Fake buyer fraud: scammers get hold of goods by posing as genuine buyers

How it all began

Jeffrey first discovered that something was wrong when he got a call from a webshop. Someone had ordered 4,000 euros-worth of jewellery in the name of Jeffrey's business. "The webshop called to check, because of the value of the order," he recalls. "Of course, we knew nothing about an order. I run a livery stable, so the business has absolutely no need for jewellery, and would certainly never place an order that big." Not long afterwards, packages started arriving, which no one at Jeffrey's stables had ordered. The scammers had apparently taken his business's Trade Register number and VAT number from his website, then used them in combination with a domain name very like his own to place orders with all sorts of companies. The crooks had gone after things they could resell quickly, such as jewellery, high-grade tools and expensive lighting equipment. Many of the suppliers had fallen for the scam and sent the goods to an address that had nothing to do with the stables.

Fighting back

Fortunately, the cyber-crooks made a mistake: they got one package delivered to the stables. When it arrived, Jeffrey contacted the webshop that had sent it, leading him to realise what was happening and report the matter to the police. Although the police didn't have the capacity to investigate fully, Jeffrey wasn't willing to drop it. With the help of some techie friends, he traced the IP address used to place the orders.

"The crooks had created a website that looked very like ours, complete with a lookalike domain name and a contact e-mail address similar to the one we use," continues Jeffrey. "They then used their lookalike domain to send e-mails and place orders. I'm pleased to say that we managed to get the site blocked by approaching the hosting service provider in line with the Notice and Take Down Procedure."

Damage mitigation

Jeffrey's alertness and speedy response meant that the scam was stopped before even worse damage could be done. One of the fraudulent orders went to Jeffrey himself because the scammers failed to change the delivery address. In a few other cases, orders weren't fulfilled because the suppliers called to check, sensing that something didn't look right.

Regrettably, though, there may well be other webshops that Jeffrey doesn't yet know about, which did send valuable goods straight to the crooks. Jeffrey passed everything on to the police, but isn't hopeful that much will come of it. "The police simply don't have enough people to tackle crimes like this. We gave them all they needed to build a case: IP addresses, web addresses and order information. But incidents like this often aren't properly investigated."

Preventing future problems

Jeffrey has since taken a range of precautions to reduce the risk of anything similar happening again. He nevertheless recognises that complete protection is hard to achieve. Businesses are legally obliged to publish details such as their Trade Register numbers and VAT numbers, so scammers have easy access to much of the information they need. "One thing we have done is to put a notice on our website saying that we send e-mail only from a particular mail domain. So, if a message with our name on it comes from another domain, it's likely to be a scam."

*For privacy reasons, we've changed the victim's real name.