Fake Car Dealership Websites: Two Free Checks a Clone Can't Pass

Here is the moment the scam is designed around. You drive to a dealership to collect a car you have already paid for. You have the confirmation email, the order number, the name of the salesperson you have been texting for two weeks. The person behind the counter looks at all of it and tells you, politely, that none of it is theirs.

That is the scene in the consumer alert the Federal Trade Commission published on 1 September 2026. The dealership is real. The website you bought from was not, and it was a copy of theirs.

Before you send money: the checks worth doing

If you are mid-purchase right now and you want the short version, do these in order. The first two are the ones almost nobody does, and they are the two that hold up when everything on the screen looks right.

1. Look the dealer up in your state’s license register. Every US state licenses motor-vehicle dealers, and most publish a searchable list — California’s Occupational License Lookup, Virginia’s active-dealer search, Florida’s list of licensed dealers and so on. Search the business name and the street address separately. A clone will match the name of a real licensed dealer, so the address is the tell.
2. If you are buying a vehicle history report, buy it from the DOJ’s approved list. The National Motor Vehicle Title Information System publishes every approved provider. If the seller is pushing you to a report site you have not heard of, that site is very likely the product, not the report.
3. Call the dealership on a number you found yourself. Not the number on the site you have been using. Search the dealership name, get the number from the listing, and ask whether they have your order.
4. Ask to see the car and the building. The FTC’s line here is blunt: if they will not let you, walk. If the car genuinely is a thousand miles away, say you are hiring a mobile inspection service. Refusal to be inspected is refusal, whatever reason follows.
5. Never wire, and never pay by app. Wire transfers, Zelle, Cash App, gift cards and “escrow companies” the seller introduced you to all share one property, which is that the money is gone at the moment you press send. A credit card is the only common rail that gives you a dispute.
6. Check the address bar character by character. A classic-car seller in Longwood, Pennsylvania found a copy of his own site running with the same address, the same contact details and photos of his own cars — the URL was identical except that it was missing the letter s from the end.

What the FTC actually described

The alert is short. It runs through the build: clone a real auto dealer’s website, “often using AI to do so,” copying the logos, the vehicle listings and the photos “down to the last detail,” and in some cases inventing customer testimonials to go with them. Then advertise something scarce — the FTC calls out rare muscle cars and hard-to-find classics — describe the buying process at length, and offer a generous return policy so that paying in advance feels low-risk.

That last detail is the one I would underline. The flexible return policy is not there to be used. It is there to answer the objection you were about to raise.

The FTC’s suggested defenses are where it gets interesting, because the agency undercuts its first one in the next sentence. Search the dealer’s name with “scam,” “review” or “complaint,” it says — and then: “Keep in mind that if the scammers are impersonating a real dealership, you might find glowing reviews.” Which is correct, and which means the most commonly given piece of advice about online sellers does not work against this attack. The reviews are real. They belong to somebody else.

So the alert moves on to the two things that do survive a perfect copy: see the car in person, or send an independent inspector. Both are good. Both are also slow and slightly awkward to ask for, which is why people skip them when a deal looks like it might go to someone else by Friday.

Why the usual checks fail against a clone

Most consumer advice about spotting a fake website was written for a different kind of fake website — the hastily built one, with the stock photos and the odd grammar and the address that is a suburban house. That advice still catches plenty of fraud. It does not catch this, because a clone starts from a legitimate business and subtracts almost nothing.

Run the standard checklist against a copied dealership site and watch it fall over. Professional design? Copied. Real inventory with real photos? Copied. Physical address you can find on a map? Copied — it is the real dealer’s lot. Years of good reviews on third-party sites? Those reviews exist, they are genuine, and they are about the business being impersonated. HTTPS and a padlock? Free, and has been for years.

The Better Business Bureau’s investigators found what scale looks like. Tracing the registrations behind reported fake vehicle sites, they found clusters sharing a name server: one server in Lithuania hosting close to thirty reported sites, claiming addresses in Alabama, Minnesota, North Dakota and Ohio; another in Iceland with almost twenty more, claiming Tennessee, Nevada and South Carolina. Same operation, dozens of front doors, each one wearing a different real business’s face.

Figure 01 · What a clone copies, and what it cannot ScamDrill

Attack elements per the FTC consumer alert of 1 September 2026 and BBB’s 2025 impostor-scam study. Verification sources: state motor-vehicle dealer license registers; NMVTIS approved data providers (US DOJ).

Notice what is on the right-hand side of that figure. It is short, and everything on it has the same shape: a record held by somebody the scammer cannot reach.

Two registers a cloned website cannot get into

A copied website can reproduce anything that lives on a website. It cannot reproduce a government file, because the government did not put it on the internet for copying — it put it there for looking up.

