Piston heads fraud scam

[Garf71]

Having advertised my car for sale through PH classified, I received quire an abusive email initially telling ME I was stupid, I was scamming people and basically I should have been shot at birth, then another mail within minuites asking if the price if the car was correct!?
With this I logged on to my ad and surprised to discover the price had been reduced from £60,000 to £22,000 and the ad stated,
'For a quick reply, contact me directly at the address on picture no 2'
This wasn't my address and someone was attempting to sell my car!
At this point I didn't know whether the car was to be stolen to order, or if there was am elaborate scam, knowing the police would require more information, I contacted the 'new seller' using a new mail address who replied with the following;

just got your message regarding my ******* *** **** Please note that the location is not shown correctly on Pistonheads, that's my old address. I recently moved back to the Denmark and the car is in Copenhagen ready for test drive or delivery. It's a right hand drive car and can't be driven in the Denmark so I'm selling it. The car runs just perfect, looks great in and out as shown in the pictures, no smoking owner, no mechanical flaws, accident free & HPI clear.

Has full service history,8 months of MOT and 7 months of TAX.
Considering the offers I received I'm asking £****** and this includes delivery to your location. It's ready to be delivered with all registration documents, service records, original invoice, both car keys and the bill of sale.

I went down the road of contacting the imposter to gather as much info as possible of which I have quite a lot inc their bank account info. He then suggested that the payment is sent using 'Amazon Payments' and the car will be shipped to me, the funds will be held in escrow and won't clear until I'm happy, Giving peace of mind.

The account is direct to the fraudster, not an escrow account, the fraudster will send email headed from Amazon, but clearly they are not.

I'd hate for someone to get caught out in this manner, so, buyers please be cautious!

[anonymous-user]

Just wondering how secure the password you used when you registered for the classifieds is? Is it your username, or password123, or the brand of car you're selling? Did you use a common dictionary term, or something random and secure?

It's just there's a lot of it about and having a lot of IT experience I tend to instinctively think "duff passwords....." but if you're using a proper random password then it's more of a worry.

[so called]

That's disgusting.
Have you informed the Police ?

[Crafty_]

Funnily enough I found a similar advert whilst browsing the classifieds this morning, I don't think its the OP's ad as the price is different, but it follows the same scam "contact me see pic no. 2" and is obviously far too cheap for the vehicle

http://www.pistonheads.com/classifieds/used-cars/m...

(In case it disappears its a private ad for a 2014 E class convertible for £15,900)

Edited by Crafty_ on Sunday 8th February 09:42

[Garf71]

The password couldn't be guessed whatsoever.
PH site is hacked, (had my IT guys check our end and it's not us)
This is the 2nd time in a week with this ad, it was reported to PH on Monday & they reset it and I chose a new password.
Same persons email embedded in the pic too!

[Garf71]

Same format as my ad, same font, just a different email address to contact.
I contacted the police, they didn't want to know, they referred me to action fraud, who take the info, but don't do anything!
I literally provided all the info to enable them to make an arrest & they still did nothing!
I even reported the account details to Barclays so they could monitor or close the account.
Much more I can't do!

[Pints]

Garf71 said:

PH site is hacked, (had my IT guys check our end and it's not us)

That's a bold statement to make. There's a difference between a password being guessed (or having access to it) and the PH server being "hacked".

There are other considerations such as the security of your email address.

Any of the PH IT bods care to comment?

[Bebee]

I informed PH of the silly prices asked for private listings a while ago, it's obviously a scam, so low the prices only a idiot would inquire.
I spoils my daily surf and have to result to selecting trade only to avoid the st.
This of course is unfair to the genuine private sellers who paid for the listing.

[Garf71]

PH's explained that the info is gained by phishing at their end, usually there is a mail when posting the ad asking you to change your password. This is how the info is gained.
They wouldn't just be looking to target me on the off chance I was to sell a car?
It's within PH, How do you explain numerous ads in the same format?

[myvision]

Not the only people to notice.

http://www.pistonheads.com/gassing/topic.asp?h=34&...

[Garf71]

Agree with their comments, definitely brings the site down a notch or two.
Think I'll stick to eBay & autotrader in future!
I shall be 'attempting' to call PH again tomorrow to cancel the ad & request a refund.

[Lumpyuk]

I've seen a few of these phishing emails when selling cars. Easy to pickup when it takes you to a none PH website asking you for your login details or from a none official PH email address.

[LaurasOtherHalf]

It does take you to pistonheads though, just had this through for my advert;



From the following person;


Basically, when she asks me to look at "my advert" it takes me to the pistonheads log in page where I guess they are remotely looking at what someone types in.

[Garf71]

I had the same, altho called 'Anna' but when I clicked on the link it took me to range rovers, which was not my ad, so I didn't go any further, just clicked on the link, but didn't enter any info.

[anonymous-user]

Just because the URL in the email reads pistonheads it doesn't mean it actually sends you to pistonheads. It's a very common way of redirecting people to sites designed to steal credentials. If you open that email again and hold your finger over the web address for a few seconds it will pop up another window which shows you the actual address it's going to send you to - I bet it's not www.pistonheads.com

[rscott]

charltjr said:

Just because the URL in the email reads pistonheads it doesn't mean it actually sends you to pistonheads. It's a very common way of redirecting people to sites designed to steal credentials. If you open that email again and hold your finger over the web address for a few seconds it will pop up another window which shows you the actual address it's going to send you to - I bet it's not www.pistonheads.com

Spot on. It's the same way many, many bank phishing mails work. If you click on the link now, what's the exact url it displays?


(having said that, slightly worrying that PH doesn't use a secured address for the ads. That would give a small degree of protection against obvious phishing)

[eybic]

charltjr said:

Just because the URL in the email reads pistonheads it doesn't mean it actually sends you to pistonheads. It's a very common way of redirecting people to sites designed to steal credentials. If you open that email again and hold your finger over the web address for a few seconds it will pop up another window which shows you the actual address it's going to send you to - I bet it's not www.pistonheads.com

This is correct. The email won't have originated from us but from the scammers, they create the link so it looks like you're logging into PH but it is in fact a site they have created to look like PH. If you were to click on "forums" on the "PH page" you are sent to for example, it wouldn't work.

As has been said, this is called phishing and is getting more and more sophisticated.

[rscott]

eybic - are there any plans to use https for parts of classifieds system? That would provide a (small) degree of protection.

[eybic]

rscott said:

eybic - are there any plans to use https for parts of classifieds system? That would provide a (small) degree of protection.

I've asked for clarification on this and will get back to you asap

[plenty]

How to report scam adverts (which as above are starting to proliferate and are seriously undermining the credibility of the PH classifieds)?

There used to be a "report" button on the advert page but this seems to have disappeared now that PH has adopted a strategy of adding lurid display advertising to the page borders.