The used car market in Spain closed 2024 with a growth of 8.6% compared to the previous year, the highest figure since 2019. More transactions mean more opportunities, but also a larger attack surface for scammers. And 'phishing car' is, currently, one of the most active threats in the sector.
The problem does not only affect private buyers. Independent dealerships are also targeted: real dealership identities are spoofed to publish fake advertisements, vehicle documentation is requested for forging, and dealers receive fraudulent payments that the bank ends up rejecting days later. Understanding how this scam works is the first step to avoiding it, and to protecting your customers too.
What exactly is a "phishing car" scam?
A phishing car scam is a type of online fraud that consists of publishing fake vehicle listings on classified portals, typically using real photos and descriptions stolen from other legitimate advertisements. The scammer poses as the owner or an intermediary and convinces the buyer to make an advance payment, either as a deposit, a reservation, or to cover transport costs. Once the money is received, they disappear.
The term comes from traditional phishing, which is the most common identity theft technique in cybersecurity. In this case, the bait is not a bank or a payment platform, but a car at a price that seems like an opportunity. The prices used in these listings are usually between 30% and 50% below the real market value, just enough to spark interest without raising immediate suspicions.
The most common methods affecting dealerships
Phishing car scams are not only a problem for the buyer. Dealers can be victimised in several different ways.
Dealership spoofing. Scammers create fake profiles on portals or social media using the name, logo and photos of a real dealership. They publish listings with the dealer's stock at reduced prices and collect deposits from buyers who believe they are dealing with the legitimate business. The dealership does not find out until they start receiving calls from angry customers.
Requesting documentation to forge. A supposedly interested buyer asks for the registration certificate and the MOT card before coming to view the vehicle. With this documentation, scammers can create fake listings of the same car or forge sales contracts.
Bounced cheques. A buyer closes the deal and pays by cheque. The bank takes several days to confirm if there are cleared funds, and during that time the dealer has already handed over the car. By the time the cheque bounces, the vehicle has disappeared.
Scamming a private seller through the dealership. Someone leaves a car on consignment for the dealer to sell. A supposed buyer pays using a fraudulent method, the dealership delivers the vehicle, and the original owner claims the money that never arrived.
Red flags you must recognise
Whether you receive a suspicious enquiry or detect an advert spoofing your business, there are warning signs that appear in almost all phishing car cases.
In incoming communications, be suspicious when the interested party avoids the phone and only wants to communicate by email or WhatsApp. Also when they say they are abroad and cannot come to see the car, when they ask for vehicle documentation before having agreed on any terms, or when they propose unusual payment methods such as transfers via Western Union or MoneyGram.
In adverts spoofing your business, the usual signs are prices well below your real rate, photos you recognise from your own stock, a contact number that is not yours, and texts with spelling mistakes or phrasing that looks like an automatic translation.
A detail that often goes unnoticed: scammers spoofing dealerships are usually active for only a short period, post on several portals at once to generate quick volume, and disappear before the first reports are made.
How to protect your dealership
The good news is that most of these scams can be prevented with simple protocols applied consistently.
Verify identity before carrying out any process. Before sharing vehicle documentation, always request a valid ID from the interested party and check that the details match. A legitimate buyer will have no problem providing them.
Do not share documentation via email or WhatsApp. The registration certificate, the MOT card or any document with vehicle details should not be sent digitally to someone you have not yet met in person. If the interested party insists on receiving them before visiting the dealership, it is a red flag.
Use traceable payment methods. Large cash payments and cheques from private individuals are the most common vectors for fraud. Working with integrated payment solutions that record every transaction and verify the payer's identity significantly reduces risk. DealcarPay, Dealcar's payment solution, is designed specifically for these types of operations, providing security and traceability in every transaction.
Monitor your presence on portals. Periodically search for your dealership's name on Google and key classified portals. If you find listings that are not yours but use your identity, contact the portal immediately to have them removed and file a report.
Verify the history of the vehicles you buy.
When acquiring stock, checking the vehicle's history with a DGT and CARFAX report protects you against cars with outstanding finance/fees, stolen vehicles, or those with tampered documentation.
What to do if you have already been a victim
If you detect that your dealership's identity has been spoofed or that you have been the victim of fraud, act as quickly as possible.
The first step is to gather all available evidence: screenshots of the fake adverts, conversations, transfer receipts, and details of the alleged buyer or seller. The more information you have, the more useful it will be for the investigation.
