Think I have a problem........not good....

[shan75]

I have a situation with a OS purchase....

Ok....so....it's a little complicated...but here we go:

I found a car in usa. Did my homework.
I investigated the dealership car is at (on consignment I think). I spoke to a local mustang club in the area that the dealer sponsors - got good feedback.

They seemed like a quality operation, with mechanical and restoration ship as well - and all legit. Could not find fault.

I then had the car inspected - independently. Came up trumps (as I have mentioned on other sections of this forum). Even had it accessed for inspection on a hoist. So car was confirmed authentic, all good, all real. Dealership very helpful. I negotiated a price, all parties agreed.

I locked in a $500 deposit via paypal, which they confirmed and then arranged for funds transfers via banks to avoid further paypal fees.

So I get another email from the sales manager, with the Bill of Sale, with figures covering remaining amount required less deposit) and Wire transfer details. Confirmed vehicle title, all paperwork is good. All the numbers on bill of sale adding up fine.

All looking good so far right?

So I also thought. I suspect at this point - the dealership did as well.

So it seems that either the dealership has a dodgy employee (which I honestly believe is not the case), or the more likely scenario - their business systems (including email) have been compromised.

So I get an email from the manager, from their email servers, stipulating account transfer details to finalise the deal. Account name on the wire transfer details is VERY similar to the company name - looked like a trading name to me. Wire details even listed the address of the dealership etc.

Now please remember, this has not come from some gmail address, the details to finalise the transaction came from the email address I had been communicating with the whole time. The sales manager. Nothing to raise any flags. Email from the same sales manager I had communicating the whole time to arrange inspections and everything.

Problem is - the account details provided on the email are not the dealerships. They have confirmed it is not their bank, it is not their company account. So I transferred a LOT of money into an account that was not theirs.

Not sure if anyone has been here before, so I am asking for some advice. This literally happened this week.

Dealership has not officially responded yet, so I have no idea what the outcome will be. Think they are trying to work out what happened and how as well. Anyone been here before?

Seems I may possibly have been exposed due to security issues with IT systems on their end. Whoever has perpetrated this fraud, has done so very elegantly, through to dealerships very own email system I think. They set up a bank account with a name similar to said business as well.

So I transferred money based on information they provided to me from their business. So I have done nothing wrong except respond to and act on info that has come from them (or at least from their business systems).

I have no idea whether dealerships liability insurance would cover that sort of theft in the USA.

I am out of pocket, due to no fault of my own, acting on good faith their information was accurate and uncompromised.

I am freakin out here. Any advice appreciated. Do I have any chance of success getting the dealership to take accountability?

Shan

[Nuts]

Talk to your bank immediately!

[boofhead]

Stating the obvious but you have no paypal protection - shame no issue if you did - they asked you to avoid it so assuming the dealer is legit and the email come from their servers then they are responsible. Now having said this if they choose not to come to the party then you have to start legal action otherwise you walk away with nothing (which still maybe the case after the legal dispute is concluded). Naturally the police would need to be informed (hopefully already). You should be prepared that this may not come out well for you.

Edit: Yes talk to the bank might be able to help. At least it can be confirmed the money went into the account as detailed by the dealership. The police might be able to put a hold on the account - then maybe a chance.

[hybrid]

Bear in mind that you can make an email appear to come from where ever you want VERY easily.
I would not assume that the email actually came from their systems, unless you're an IT person that knows how to inspect the full headers of the email message.

If you want, you can forward the email to me (or even better, attach the original email to a new email) and I can investigate it for you.
I really hope you are able to get your money back, but people like this have stolen many millions from banks. Unless an entity is willing to take responsibility, you're unlikely to get the funds back - there has probably been several transfers away from the original account by now and/or it's been laundered through casinos etc.

[nassi]

No help i know, but that stinks.

[cage]

Mate, send an email that came form the dealer early on in the process,an email where you are super confident is from the dealer and the email where they say don't use PayPal but use these bank details and send them to Hybrid. He will be able to tell you where each email is really from.

I also agree with Nuts, my first call would be my bank.

Don't waste time on this mate, the quicker the better.

