The used car market in Spain closed 2024 with growth of 8.6% compared with the previous year, the highest figure since 2019. More transactions mean more opportunities, but also a larger attack surface for fraudsters. And car phishing is, right now, one of the most active threats in the sector.
The problem does not only affect private buyers. Independent dealerships are also a target: real dealerships are impersonated to publish fake adverts, vehicle documentation is requested in order to forge it, and dealers receive fraudulent payments that the bank ends up rejecting days later. Understanding how this scam works is the first step to avoiding it, and to protecting your customers too.
What exactly is car phishing
Car phishing is an online fraud method that consists of posting fake vehicle adverts on buying and selling portals, usually with photos and descriptions stolen from legitimate adverts. The scammer poses as the owner or as an intermediary and convinces the buyer to make an advance payment, whether as a deposit, a reservation fee or to cover transport costs. Once the money is received, they disappear.
The term comes from traditional phishing, which is the most common identity impersonation technique in cybersecurity. In this case the lure is not a bank or a payment platform, but a car at a price that looks like a bargain. The prices used in these adverts are usually between 30% and 50% below the real market value, enough to arouse interest without raising immediate suspicion.
The most common methods affecting dealerships
Car phishing is not just a problem for buyers. Dealers can be victims in several different ways.
Impersonation of the dealership. Scammers create fake profiles on portals or social media using the name, logo and photos of a real dealership. They publish adverts with the dealer's stock at reduced prices and collect deposits from buyers who believe they are dealing with the legitimate business. The dealership does not find out until it starts receiving calls from angry customers.
Request for documentation to forge it. A supposed interested party in a vehicle asks for the registration document and ITV record before coming to see it. With that documentation, scammers can create fake adverts for the same car or forge purchase and sale contracts.
Bounced cheques. A buyer closes the deal and pays by cheque. The bank takes several days to confirm whether there are sufficient funds, and in that time the dealer has already handed over the car. When the cheque bounces, the vehicle has gone.
Fraud against the private seller via the dealership. Someone leaves a car on consignment for the dealer to sell. A supposed buyer pays with a fraudulent method, the dealership hands over the vehicle, and the original owner claims the money that never arrived.
Warning signs you should recognise
Whether you receive a suspicious enquiry or detect an advert impersonating your business, there are signs that recur in almost every car phishing case.
In incoming communications, be wary when the interested party avoids the phone and only wants to communicate by email or WhatsApp. Also when they say they are abroad and cannot come to see the car, when they ask for the vehicle documentation before any terms have been agreed, or when they propose unusual payment methods such as transfers via Western Union or MoneyGram.
In adverts impersonating your business, the usual signs are prices far below your actual pricing, photos you recognise from your own stock, a contact number that is not yours, and texts with spelling mistakes or wording that looks like an automatic translation.
A detail that often goes unnoticed: scammers who impersonate dealerships are usually active for a short spell, post on several portals at once to generate volume quickly, and disappear before the first complaints arrive.
How to protect your dealership
The good news is that most of these scams can be prevented with simple protocols applied consistently.
Verify identity before any action. Before sharing documentation for a vehicle, always ask the interested party for valid identification and check that the details match. A legitimate buyer will have no problem providing them.
Do not share documentation by email or WhatsApp. The registration document, ITV record or any document with vehicle details should not be sent digitally to someone you have not yet met in person. If the interested party insists on receiving them before visiting the dealership, it is a warning sign.
Use traceable payment methods. Cash payments for large amounts and private cheques are the most common fraud vectors. Working with integrated payment solutions that record each transaction and allow the payer's identity to be verified significantly reduces the risk. DealcarPay, Dealcar's payment solution, is designed specifically for this type of operation, providing security and traceability in every collection.
Monitor your presence on portals. Carry out periodic searches for your dealership name on Google and on the main portals. If you find adverts that are not yours but use your identity, contact the portal immediately so they remove them and file a report.
Check the history of the vehicles you buy. When you acquire stock, checking the vehicle history with a DGT and CARFAX report protects you against cars with liens, stolen vehicles or manipulated documentation.
What to do if you have already been a victim
If you detect that your dealership's identity has been impersonated or that you have been the victim of fraud, act as soon as possible.
The first step is to gather all available evidence: screenshots of the fake adverts, conversations, transfer receipts, details of the supposed buyer or seller. The more information you have, the more useful it will be for the investigation.
