The useful answer first: the Federal Trade Commission is warning that scammers set up bogus car dealership websites to collect up-front payments for cars a buyer will never receive. The pattern is impersonation rather than a hack of the real dealer. Cloned pages copy brand logos, vehicle listings and photos, and some add fake customer testimonials and detailed buying instructions with flexible return policies to put shoppers at ease.
The practical takeaway is to verify the seller through a channel the cloned site does not control, and to insist on seeing the car and the dealership in person before money moves. The rest of this guide sets out the reported pattern, the checks the FTC recommends, and the questions the alert does not answer.
What the FTC says is happening
The alert describes buyers arriving at a dealership to find the dealer has no record of their order or payment, and no car waiting. That is the defining characteristic of the scheme: the payment went somewhere, but not to the business the buyer thought they were dealing with.
The mechanism is cloning. Scammers build a fake site that mirrors a real auto dealer's site, often using AI to do so, down to the logos, listings and photos. Some fake sites carry invented customer testimonials. Detailed descriptions of the buying process and generous-sounding return policies are part of the pitch, according to the alert.
Note the distinction between what is announced and what is established. The alert is a consumer warning published by the FTC, not a list of specific dealerships, a count of victims, or a statement that any named dealer was breached. It describes a category of fraud and offers defensive steps.
The checks the alert recommends
The FTC's guidance is short and can be run as a checklist before any payment:
- Search for complaints. Look up the dealer's name together with words like “scam,” “review,” or “complaint.” Negative results are a red flag.
- Do not rely on good reviews alone. If scammers are impersonating a real dealership, you may find glowing reviews, because those reviews belong to the real business. Positive feedback does not clear a site you reached some other way.
- Go the extra mile. Ask to see the car and the dealership in person.
- Use an independent inspection. If the car is too far away, tell the dealer you want to hire a mobile inspection service to check the car.
- Walk if refused. If they will not permit the inspection, consider taking your business elsewhere.
The logic behind the list is that cloning is cheap and copying is convincing, but a real dealership can still show you a building and a vehicle. A refusal to allow either is the cheapest available test, and it costs the buyer nothing to run.
A worked example of the check
Hypothetical: a shopper finds a listing for a used SUV on a site that looks like a familiar local dealer. The logo matches, the photos look professional, and the page walks through financing and delivery. Before paying anything, the shopper could run these steps in order:
| Step | What the shopper does | What would count as a warning sign |
|---|---|---|
| 1 | Search the dealer name with “scam,” “review,” or “complaint” | Complaint threads about up-front payments with no car |
| 2 | Ask to visit the lot and see the vehicle | Excuses, pressure, or refusal |
| 3 | For a distant car, request an independent mobile inspection | Refusal to allow the inspector |
| 4 | Compare the site against contact details found independently | Contact details that reach only the site, not the dealer |
Step 4 is an extension of the alert's principle rather than a step it states. The alert's own instructions are steps 1 through 3. The point of the sequence is that any single signal can be faked or explained away, but a refusal to let an independent person look at the car is hard to explain if the car exists.
Why the cloning trend matters more than any one listing
Most consumer fraud advice assumes the fake is sloppy. This alert describes the opposite: fakes that copy a real brand and its inventory closely enough that visual inspection of a website tells you little. The reported use of AI to build the clones makes that cheaper to do at scale, which is why the alert leans on off-site verification instead of site-level spot checks.
For a reader used to checking whether a service is down or an exchange is compromised, the framing shifts. Here the question is not what happened to a platform you already use, but whether the site in front of you is the business it names. The evidence is a building, a vehicle, an independent inspector, and complaint history, not a polished page.
What the source does not say
The alert does not name any impersonated dealership, estimate the number of victims or the money lost, or describe how payments were typically requested. It does not say which platforms or search engines hosted the cloned sites, or whether any have been taken down.
It also does not establish that a specific dealership was hacked or that its own systems were compromised; the described pattern is impersonation through a separate site. It offers no guidance on recovering funds after a payment, and it does not address whether regulatory action has been taken against any operator. Anyone who encounters such a site should treat those gaps as open questions rather than assume facts not stated.
A short checklist to keep
- Search the dealer name with “scam,” “review,” or “complaint” before anything else.
- Treat glowing reviews as inconclusive when impersonation is possible.
- Ask to see the car and the dealership in person.
- For a distant car, insist on a mobile inspection service.
- If inspection is refused, look elsewhere.
The alert closes by pointing readers to further FTC consumer advice, which is the appropriate place to look for updates beyond the steps above.