[shan75]

Money is gone - no question of that at this point. Have requested a reversal, but once it is in an account - totally up to the other people to accept reversal request. So think I've done my savings. Would have gone into the dodgy account last week. So yeah....bye bye.

I have PM'ed hybrid for an email addy to forward the emails to. I would like answers.

The dealer did not say "not to use" paypal, I just thought the transfer through Oxforex a more efficient and cost effective way to do it. Got no one but myself to blame there.

All the emails I sent were from my work email servers. I am not technical, but I work for an IT company that has pristine security systems. We are an approved partner for some of the big security vendors and our guys install the stuff for large corporates. So while I am stupid - I work with some really smart people. Failure is not our end.

I took it fore-granted that the USA dealer systems may not be up to scratch like ours are. Feel so stupid. Whoever did this was monitoring their servers for a while I think.

I get the impression (although not said directly) that the dealer sent an email to me with ALL the accurate info. I spoke with the accounts girl that prepped all the final info for payment (bill of sale, wire details) and she sent to the sales manager, who would forward it to me. She said what was sent to me was not what was prepared by accounts. So this email was somehow stopped and an alternate email sent with all the dodgy transfer info.

I never received the email with the right information at all. So whoever did it definitely has control of the email system they use in some way and is able to stop emails coming.

Like I said......was pretty elaborate.

Dealer accused me of being at fault, told me I am a liar and said he thought I was the scammer. Was a really horrible conversation. Either he knows his systems have been compromised and does not want to say OR he really thinks I am at fault somehow. My concern is others could still be at risk with this organisation.

I'll keep pushing though.

I called the USA police station in his area - filed a report. Will also do the same with ACORN here. Unfortunately I think my mustang dream has come to a rather upsetting end. My wife and I are gutted.

Bloody hell.

[LEEH69]

Shit mate that sucks, I really hope you get it sorted

[Nuts]

That is the worst. I do hope you eventually get to live your dream!

[69candy]

Not good!! Try the reversal think with your bank, and ask them about the fraud insurance. I would also get onto the police here and ask for the internet fraud squad? to investigate, Good luck

[Dwayne]

That sucks big time, and is a valuable lesson for us all.

We've received a few well faked email scams like this with our chinese suppliers, and only picked it up because the bank account details had changed. Queried the change by replying to an old email and they even confirmed the change in account details immediately. Their servers had been hacked.

It was only when we sought further confirmation directly via WeChat that we picked up the fraud attempt.

[shan75]

Hi Guys,

Hybrid has been bloody awesome - really knows his stuff.

There is a remote chance we can make the dealer accountable, but I have spoken with some people - could be a struggle.

According to Hybrid, it does look like the email server of the dealership was compromised. He believes someone likely has the passwords and can access it. That is what it looks like so far anyway.

While I cannot discount the dealer being dodgy in some way, it's my honest belief they sent the accurate payment information, but it was somehow stopped and an alternate sent.
This was all done from their servers. All from what appears to be the accurate email address. Pretty scary stuff.

Lesson is ALWAYS authenticate in two different ways. Email is NOT safe - at all. Pick up the phone and call to confirm the details sent to you with any large transaction. ALWAYS!
You have no idea who is listening to an email conversation.

Learn from my hard lesson.

Will investigate the legal route now.....although given the costs of such an exercise may be beyond us.

My thanks to you all for the support.

cheers,
Shanan

[cage]

Nice work Hybrid.

This is a sick story Shanan, absolutely horrible. Keep fighting as much as you can mate, as you stated once early on, if this can now boil down to an insurance claim on the part of the dealer then you may still be in the hunt, even if you pay the excess etc. Feels like you have a ways to go with it so good luck and keep us posted.

[hybrid]

Just to clarify - the dealer uses GoDaddy to host their email and domain name.
It is my opinion that someone has guessed (or brute forced) the password for the dealers godaddy account and has been using it to send emails.

[ozbilt]

Shanan, if you need a good US lawyer I have one. Based in Los Angeles and is familiar with web based cases. I used him in 2006 in US Federal Court (& won against multiple parties). Call me if you need his details. Probably pay to have a chat with him.