Fake Equipment Dealers: The Wire Transfer That Buys Nothing

Most fraud advice assumes the victim was careless. This one does not survive that assumption. The buyers in these cases did the research — they searched the dealer’s name, they landed on a site with the right inventory and the right logo, they got a purchase agreement with line items and a delivery date. One of them had bought from that dealership before.

That is the part worth sitting with. The FTC’s alert, published 15 September, describes a farmer searching online and finding “a tractor from a business you know, and maybe even bought equipment from before.” The name is not a red flag. The name is the lure.

Six tells before you send a deposit

None of these is conclusive on its own. Two together is a stop.

1. The price is under market, and there is a story attached. An estate sale, a fleet downsizing, a dealer closing out. The BBB’s casework lists “owner cites an overly personal reason they need to get rid of a vehicle” as a standing red flag, and steep discounts were the hook in the Kansas case below.
2. Payment collapses to one method. Wire only. Sometimes ACH to an account whose name does not quite match the dealership. The FTC’s advice is blunt: never send money to anyone who says you can only pay by wire transfer, gift card, cryptocurrency or a payment app.
3. You cannot go and look at it. BBB found this in every cluster it traced: the seller always claims the unit has to ship, which conveniently removes the one check that would end the conversation.
4. The contact details on the site do not match the ones you can find anywhere else. This is the actual mechanic of the clone. Photos, layout, product listings and reviews get copied wholesale; the phone number and the bank details are the two things swapped.
5. There is a clock on the deposit. Another buyer is interested, the truck is already routed, the price holds until Friday. Urgency exists to compress the window in which you would otherwise make a phone call.
6. The reviews live only on the seller’s own site. BBB investigators flagged fake customer reviews and ratings as part of the Rock Line Equipment site’s furniture, alongside brand-name listings and warranty promises.

And one that is not really a tell so much as a structural warning: the first search results you see may be paid ads, and scammers buy them. The FTC says so directly — criminals place ads that pretend to be a real business while carrying their own contact information. Scroll past the ad block to the organic results before you trust a phone number.

What the Kansas case shows about how good the fakes are

In May 2026 the BBB went public with an investigation into a site called Rock Line Equipment, which presented itself as a machinery dealer selling tractors, excavators and loaders at discounts investigators described as too good to be true. Reported losses at the time totalled about $51,000, spread across buyers in several states who had wired money for equipment that never showed up.

Three details are worth pulling out, because they are the same three details in most of these cases.

The site listed a Kansas City address. BBB found the address invalid — and sitting next to an unrelated company called Road Builders, which had been fielding calls from people trying to track down machines they believed they had bought. That is the tell an hour on a mapping service would have caught.

The operation also claimed a connection to Skyland Industrial LLC, a real Kansas equipment dealer. According to the company, victims were handed wire instructions specifically constructed to make the payment look like it belonged to the legitimate business. The point of borrowing a real name is not vanity. It is to survive the exact search a cautious buyer runs.

And it was referred out — to the Kansas Attorney General’s office and the Kansas City, Kansas police department. Referral is not recovery. By the time a case is referred, the wire has generally cleared, been withdrawn, and moved on.

Figure 01 · The five steps of a purchase that never existed ScamDrill

Sequence per the FTC consumer alert “Scammers are impersonating farm equipment businesses,” 15 September 2026, and BBB investigative reporting on equipment impostor sites (2025–2026).

One name server, thirty dealerships

It is tempting to read a case like Rock Line as a one-off — somebody threw up a website, got lucky, got caught. The infrastructure says otherwise.

When BBB’s International Investigations Initiative looked at the registration data behind the fake vehicle and equipment sites reported to it, the domains clustered. One name server in Lithuania hosted close to thirty of them, claiming addresses in Alabama, Minnesota, North Dakota and Ohio, selling everything from classic cars to agricultural machinery. A second name server in Iceland carried nearly twenty more, with claimed locations in Tennessee, Nevada and South Carolina, some of them advertising heavy construction equipment.