The state dealer license register

Selling cars for a living requires a license from the state, and states publish who holds one. The lookups vary in polish. California runs an Occupational License Lookup you can search by business name, city or license number. Virginia’s Motor Vehicle Dealer Board has a search for active dealers. Florida publishes a downloadable list. Connecticut, New York and Delaware each have their own version. The right search term for yours is your state’s name plus “dealer license lookup.”

The trick is knowing what you are looking for. The clone is impersonating a licensed dealer, so the business name will very likely match. What will not match is the pairing — name, address and license status together — because the operator running the copied site has no way to make the register say what his website says. And if the name is not in the register at all, that is the end of the conversation regardless of how good the site looks.

This is not theoretical. In July, the Better Business Bureau of South Central Louisiana warned about a company calling itself Accelerated Motors LLC, advertising RVs on Facebook to buyers across the country and listing a Baton Rouge headquarters. The headquarters was a parking lot. The photos of the premises on its website appeared to be AI-altered versions of images of that actual address — and the altered version had the business name misspelled. BBB confirmed the company held no license from the Louisiana State Motor Vehicle Commission, which every RV dealer in the state is required to have, and referred the case to the FTC, the state attorney general and the FBI. One license lookup answers that whole story before anyone wires anything.

The DOJ’s approved vehicle-history provider list

The second register solves a smaller problem that costs far more people money, which I will come back to in a moment. The National Motor Vehicle Title Information System is run by the Department of Justice’s Bureau of Justice Assistance, and it publishes the complete list of businesses approved to sell NMVTIS vehicle history reports to the public. As of early September 2026 that consumer list runs to roughly a dozen names — Bumper, Carsforsale, CarVertical, CheckThatVin, ClearVin, EpicVin, GoodCar, TitleCheck, VinAudit, VinData, VinSmart, and a handful of affiliated sites listed underneath them.

The page also carries a line worth memorizing, because it contradicts what most people assume: consumers cannot get NMVTIS reports from Carfax, DMVDesk or Experian. Those three supply NMVTIS data to dealerships only. Carfax sells consumers a different product, and that is fine — but “I ran a Carfax” and “I ran the federal title record” are not the same sentence.

Figure 02 · Two lookups, about ninety seconds ScamDrill

State dealer license registers are published by each state’s DMV or motor vehicle board. The approved NMVTIS data provider list is published by the US Department of Justice, Bureau of Justice Assistance.

The other business running on the same lure

There are two very different money-making operations hiding behind “fake car listing,” and the smaller one catches more people.

BBB Scam Tracker data from 2021 through 2023 splits it cleanly. Reports involving a fake sale or a fake escrow company: 209 reports, median loss $12,600. Reports involving a fake vehicle-history site: 488 reports, median loss $45. More than twice as many people got taken by the forty-five-dollar version.

The vehicle-report version works during the research phase, before anyone has decided to buy anything. A seller tells you the well-known history services are missing something on this particular VIN and sends you to a site he prefers. Or you go looking yourself and find a result promising a full report for a dollar. Rosemarie in New Haven found one of those, entered her card, and watched it take a dollar, then $29.95, then $4.95, followed by an email announcing she would be charged thirty dollars every two weeks.

BBB found the same fingerprint across these sites that it found on the fake dealerships — shared name servers, near-identical page copy, one phone number tying more than a dozen of them together, names built from the same handful of words: Check Auto Status, Digital Title Check, VIN Summary Report, Carfax Line. Reports of this type rose by nearly thirty percent in 2023. None of the sites appeared on the DOJ’s approved provider list.

There is a seller-side variant too, which is the one I did not see coming. Ralph in Hailey, Idaho was selling a motorhome when a prospective buyer called James asked him to purchase a $39 “audit” on his own vehicle. Ralph already had a report; James said he did not trust it and supplied his own link. Ralph paid, and James never showed up. The rule that falls out of that is simple enough to give to anyone: you never buy a history report on a car you already own to satisfy a buyer.

What the losses actually look like

The honest answer is that nobody knows the size of this, and the reasons why are instructive.

The FBI’s Internet Crime Complaint Center has been publishing about fraudulent online vehicle sales since 2014. Its 2018 public service announcement counted roughly 26,967 complaints and $54,032,396 in adjusted losses between May 2014 and December 2017 — and the mechanics it describes have barely moved in the years since. The seller is relocating, or being deployed, or the car came out of a divorce, or it belonged to a relative who died. There is a third party with a Buyer Protection Program, and a toll-free number for it that turns out to belong to the scammer. Read it next to the 2026 FTC alert and the only real change is the production quality of the website.

On the reporting side: BBB’s researchers cite work using FTC data suggesting only about 4.8% of victims of mass-market fraud ever report it to BBB or a government agency. So every count in this post is a floor, and a low one.

