FAKE DEALERSHIP SITES - FTC ALERT

Every guide says spot the sloppy fake. The FTC just described a perfect one.

Scammers are cloning real car dealers' websites, logos, listings, photos, often with AI. The most useful thing in the FTC's alert is what its advice never tells you to do, which is look at the site.

SB

SafeBrowz Threat Research Security Research · 5 September 2026 · 9 min read

What the FTC published, and the three words inside it

The alert went up on 1 September 2026 under the title "Scammers are spoofing car dealership websites: What you need to know", written by BCP Staff. It runs to a few hundred words and describes a sequence that is easy to follow.

Fraudsters "clone a real auto dealer's website, often using AI to do so, copying the brand logos, vehicle listings, and photos down to the last detail." Some, the alert adds, "even include fake customer testimonials." They "might advertise rare muscle cars or hard-to-find classics to lure you in." Then they "describe the buying process in detail and offer flexible return policies to put you at ease." The end of it, as the FTC puts it, is "paying up front for a car you'll never lay hands on."

Read that first quotation again and notice the clause in the middle. Often using AI to do so. Three words, delivered in passing, and they quietly retire most of the advice consumers have been given about fake websites for the last fifteen years.

What AI cloning actually took away

Think about what you were taught to look for on a suspicious site. Blurry logos stretched out of proportion. Product photos with a competitor's watermark still on them. Sentences with the definite article missing. A layout that falls apart on a phone. A returns page that is one paragraph of nonsense. An About Us that says nothing.

Every one of those is a symptom of the same underlying constraint, which is that building a convincing site used to cost time and skill the fraudster did not want to spend. Take that constraint away and the symptoms go with it. A model can lift a real dealership's inventory listings, rewrite them cleanly, produce a returns policy that reads like a lawyer wrote it, and lay the whole thing out properly, in an afternoon.

So the cosmetic checklist is not wrong, exactly. It has just stopped being evidence. A page that looks professional used to be weak evidence that someone professional made it. It is not anymore, and that shift is the same one we described in our piece on AI-written phishing emails, where the spelling mistakes people were trained to catch simply stopped appearing.

Now look at what the FTC does not tell you to check

This is the part worth sitting with. The alert gives three pieces of advice, and it is a good list:

• Search for the dealer's name together with words like "scam", "review" or "complaint".
• Ask to see the car, and the dealership, in person. In the FTC's phrasing, if they will not let you, "pump the brakes".
• If the car is too far away to visit, pay for a mobile inspection service to go and look at it.

Notice what all three have in common. Not one of them asks you to examine the website. Every single check happens somewhere else: in a search engine, on a forecourt, through a third party you hire. The website, the actual artefact you were sent, is treated as something to be routed around rather than assessed.

That is not an oversight in the drafting. It is an accurate reflection of the situation the first quotation described. When the page is a faithful copy of a real business's page, the page has stopped being able to tell you anything, and sensible advice moves elsewhere.

The trap inside the first tip, which the FTC flags itself

Credit where it is due, because the alert catches this and it is the part people most need. Straight after telling you to search the name, the FTC writes: "Keep in mind that if the scammers are impersonating a real dealership, you might find glowing reviews."

That single sentence is doing a lot of work. These operations clone existing dealerships, so the name on the fake site usually belongs to a real business with a real history and years of decent reviews. Search it and the good record comes back. It reads as reassurance, and it is actually information about a completely different website. A reassuring search result is the expected outcome here, not the all-clear.

The FTC's answer is to go and look at the car. Here is a smaller step that fits before that one: search the web address rather than the business name, and compare what you find against how the dealer describes itself. A family firm that says it has been serving the county since 1987 should not be operating from a domain that came into existence six weeks ago. That mismatch, between claimed history and actual age, is one of the few things a clone cannot copy, and it is the same tension we walked through in how to spot a fake online store.

What is still checkable, because it is structural

Three things survive the cloning, because they are not properties of the page at all. They are properties of the business and its registration, and the fraudster does not control any of them.

1. The age and identity of the domain. A dealership that has traded for decades has a web address that has existed for a long time and that shows up consistently wherever the business is mentioned. A clone needs a new address, because it cannot have the real one. This is the check you can run in seconds rather than days.
2. The manufacturer's own dealer locator. For franchised new-car dealers this is close to decisive and it is oddly under-used. Carmakers publish a locator on their own site listing the dealers authorised to sell their vehicles. If a site presents itself as an authorised dealer for a brand and the brand's own locator has no such dealer at that location, you are finished. No amount of cloning reaches inside the manufacturer's database.
3. The state dealer licence. Selling cars is a licensed activity, and many states publish a free public search. California's DMV runs an Occupational License Lookup you can query by business name, city or licence number. Virginia's Motor Vehicle Dealer Board publishes a Search Active Dealers tool. Look up the dealer, confirm the licence is current rather than expired or revoked, and check that the address on the licence is the address on the site.

