never sees. It advises inspecting the vehicle in person or independently and walking away when the seller insists on an up-front transfer only.

Breachroad recommends checking four things through independent routes: the domain, telephone number, physical vehicle and recipient of the money. If every answer comes from the same person, you do not have four confirmations; you have one story.

The same mechanics appear in our guide to fake payments on online marketplaces. We help organisations practise payment verification in our cybersecurity training.