Then, file a report with the National Police or the Civil Guard, specifically their technology crime units. If a bank payment is involved, contact your bank immediately too, as in some cases it may be possible to stop or reverse the transaction if action is taken quickly.
Also inform the portal where the fraudulent advert was posted. Most large buying and selling portals such as Coches.net or AutoScout24 have dedicated teams to handle these cases and can remove the advert and block the scammer's profile.
Frequently asked questions
What is car phishing?
It is an online scam that consists of posting fake vehicle adverts with real photos stolen from other adverts, at prices far below the market, to get the buyer to make an advance payment. Once the money has been sent, the scammer disappears.
Can dealerships be victims of car phishing?
Yes. Dealers can suffer identity impersonation on portals and social networks, receive payments by bounced cheques, or see their vehicle documentation used to create fraudulent adverts.
How can I tell if someone is impersonating my dealership?
By searching regularly for your name on Google and on the main buying and selling portals. If adverts appear with your name but with a different contact number or prices that are not yours, it is very likely that they are using your identity.
What do I do if a buyer pays me with a cheque and it turns out there are insufficient funds?
Contact your bank immediately to try to stop any related transaction and file a report with the National Police or the Civil Guard. To avoid this situation, the most advisable approach is not to hand over the vehicle until you have confirmed with the bank that the cheque has real funds.
Is it mandatory to verify the identity of buyers at a dealership?
From a legal standpoint, anti-money laundering regulations require dealerships to identify buyers in transactions above certain amounts. But beyond the legal obligation, verifying the identity of any interested party before sharing documentation is a common-sense measure that protects the business.
You may also be interested in our article “Legal guide for dealerships”.
Conclusion
Car phishing is a real threat for independent dealerships, not just for private buyers. Knowing how to spot it, having clear protocols for handling documentation and using secure payment methods are the three measures that reduce the risk the most. A dealer who understands these scams not only protects their business, it also generates more trust with customers.
More than 500 dealerships are already using Dealcar to manage their business more efficiently and securely.
Dealcar is the all-in-one platform for independent dealerships that centralises stock management, portal listings, invoicing, contracts and payments in one place. If you want to see how it can help you work with more control and fewer risks, you can book a free demo at dealcar.io.
The used car market in Spain closed 2024 with growth of 8.6% compared with the previous year, the highest figure since 2019. More transactions mean more opportunities, but also a larger attack surface for fraudsters. And car phishing is, right now, one of the most active threats in the sector.
The problem does not only affect private buyers. Independent dealerships are also a target: real dealerships are impersonated to publish fake adverts, vehicle documentation is requested in order to forge it, and dealers receive fraudulent payments that the bank ends up rejecting days later. Understanding how this scam works is the first step to avoiding it, and to protecting your customers too.
What exactly is car phishing
Car phishing is an online fraud method that consists of posting fake vehicle adverts on buying and selling portals, usually with photos and descriptions stolen from legitimate adverts. The scammer poses as the owner or as an intermediary and convinces the buyer to make an advance payment, whether as a deposit, a reservation fee or to cover transport costs. Once the money is received, they disappear.
The term comes from traditional phishing, which is the most common identity impersonation technique in cybersecurity. In this case the lure is not a bank or a payment platform, but a car at a price that looks like a bargain. The prices used in these adverts are usually between 30% and 50% below the real market value, enough to arouse interest without raising immediate suspicion.
The most common methods affecting dealerships
Car phishing is not just a problem for buyers. Dealers can be victims in several different ways.
Impersonation of the dealership. Scammers create fake profiles on portals or social media using the name, logo and photos of a real dealership. They publish adverts with the dealer's stock at reduced prices and collect deposits from buyers who believe they are dealing with the legitimate business. The dealership does not find out until it starts receiving calls from angry customers.
Request for documentation to forge it. A supposed interested party in a vehicle asks for the registration document and ITV record before coming to see it. With that documentation, scammers can create fake adverts for the same car or forge purchase and sale contracts.
Bounced cheques. A buyer closes the deal and pays by cheque. The bank takes several days to confirm whether there are sufficient funds, and in that time the dealer has already handed over the car. When the cheque bounces, the vehicle has gone.
Fraud against the private seller via the dealership. Someone leaves a car on consignment for the dealer to sell. A supposed buyer pays with a fraudulent method, the dealership hands over the vehicle, and the original owner claims the money that never arrived.
