Paying for a car you just won, without being defrauded

The moment between winning a car and owning it is the moment you are most exposed, and it is targeted deliberately. You are about to send a large sum to someone you have never met, you are in a hurry because the payment deadline is short, and you are pleased about the car. That is an ideal set of conditions for fraud, and the people who do this for a living know it.

None of what follows is unusual caution. It is the ordinary standard of care for a wire you cannot reverse.

Wire fraud is the main event

The dominant fraud in vehicle purchases is not a fake car. It is real car, real seller, intercepted payment instructions.

It works like this. Someone has access to an email thread — the seller's account, a broker's, a shop's, sometimes just a convincing lookalike domain. At the moment the invoice is due, you receive updated wire instructions. The email is in the right thread, in the right tone, referencing your actual car. The account details are the fraudster's. You wire. The money is gone, usually within hours, usually abroad, and a wire is final.

The defence is one rule, and it is not optional: verify payment instructions by voice, on a number you obtained independently.

• Independently means from the venue's own website, your invoice from before the thread began, or a number you already had. Not the number in the email containing the instructions.
• Verify by reading the account details to them and having them confirm, rather than having them read them to you.
• Treat any change of instructions as fraud until proven otherwise. Legitimate parties change bank details very rarely and are entirely unsurprised to be asked to confirm. Urgency attached to a change of details is the signal itself.
• Do this even when nothing looks wrong. The whole point of this attack is that nothing looks wrong.

Pay the venue, not around it

When you buy through an auction house, you owe the auction house. It invoices you, it holds or forwards the funds, and it has a process. Stay inside that process.

Be immediately suspicious of any request to:

• pay the seller directly rather than the venue;
• pay a third party described as a shipper, agent or escrow company that you did not choose;
• split payment across accounts, or send part by a different method;
• continue the transaction on email or messaging outside the platform.

Each of these removes the one party with a reputation to protect. The request may come with a plausible reason. The reason does not change the exposure.

Private sales

Without a venue in the middle, you need something standing in for it.

Escrow, chosen and verified by you — not a service the seller introduced. Fake escrow sites are a mature industry with convincing branding. Confirm the company exists independently of any link you were sent.

Payment at the point of exchange, with the title in hand. A cashier's cheque exchanged in the lobby of the issuing bank, with the bank verifying it, is slow and awkward and considerably safer than a wire into the unknown. Cashier's cheques are also forged; having the issuing bank confirm it is the part that matters.

Never send a deposit to hold a car for a seller you cannot verify, and never by a method with no recourse — gift cards, crypto, person-to- person payment apps. Those methods exist in this context for one reason.

Before the money moves

• See the title. Images at minimum, matched to the VIN on the car, in the seller's name or with a clear explanation of why not.
• Confirm any lien is released, with the release document, not an assurance.
• Know who you are paying — the legal entity name on the invoice should match the account name at the bank. A mismatch between the two is a stop-work condition.
• Keep every document. Invoice, wire confirmation, title images, the bill of lading, your correspondence. Fraud recovery, when it is possible at all, depends on moving within hours and having paperwork ready.

If it goes wrong

Speed is the only lever. Call your bank immediately and ask for a wire recall — within the same day there is sometimes a chance, and after that there is usually not. Report it to your bank in writing, to the auction venue, and to law enforcement. In the United States that includes the FBI's IC3. Recovery is uncommon, which is exactly why the verification call is worth the four minutes it costs.