The second and third of those apply to different kinds of seller, and it is worth being precise. An independent used-car lot will not appear in any manufacturer's locator, and its absence there means nothing. The state licence check is the one that covers it.

The payment sentence, which is where the money is actually lost

The FTC gives one instruction in the imperative, and it is about payment: "Walk away if the dealer insists on an upfront payment by wire transfer only."

The load-bearing words are insists and only. Wire transfers are not fraudulent instruments, and plenty of legitimate vehicle purchases involve one. What no legitimate dealership does is refuse every other method. A real business wants the sale and will take a card, a certified cheque, financing, a deposit structure. A fraudulent one needs the payment to be irreversible, which is why the same insistence shows up with gift cards and cryptocurrency in every other version of this fraud.

So read the refusal, not the method. The moment a seller closes off every route that carries buyer protection, the transaction has told you what it is, whatever the website looks like. That mechanic is identical in marketplace payment scams, where the pressure is always toward the one rail that cannot be reversed.

How large is this, honestly

A number is useful here, but only an honest one.

The FBI's 2025 Internet Crime Report does not break vehicle sales out as its own category, so treat any confident car-specific loss figure you see quoted with suspicion. What the report does record is the bucket this fraud belongs to. Non-Payment and Non-Delivery, the category that covers paying for goods that never arrive, accounted for 56,478 complaints and $503,373,587 in reported losses in 2025, inside a national total that passed $20.8 billion for the first time.

Two caveats belong with those figures. They are reported losses, and most people who lose money to a fake storefront never file a complaint anywhere. And a car is an unusually large single transaction, which means a small number of successful attempts does a lot of damage.

A 30-second check before you send anything

You do not need all of this every time. In the order that eliminates the most risk fastest:

1. Read the address bar, not the page. Is this the dealership's actual domain, or a close variant of it? Compare it side by side with the address on the business's own verified listing, character by character, not from memory.
2. Check how old that domain is against how long the business claims to have existed. A decades-old dealership on a weeks-old address is the whole answer.
3. Look up the dealer licence on the state motor vehicle department's search. Current, matching address, right name.
4. Ask to see the car. Then listen carefully to the reason you cannot, if one arrives.
5. Ask to pay by card. Not because you must, but because the answer is diagnostic.

What a link checker settles here, and what only a person on the forecourt can

Being straight about the boundary matters more than usual with this one, because most of this scam sits outside what any browser tool can see.

We cannot tell you whether a particular car exists. We cannot inspect a vehicle, verify a title, or tell you that the photographs were taken somewhere else. The in-person viewing and the mobile inspection in the FTC's alert are doing work that nothing on this page replaces, and you should treat them as the real checks.

What we can settle is the question the cloning was designed to make unanswerable: is this address what it claims to be? Layer 1 runs generic checks locally in the browser before the page renders, the shape of the URL, a free-hosting host, a missing certificate, plus a small built-in lookalike list that covers major consumer brands rather than individual dealerships. It is not the layer that carries this scam, and it is worth saying so. The work here is Layer 2, which checks the address server-side against reputation sources, our blocklist, and a brand database of more than 550 names. Layer 3 is the AI deep scan, which reads what the page actually serves rather than what it resembles, one free scan a day for everyone and unlimited on Premium at $14.99 a year across up to three devices.

Here is the honest limit of Layer 3 on this specific scam, and it is the same one we hit with sites built to read clean to a scanner. A perfect clone of a legitimate dealership page contains no scam content, because every word of it was written for a real business. There is nothing deceptive on the page for an AI to find. The signal is not in the content, it is in the registration, and that is why the domain-level layers do the work here and the deep scan is the supporting act rather than the star.

If you have already paid

Speed matters more than anything else in the first day, so do these in order.

Call your bank and use the phrase fraudulent wire transfer. A recall has to be requested quickly and the odds fall away by the hour, so this call comes before the reporting. If you paid by card, ask about a chargeback in the same conversation.

Then report it at ReportFraud.ftc.gov and at the FBI's Internet Crime Complaint Center, ic3.gov. This is not paperwork for its own sake. A wire recall sometimes depends on law enforcement reaching the receiving bank, and the report is what starts that.

Tell the real dealership whose identity was borrowed. Their name is being spent on this and they will usually want to act. And keep everything, the listing, the emails, the payment confirmation, screenshots of the site, before any of it is taken down. Our step-by-step guide to what to do after a scam goes through the rest of it.