Next, file a report with the National Police or the Civil Guard, specifically with their technological crime units. If a bank payment is involved, also contact your bank immediately, as in some cases it is possible to stop or reverse the transaction if you act quickly.
Additionally, notify the portal where the fraudulent ad was published. Most of the large automotive portals like Coches.net or AutoScout24 have dedicated teams to handle these cases and can take down the ad and block the scammer's profile.
Frequently Asked Questions
What is a "phishing car" scam?
It is an online scam that consists of publishing fake vehicle advertisements using real photos stolen from other listings, at prices well below the market, to get the buyer to make an advance payment. Once the money is sent, the scammer disappears.
Can dealerships be victims of phishing car scams?
Yes. Dealers can suffer identity theft on portals and social networks, receive payments with bounced cheques, or have their vehicle documentation used to create fraudulent advertisements.
How can I tell if someone is spoofing my dealership?
By periodically searching for your name on Google and the main vehicle sale portals. If listings appear under your name but with a different contact number or prices that are not yours, it is highly likely that they are using your identity.
What do I do if a buyer pays me with a cheque and it turns out to have bounced?
Contact your bank immediately to try and stop any related transactions and file a report with the National Police or Civil Guard. To prevent this situation, it is highly recommended not to deliver the vehicle until you have confirmed with the bank that the cheque has cleared funds.
Is it mandatory to verify the identity of buyers at a dealership?
From a legal perspective, anti-money laundering regulations require dealerships to identify buyers in transactions that exceed certain amounts. But beyond legal obligations, verifying the identity of any interested party before sharing documentation is a common-sense measure that protects the business.
You might also be interested in our article "Legal Guide for Dealerships".
Conclusion
Phishing car scams are a real threat to independent dealerships, not just private buyers. Knowing how to identify them, having clear protocols for handling documentation, and using secure payment methods are the three measures that most reduce risk. A dealer who is aware of these scams not only protects their business, but also builds greater trust with their customers.
More than 500 dealerships are already using Dealcar to manage their business more efficiently and securely.
Dealcar is the all-in-one platform for independent dealerships that centralises stock management, portal publishing, invoicing, contracts, and payments in one single place. If you want to see how it can help you work with more control and fewer risks, you can book a free demo at dealcar.io.
The used car market in Spain closed 2024 with a growth of 8.6% compared to the previous year, the highest figure since 2019. More transactions mean more opportunities, but also a larger attack surface for scammers. And 'phishing car' is, currently, one of the most active threats in the sector.
The problem does not only affect private buyers. Independent dealerships are also targeted: real dealership identities are spoofed to publish fake advertisements, vehicle documentation is requested for forging, and dealers receive fraudulent payments that the bank ends up rejecting days later. Understanding how this scam works is the first step to avoiding it, and to protecting your customers too.
What exactly is a "phishing car" scam?
A phishing car scam is a type of online fraud that consists of publishing fake vehicle listings on classified portals, typically using real photos and descriptions stolen from other legitimate advertisements. The scammer poses as the owner or an intermediary and convinces the buyer to make an advance payment, either as a deposit, a reservation, or to cover transport costs. Once the money is received, they disappear.
The term comes from traditional phishing, which is the most common identity theft technique in cybersecurity. In this case, the bait is not a bank or a payment platform, but a car at a price that seems like an opportunity. The prices used in these listings are usually between 30% and 50% below the real market value, just enough to spark interest without raising immediate suspicions.
The most common methods affecting dealerships
Phishing car scams are not only a problem for the buyer. Dealers can be victimised in several different ways.
Dealership spoofing. Scammers create fake profiles on portals or social media using the name, logo and photos of a real dealership. They publish listings with the dealer's stock at reduced prices and collect deposits from buyers who believe they are dealing with the legitimate business. The dealership does not find out until they start receiving calls from angry customers.
Requesting documentation to forge. A supposedly interested buyer asks for the registration certificate and the MOT card before coming to view the vehicle. With this documentation, scammers can create fake listings of the same car or forge sales contracts.
Bounced cheques. A buyer closes the deal and pays by cheque. The bank takes several days to confirm if there are cleared funds, and during that time the dealer has already handed over the car. By the time the cheque bounces, the vehicle has disappeared.
Scamming a private seller through the dealership. Someone leaves a car on consignment for the dealer to sell. A supposed buyer pays using a fraudulent method, the dealership delivers the vehicle, and the original owner claims the money that never arrived.