Warning signs you should recognise
Whether you receive a suspicious enquiry or detect an advert impersonating your business, there are signs that recur in almost every car phishing case.
In incoming communications, be wary when the interested party avoids the phone and only wants to communicate by email or WhatsApp. Also when they say they are abroad and cannot come to see the car, when they ask for the vehicle documentation before any terms have been agreed, or when they propose unusual payment methods such as transfers via Western Union or MoneyGram.
In adverts impersonating your business, the usual signs are prices far below your actual pricing, photos you recognise from your own stock, a contact number that is not yours, and texts with spelling mistakes or wording that looks like an automatic translation.
A detail that often goes unnoticed: scammers who impersonate dealerships are usually active for a short spell, post on several portals at once to generate volume quickly, and disappear before the first complaints arrive.
How to protect your dealership
The good news is that most of these scams can be prevented with simple protocols applied consistently.
Verify identity before any action. Before sharing documentation for a vehicle, always ask the interested party for valid identification and check that the details match. A legitimate buyer will have no problem providing them.
Do not share documentation by email or WhatsApp. The registration document, ITV record or any document with vehicle details should not be sent digitally to someone you have not yet met in person. If the interested party insists on receiving them before visiting the dealership, it is a warning sign.
Use traceable payment methods. Cash payments for large amounts and private cheques are the most common fraud vectors. Working with integrated payment solutions that record each transaction and allow the payer's identity to be verified significantly reduces the risk. DealcarPay, Dealcar's payment solution, is designed specifically for this type of operation, providing security and traceability in every collection.
Monitor your presence on portals. Carry out periodic searches for your dealership name on Google and on the main portals. If you find adverts that are not yours but use your identity, contact the portal immediately so they remove them and file a report.
Check the history of the vehicles you buy. When you acquire stock, checking the vehicle history with a DGT and CARFAX report protects you against cars with liens, stolen vehicles or manipulated documentation.
What to do if you have already been a victim
If you detect that your dealership's identity has been impersonated or that you have been the victim of fraud, act as soon as possible.
The first step is to gather all available evidence: screenshots of the fake adverts, conversations, transfer receipts, details of the supposed buyer or seller. The more information you have, the more useful it will be for the investigation.
Then, file a report with the National Police or the Civil Guard, specifically their technology crime units. If a bank payment is involved, contact your bank immediately too, as in some cases it may be possible to stop or reverse the transaction if action is taken quickly.
Also inform the portal where the fraudulent advert was posted. Most large buying and selling portals such as Coches.net or AutoScout24 have dedicated teams to handle these cases and can remove the advert and block the scammer's profile.
Frequently asked questions
What is car phishing?
It is an online scam that consists of posting fake vehicle adverts with real photos stolen from other adverts, at prices far below the market, to get the buyer to make an advance payment. Once the money has been sent, the scammer disappears.
Can dealerships be victims of car phishing?
Yes. Dealers can suffer identity impersonation on portals and social networks, receive payments by bounced cheques, or see their vehicle documentation used to create fraudulent adverts.
How can I tell if someone is impersonating my dealership?
By searching regularly for your name on Google and on the main buying and selling portals. If adverts appear with your name but with a different contact number or prices that are not yours, it is very likely that they are using your identity.
What do I do if a buyer pays me with a cheque and it turns out there are insufficient funds?
Contact your bank immediately to try to stop any related transaction and file a report with the National Police or the Civil Guard. To avoid this situation, the most advisable approach is not to hand over the vehicle until you have confirmed with the bank that the cheque has real funds.
Is it mandatory to verify the identity of buyers at a dealership?
From a legal standpoint, anti-money laundering regulations require dealerships to identify buyers in transactions above certain amounts. But beyond the legal obligation, verifying the identity of any interested party before sharing documentation is a common-sense measure that protects the business.
You may also be interested in our article “Legal guide for dealerships”.
Conclusion
Car phishing is a real threat for independent dealerships, not just for private buyers. Knowing how to spot it, having clear protocols for handling documentation and using secure payment methods are the three measures that reduce the risk the most. A dealer who understands these scams not only protects their business, it also generates more trust with customers.
More than 500 dealerships are already using Dealcar to manage their business more efficiently and securely.
Dealcar is the all-in-one platform for independent dealerships that centralises stock management, portal listings, invoicing, contracts and payments in one place. If you want to see how it can help you work with more control and fewer risks, you can book a free demo at dealcar.io.