That is not opportunism. That is a production line, and the individual storefront is disposable in a way your money is not.

BBB also recorded something I had not seen before in a fraud writeup: after its Central and South Alabama office started publishing warnings about local impostor businesses, BBB.org itself came under repeated distributed denial-of-service attacks. The apparent goal was to knock the complaint pages offline so a buyer checking the business would find nothing. Whether or not that was the motive, it tells you these operations treat the reputation layer as terrain to be fought over.

Why it is always a wire

Because a wire is the only common payment method that is both large enough for the purchase and effectively final once it lands.

A credit card gives you a chargeback. ACH gives you a limited and awkward return window. A wire, once the receiving bank has credited the account and the money has been pulled out, is gone in a practical sense even when it is theoretically traceable. The FTC puts it plainly: scammers prefer these methods because once they have collected the money, it is almost impossible to get back.

The volume behind this is not small. In its 2025 Internet Crime Report, the FBI’s IC3 logged 56,478 complaints under non-payment/non-delivery, with reported losses of $503,373,587. That bucket is broader than equipment fraud — it covers everything bought and never delivered — but it is the category these cases land in, and half a billion dollars is what “the delivery never comes” adds up to across a year.

The wider impersonation picture moved the same direction. FTC data released in June show people reported losing $3.5 billion to imposter scams in 2025, with nearly $1 billion of that going to business impersonators specifically — up from $866 million the year before. Nearly one in three fraud reports the FTC received was an impersonation of some kind.

Four checks, about twelve minutes

You do not need a fraud team for this. You need to be willing to be slightly annoying on the phone before a five-figure wire leaves.

Figure 02 · What to check, and what a failed check looks like ScamDrill

Checks assembled from FTC guidance on impersonation and online shopping (September 2026), BBB red flags for vehicle and equipment seller scams, and the specific failures documented in the Rock Line Equipment investigation.

Find the number yourself. Not from the site, not from the ad, not from the signature block on the quote. Your state’s dealer licensing lookup, the manufacturer’s official dealer locator, a directory listing that predates this week. Call it and ask whether they have the unit and whether the quote number is theirs. In the Kansas case that call would have reached a confused business that had never heard of the order.

Look at the address. Literally look at it, on a mapping service, in street view. A machinery dealer occupies a yard. If the pin lands on a strip of offices, a residential block, or a lot belonging to a company with a different name on the sign, you have your answer in under a minute.

Check when the domain was registered. A dealership that has been in business since 1974 should not be operating on a domain someone registered in March. Free WHOIS lookups are enough for this. It is not proof of fraud on its own — businesses do rebrand — but a two-month-old domain on a fifty-year-old business name is a question that deserves an answer before the wire, not after.

Make the payment method the test. Ask to put the deposit on a card. Ask whether they will use an escrow service your bank suggests. A real dealer will grumble about the card fee and then take the card. What you are watching for is the reaction — a seller who cannot accept any instrument that carries a reversal right has told you something about the transaction.

If the machine is worth wiring for, it is worth sending someone to stand next to. Even a paid local inspection costs a fraction of the deposit, and the one structural constant across every reported case is that in-person inspection was never on the table.

If the wire already went out

Speed is the whole game here, and the window is measured in hours rather than days.

The FBI runs a process for exactly this. Its Internet Crime Complaint Center has had a Recovery Asset Team since 2018, and the mechanics are straightforward: when IC3 receives a complaint about a transfer made under fraudulent pretences, the team forwards the transaction details to a contact at the receiving bank, asks that the account be frozen, and loops in the relevant FBI field office. That sequence is called the Financial Fraud Kill Chain.

In 2025 it ran 3,900 times, against $1,163,919,846 in attempted theft, and froze $679,013,183 — a 58% success rate. For businesses inside the sixteen critical infrastructure sectors, the team initiated 655 of those and froze $146,561,094 of $261,451,001 reported, a similar 56%. IC3 is careful about why those rates hold, and the report says it directly: the chain assists “when complaints are filed as quickly as possible.”

