Week 37: How fake company websites are used for online fraud

16.09.2025 - Classified ad fraud is among the offences reported most frequently to the police, and it is also frequently reported to the NCSC. The fraudsters target both sellers and buyers. When you buy something on the internet, you have to decide whether to pay first and then have the item delivered, or await delivery and then make the payment. Where a large sum of money is involved, so-called trust services come into play: a trust service provider retains the amount paid until the item is safely delivered. This week's review shows that fraudsters go to great lengths to get around these trust services and achieve their ends.

A beautiful motorhome at a reasonable price – an ad such as this on a classified ads platform arouses great interest. In the case investigated here, the alleged seller stated in the advert that she used to work in Switzerland, moved to Sweden and then wanted to sell her motorhome. To convince prospective customers, she sent them emails with plenty of photos along with a copy of a vehicle registration document, using the company email address of her new employer in Sweden. Everything seemed to be in order. However, the motorhome was also in Sweden and could not be handed over in person. So the question arose: how to pay? Normally for higher amounts, payment is not made until the buyer receives the purchased item. However, sellers want to receive payment before dispatching items.

An apparently trustworthy TSP

In such cases, trust services come into play. When a vehicle or other valuable item is bought or sold via an online marketplace, there are often legal and organisational challenges involved. Uncertainties regarding contract design, missing documentation or unclear payment modalities may soon lead to conflicts. Digital trust service providers (TSPs) help by providing model contracts, electronic signature services and secure and transparent payment processes.

An alleged TSP website. The page is an exact copy of a genuine website; only the link is different.
An alleged TSP website. The page is an exact copy of a genuine website; only the link is different.

In our case of the motorhome, the seller proposed that the transaction be processed via an existing TSP platform. However, the prospective buyer was given a link that had been very slightly modified to connect to a fraudulent site rather than the original one. The website looked deceptively genuine. However, the entire contract execution was fake and the payment was set to be transferred to a fraudulent account.

Deceptively genuine corporate appearance

In this case, the fraudsters have gone to considerable lengths. They use a company email address rather than a private one. Clicking on the website of the alleged company opens a well designed website of a company active in the solar sector. If the victim becomes sceptical and searches for the seller's email address, they are directed to the company website. The seller is the company's store manager and her name and email are listed. This information and the apparent seriousness of the website create the appearance of credibility – the seller appears to be a real and trustworthy person.

However, a look at the registration date reveals that the website domain has only been registered since April 2025. Moreover, there are numerous other companies under the same IP address whose websites are structured in exactly the same way, and they are also active in the solar industry and have the same registered office.

Two identical company websites that differ only in the name of the company and the store manager.
Two identical company websites that differ only in the name of the company and the store manager.

There are just following differences : the name and email address of the store manager and also the name of the company. These websites seem to have been created for the same purpose – to give the fraud an appearance of credibility.

Real photos, fake story

Further enquiries regarding the motorhome revealed that it was actually a hire vehicle. So it is not surprising that the fraudsters were able to get hold of pictures and even a photo of the vehicle registration document. But it is not known whether they actually rented the motorhome and took the photos or whether they obtained the data elsewhere.

Recommendations

  • Have a look at the ratings on the classified ad site. Check sellers' ratings. But bear in mind that reviews can also be bogus.
  • Alarm bells should ring if an offer is obviously too cheap.
  • For larger amounts, a trust services provider of your choice should handle the purchase. Make sure that the website you are on is genuine.
  • Choose payment/shipping options that are as secure as possible (e.g. cash on delivery).
  • Never send a copy of your passport or ID card. This applies whether you are buying or selling.

Last modification 16.09.2025

Top of page

https://www.ncsc.admin.ch/content/ncsc/en/home/aktuell/im-fokus/2025/wochenrueckblick_37.html