One demographic detail from the BBB update is worth stating plainly, because it cuts against the usual story about who falls for internet fraud: buyers aged 45 and over filed more than three-quarters of the virtual vehicle scam reports. That is not a comment on judgment. It is a comment on who is in the market for a $30,000 truck or a restored Challenger, and who has the money on hand to move quickly. If you are the person in your family who fields the “does this look right to you?” calls, this is one to raise before it comes up — the same conversation that works for the calls that do most of the damage to older relatives works here, and it works far better as a chat about a car somebody is thinking about buying than as a warning after the fact.

If you already sent the money

Speed is the whole game, and the window is measured in hours rather than days.

1. Call the bank that sent the money, now, and use the words “fraudulent wire” and “recall.” The FBI’s guidance is to contact the originating financial institution as soon as you recognize the fraud and request a recall or reversal, along with a Hold Harmless Letter or Letter of Indemnity. Ask for the fraud department, not the branch.
2. File at ic3.gov and include the banking details. This is what triggers the FBI’s Recovery Asset Team, which contacts the receiving bank and asks it to freeze the account. Include every account number, name and transaction reference you have; the complaint is only as useful as the fields you fill in.
3. If you paid by card, dispute it today. Card networks give you a chargeback right that wires and payment apps do not. This is the one place where the payment method you chose weeks ago decides the outcome.
4. Report it to ReportFraud.ftc.gov and to BBB Scam Tracker, and tell the real dealership that its name is being used. They will want to know, and they may already have a file.
5. If you handed over documents as well as money — a driving license scan, a Social Security number for a finance application that turned out to be theatre — treat that as a separate incident and work the identity side of it in parallel.

Does any of this work? Sometimes, and the published numbers are better than the folklore suggests. The IC3's Recovery Asset Team handled 3,574 incidents in 2025, covering $832,965,941 in reported losses, and froze $507,042,623 of it — a 61% recovery rate. That figure applies to cases that reached the team fast enough for a freeze to be possible, which is exactly the point: it is a reward for hours, not a promise. I would not tell anyone their money is coming back. I would tell them that the difference between calling the bank tonight and calling on Thursday is most of the odds they have.

If you want the wider version of this — who to call, in what order, when you are not yet sure what happened — we wrote the first sixty minutes for exactly that state.

When the cloned dealership is yours

There is a second victim in every one of these cases and they are usually the last person to find out.

Doug runs a motorhome repair and parts business in Canby, Minnesota with his wife. In September they started hearing from people saying his shop was showing unusual inventory online — stock he had never carried. Someone had copied the business: the photos of the shop, the address, near enough everything. He tried to get the fake delisted by search engines and got nowhere. Then came the emails from people who believed he had taken their money, and threats from the scammers on top of that. He changed his phone number after accumulating more than 3,000 unread texts. He told BBB he could not calculate the lost business, only that customers kept asking why he had never answered their service requests — they had been calling the scammer’s number. He and his wife were planning to close.

“It was a scary situation,” he said. “And it drove us to seriously think of closing.”

If you sell vehicles, equipment, or anything else where a copied storefront could pass, the practical version of that story is short. Set a standing alert on your business name and your phone number. Reverse-image-search your inventory photos every so often, since those photos are the raw material. Register the obvious typo variants of your domain before somebody else does — the missing letter at the end, the hyphen, the .net. Put your state license number where a buyer can find it, and say on your own site which payment methods you accept and which you never will. And when a buyer calls confused, get the domain out of them and keep a file: a pattern of reports moves a registrar when a single complaint does not.

The uncomfortable part is that none of this is a security control in the usual sense. Nothing was breached. The attack ran entirely outside your systems, on a domain that was never yours, aimed at people who trusted you — the same structure we wrote about when it was a health system’s portal being copied and when it was a sticker on a business’s own signage. There is no log to check. There is only the phone ringing.

What to do now

If you are shopping for a vehicle: bookmark your state’s dealer license lookup and the DOJ provider list before you need them, and make the license check the thing you do first rather than the thing you do when something already feels wrong. By the time it feels wrong you are usually arguing yourself out of a deal you have grown attached to.

If a link came to you by text, ad or DM rather than from a search you started, you can run the address through our free link checker before you open it. It is not a substitute for the license lookup — a cloned dealership’s domain may be perfectly ordinary — but it catches the crude end of the range in a few seconds.

The habit underneath all of this is older than the internet: verify through a channel the other person did not choose for you. A number you looked up. A register they cannot edit. An inspector they did not recommend. It is the same muscle that catches the fake bank fraud department, which is why practicing it on something low-stakes tends to hold when a real one arrives.