If a fake website is collecting deposits under your dealership’s name, appoint an incident lead immediately. Save the evidence while staff warn shoppers and direct anyone who paid to their payment provider. These reporting routes apply to U.S. dealerships, with Wisconsin-specific options identified where relevant.
The Federal Trade Commission describes scammers copying dealership listings and branding to solicit payments. Those materials are publicly visible, so a copy on another domain does not by itself establish that anyone entered your accounts. Your genuine website can remain operational while the impersonator takes money elsewhere.
A caller may believe your store has their deposit and is refusing to deliver. Start by helping them address the payment, rather than arguing about who is responsible.
1. Assign responsibility and capture the evidence
Put a manager in charge of the incident log and public updates. Assign your marketing contact or web provider to handle technical reporting, so reception does not have to investigate a domain while answering worried buyers.
Start with the exact link the shopper received. It identifies the page involved in that contact; a broad search for your dealership’s name does not. Build a restricted-access evidence folder containing:
- Complete fake URLs, including individual inventory pages and any associated ads or profiles.
- Screenshots showing the address bar, copied dealership details and payment requests.
- Original emails, message threads and documents already received, including sender addresses and phone numbers.
- Discovery dates and times, with the time zone, plus a record of subsequent changes.
Have your web provider capture suspicious pages safely. Staff should not submit forms or download files to test the scam. Ask the provider to check for unauthorized access or changes to your genuine domain; evidence of either warrants a separate breach response alongside the impersonation work.
The FBI’s Internet Crime Complaint Center (IC3) instructs complainants to retain original evidence because its complaint process does not accept attachments. Preserve what you have, but do not hold up warnings or a buyer’s bank call while assembling the folder.
2. Send buyers who paid to their payment provider immediately
Ask whether money was sent and which payment method was used. The FTC’s payment-recovery guidance directs victims to contact the company that handled the payment immediately and request a refund or reversal. For bank transfers, contact the bank; for card payments, contact the issuer; for payment apps, report through the app’s official support.
For a bank wire, the FBI specifically advises asking the sending bank to recall the transfer before filing an online complaint. The buyer should use independently verified contact information, such as the number on their card or their banking app.
Give staff this wording: “Please contact your payment provider now and explain that someone impersonating this dealership obtained your payment. Ask what they can do to stop or recall it.” Tell buyers to describe accurately whether they authorized the payment after being deceived.
Do not promise reimbursement. Ask buyers to keep transaction receipts for their bank and investigators, rather than sending your sales team full account numbers or financial statements.
3. Publish one warning and provide independent verification
Post a dated notice prominently on your genuine website and through established social accounts. Give reception and sales staff the same wording, and contact shoppers already known to have encountered the impersonator. Use an existing conversation or verified contact record rather than details supplied by the fake site.
A warning can follow this template, with the brackets replaced by confirmed information:
Someone is using our dealership’s identity to request payments through an unauthorized website. Our genuine website is [official address]. Before sending money, independently verify our contact details and confirm the payment instructions with our store. If you have already paid the impersonator, contact your payment provider immediately.
Identify confirmed fake domains as non-clickable text or in a screenshot. Do not turn the warning into another route to the scam.
Give staff a verification script: “You do not have to trust this call. Use contact details from previous dealership paperwork you know is genuine, or ask the state dealer-licensing office how to verify our business. Then call back before paying.” Offer an in-person visit or a buyer-appointed inspection rather than demanding immediate trust.
Wisconsin DMV recommends checking its active dealer list and independently researching contact information. A license listing establishes that the dealer exists; it does not establish that a particular website or payment request belongs to that dealer.
4. Request removal from the providers serving the fake site
Send the evidence to the fake site’s hosting provider and domain registrar. The host serves the website’s content; the registrar manages its domain registration. These reports seek to interrupt the impersonation, while crime reports serve a different purpose.
Use ICANN’s registration lookup to identify the registrar. ICANN’s abuse-reporting guide explains where to find registrar abuse contacts and calls for specific evidence. Ask your web provider to identify the host rather than assuming it is the same company.
Submit through each provider’s official abuse channel. Include the fake URLs, your genuine website, screenshots and an explanation of how shoppers are being asked to pay. Establish your authority to represent the dealership, and describe suspected fraud rather than reporting only that someone copied a logo.
If the technical lookup points to an intermediary, follow the referral to the actual host. Cloudflare, for example, explains that its pass-through services do not host website content and that it forwards relevant complaints to the hosting provider.
Report the specific ads and social profiles directing shoppers to the clone as well. Google’s ad-reporting instructions explain how to flag an ad and identify the business it impersonates. Record ticket numbers and requests for further evidence so someone owns each follow-up.
5. File crime reports without treating them as takedown requests
Submit the dealership’s impersonation report through the FBI’s IC3 complaint form. Encourage affected buyers to report their own transactions, including information they should provide directly to investigators rather than through your staff. Clearly distinguish the genuine dealership from the impersonator in every report.
IC3 says it analyzes complaints and shares them with appropriate agencies; investigation is at those agencies’ discretion. Save the submitted report before closing the page. An acknowledgment confirms submission, not that the website has been disabled.
The Consumer Financial Protection Bureau also directs scam victims to their state attorney general and local police. For Wisconsin consumers, or consumers dealing with a purported Wisconsin business, Wisconsin DATCP provides a complaint route and assistance at 800-422-7128. Wisconsin DMV separately accepts complaints concerning vehicle-sale scams.
Avoid false reassurance and verify what changed
Do not announce that there was no breach merely because your homepage still loads. Equally, do not shut down a verified, unaffected website solely because someone copied it: shoppers need somewhere to find your warning.
Measure progress by what your team can verify. Ask the web provider to recheck reported URLs and redirects, and confirm whether the associated ads and profiles remain accessible. Follow up on unresolved tickets and log newly reported domains instead of closing the incident after one removal.
Check that reception can deliver the warning and explain independent verification without improvising. A provider’s acknowledgment is paperwork; confirmed removal addresses the reported page, not every possible copy.
Start with a named incident lead and the shopper’s exact URL. If money has already moved, the buyer’s payment-provider call takes priority over completing your evidence file.
Frequently asked questions
What if a shopper entered their Social Security number on the fake site?
Direct the shopper to identity-theft protection guidance even if they have not lost money. The FTC points people who disclosed their Social Security number, but do not know whether it has been misused, to its IdentityTheft.gov protection guidance. Record that information was exposed, but do not ask the shopper to send your dealership another copy of the sensitive application.