Red flags you must recognise
Whether you receive a suspicious enquiry or detect an advert spoofing your business, there are warning signs that appear in almost all phishing car cases.
In incoming communications, be suspicious when the interested party avoids the phone and only wants to communicate by email or WhatsApp. Also when they say they are abroad and cannot come to see the car, when they ask for vehicle documentation before having agreed on any terms, or when they propose unusual payment methods such as transfers via Western Union or MoneyGram.
In adverts spoofing your business, the usual signs are prices well below your real rate, photos you recognise from your own stock, a contact number that is not yours, and texts with spelling mistakes or phrasing that looks like an automatic translation.
A detail that often goes unnoticed: scammers spoofing dealerships are usually active for only a short period, post on several portals at once to generate quick volume, and disappear before the first reports are made.
How to protect your dealership
The good news is that most of these scams can be prevented with simple protocols applied consistently.
Verify identity before carrying out any process. Before sharing vehicle documentation, always request a valid ID from the interested party and check that the details match. A legitimate buyer will have no problem providing them.
Do not share documentation via email or WhatsApp. The registration certificate, the MOT card or any document with vehicle details should not be sent digitally to someone you have not yet met in person. If the interested party insists on receiving them before visiting the dealership, it is a red flag.
Use traceable payment methods. Large cash payments and cheques from private individuals are the most common vectors for fraud. Working with integrated payment solutions that record every transaction and verify the payer's identity significantly reduces risk. DealcarPay, Dealcar's payment solution, is designed specifically for these types of operations, providing security and traceability in every transaction.
Monitor your presence on portals. Periodically search for your dealership's name on Google and key classified portals. If you find listings that are not yours but use your identity, contact the portal immediately to have them removed and file a report.
Verify the history of the vehicles you buy.
When acquiring stock, checking the vehicle's history with a DGT and CARFAX report protects you against cars with outstanding finance/fees, stolen vehicles, or those with tampered documentation.
What to do if you have already been a victim
If you detect that your dealership's identity has been spoofed or that you have been the victim of fraud, act as quickly as possible.
The first step is to gather all available evidence: screenshots of the fake adverts, conversations, transfer receipts, and details of the alleged buyer or seller. The more information you have, the more useful it will be for the investigation.
Next, file a report with the National Police or the Civil Guard, specifically with their technological crime units. If a bank payment is involved, also contact your bank immediately, as in some cases it is possible to stop or reverse the transaction if you act quickly.
Additionally, notify the portal where the fraudulent ad was published. Most of the large automotive portals like Coches.net or AutoScout24 have dedicated teams to handle these cases and can take down the ad and block the scammer's profile.
Frequently Asked Questions
What is a "phishing car" scam?
It is an online scam that consists of publishing fake vehicle advertisements using real photos stolen from other listings, at prices well below the market, to get the buyer to make an advance payment. Once the money is sent, the scammer disappears.
Can dealerships be victims of phishing car scams?
Yes. Dealers can suffer identity theft on portals and social networks, receive payments with bounced cheques, or have their vehicle documentation used to create fraudulent advertisements.
How can I tell if someone is spoofing my dealership?
By periodically searching for your name on Google and the main vehicle sale portals. If listings appear under your name but with a different contact number or prices that are not yours, it is highly likely that they are using your identity.
What do I do if a buyer pays me with a cheque and it turns out to have bounced?
Contact your bank immediately to try and stop any related transactions and file a report with the National Police or Civil Guard. To prevent this situation, it is highly recommended not to deliver the vehicle until you have confirmed with the bank that the cheque has cleared funds.
Is it mandatory to verify the identity of buyers at a dealership?
From a legal perspective, anti-money laundering regulations require dealerships to identify buyers in transactions that exceed certain amounts. But beyond legal obligations, verifying the identity of any interested party before sharing documentation is a common-sense measure that protects the business.
You might also be interested in our article "Legal Guide for Dealerships".
Conclusion
Phishing car scams are a real threat to independent dealerships, not just private buyers. Knowing how to identify them, having clear protocols for handling documentation, and using secure payment methods are the three measures that most reduce risk. A dealer who is aware of these scams not only protects their business, but also builds greater trust with their customers.
More than 500 dealerships are already using Dealcar to manage their business more efficiently and securely.
Dealcar is the all-in-one platform for independent dealerships that centralises stock management, portal publishing, invoicing, contracts, and payments in one single place. If you want to see how it can help you work with more control and fewer risks, you can book a free demo at dealcar.io.