Which means the odds you read about belong to the people who reported inside the window. Nobody can promise you your money back. What you can do is make sure yours is one of the cases that reaches the process at all.

In the first hour:

1. Call your bank’s wire desk, not the branch. Use the word fraud and ask for a wire recall. The branch will route you; the wire desk can act.
2. File at IC3.gov with the full transaction detail. Originating bank and account, receiving bank and account, amount, date, time, and any intermediary bank on the instructions. That detail is what the Recovery Asset Team actually needs; a complaint without it is slower to action. If money has already moved on from the first account, say so — IC3 will chase second-hop transfers when it is given the information.
3. Report to the FTC at ReportFraud.ftc.gov, and to your state attorney general. The Kansas matter went to the state AG and local police; that is the route.
4. Tell the business being impersonated. They are almost certainly already fielding calls, and they often have a folder of evidence and a contact at the registrar. You are also confirming for them that the fake is still live.
5. Report the site and the ad. The hosting provider, the domain registrar, and whichever platform ran the ad. Each has its own abuse channel and none of them talk to each other.
6. Write the timeline down while it is fresh. Screenshots of the listing, the quote, the invoice, the wire instructions and the message history. Sites vanish, and your insurer and your bank will both ask.

If the loss is large enough to touch operations, the sequencing beyond the first hour matters more than the thoroughness, and we set out the order to work in separately.

The other victim is the dealer whose name was taken

This part gets left out, and for a small business it can be the more expensive half.

The clearest case BBB has documented is a couple in Canby, Minnesota, who repair and sell motor home parts. Somebody lifted their photos, their address and effectively their identity; thousands of emails arrived from people convinced the shop had stolen from them; the husband changed his phone number after passing three thousand unread texts. They ended up planning to close. We told that story at length in the consumer cut of this scam, so I will not repeat it here beyond the part that matters to anyone running a business with a website: he did nothing wrong. There was no breach. His site was simply good enough to copy.

Equipment dealers are a softer target than most, because the inventory photography that sells machines is also the raw material a clone needs. If you sell equipment, the defensive posture is mostly surveillance and preparation:

• Set a standing alert for your business name and your main product lines, and run a reverse image search on your own listing photos every so often. That is how impersonation usually surfaces — through a customer, weeks late, or through your own search.
• Publish a short, findable “how we take payment” page: the exact bank name on your account, the fact that you will never change wire instructions by email, and the one number to call to confirm. Send it with every quote.
• Keep a takedown packet ready — screenshots, WHOIS, the registrar abuse address, your trademark or business registration. When a clone appears, the first day is worth the next thirty.
• Warn your customers in advance rather than after. A single line in your quote template does more work than a notice posted once the calls have started.
• Understand that your reputation surface can be attacked directly. BBB got knocked offline for publishing warnings; a small dealer’s site is a softer target than that.

What to do now

Three things, and the first two are quick.

Write down who in your business is allowed to release a wire, and what they are required to verify first. Most companies under fifty people have this rule in somebody’s head rather than on paper, which means it is a rule right up until the week things are busy.

Then give that person one sentence they are allowed to say out loud: we verify new payment details by phone on a number we sourced ourselves, and I am not able to skip that. Make it policy rather than judgement, so declining is not a personal act. If you want a second pair of eyes on a listing before anyone commits, our free link checker will at least tell you what the domain looks like.

The third takes longer and decides whether the first two hold. People can recite red flags in a meeting. Recognising a pretext in a meeting and recognising one at 4:40 on a Friday, with a machine you need and a seller who says the truck leaves tomorrow, are different skills, and only one of them gets practised by accident. That is what a drill is for. Smaller firms get picked precisely because that rehearsal has not happened — and the same crews run the payroll version and the consumer car-buying version of this with the same tooling.