Fighting the scourge of storage spoofing

Non-existent fuel or storage capacity

It was about four years ago that the Netherlands had its first incidents of storage spoofing: selling non-existent storage capacity and supplies in Rotterdam's dock terminals. Storage spoofing is similar to a fake webshop scam: crooks register a domain name like the name of a familiar, reputable storage and supply company, then set up a website like that company's. On the site, they'll advertise special offers – a quantity of fuel at a knock-down price, say. Companies and private individuals visiting the site think they've found a bargain, and snap it up. Only to find that they've been swindled out of their money: the fuel never existed. And, in contrast to the average fake webshop scam, the sums involved can be huge. "Some firms have lost hundreds of thousands of euros," says Ward Veltman, Programme Manager at FERM, a partnership set up by firms based at Rotterdam docks to tackle cybersecurity. "I've seen e-mail correspondence shared by victims, detailing high-value negotiations with crooks."

International fraud

It isn't only the amount of money involved that distinguishes storage spoofing from fake webshop scamming. "In the port of Rotterdam, there are firms from all over the world," explains Chiel van Spaandonk, Process Owner at SIDN. "So the victims of fraud can be from anywhere. The scammers also go to more trouble to seem convincing. They have professional-looking fake websites that are easily mistaken for the real thing, complete with real contact details. And they send out genuine-looking invoices for their imaginary goods and services. A lot of time is also invested in getting search engines to rank the scam sites well."

More scams reported every week

The prevalence of storage spoofing is apparent from the URL blacklist maintained by FERM, which now has more than five hundred malicious website addresses. "More scams are reported to us every week," says Veltman. "If anything, the number of reports has been increasing recently. After all, this is a good time for investing in fuel, because the oil price is historically low. The opportunity is there to buy cheaply now, and sell at a healthy profit later. Fraudsters are taking advantage of the current market conditions to pressurise buyers into making hasty decisions."

Always report frauds to the police

So, what can be done about storage spoofing? FERM helps the police by sharing as much information as possible, such as where the scammers' e-mails come from. However, FERM's efforts are useful only if victims tell the police what's happened. Unfortunately, a lot of them don't. "Foreign companies may not find it easy to report an incident to the Dutch authorities," says Veltman. "Nevertheless, if you get hit, you should report it. Because it's not the case that there's nothing anyone can do. And one thing's for certain: if you don't report it, there's no chance of you ever getting your money back."

End of the road for storage spoofing?

We've now teamed up with FERM, the port police and the Public Prosecutor's Office to develop a procedure for taking down malicious websites with .nl extensions. Explaining the rationale for the move, Van Spaandonk says, "We have a responsibility to do all we can to keep the .nl domain secure. So we've established a takedown procedure and we're helping FERM to identify suspect sites. Our abuse team's experience with fake webshop detection and policy development is really useful in that context." Will the initiatives put an end to storage spoofing? Van Spaandonk fears that's over-optimistic. "Even if we manage to stamp out spoofing in the .nl zone, there's no shortage of other top-level domains that scammers can use. The total elimination of cybercrime is probably an impossible dream. So we would advise everyone to remain alert and to trust their sense that something's too good to be true."