Fake Escrow Sites: How to Spot Them

An escrow scam on a car sale is, at bottom, a social engineering attack with a website attached. The website is the least interesting component. What makes it work is that the scammer controls which site you visit. Once you see that, most of the defense becomes procedural, and procedures can be followed under pressure, which is when you will need them. This piece treats the problem the way I would treat any failure mode: how the system is assembled, which tests reliably detect it, and the operating procedure that makes it irrelevant.

How a fake escrow scheme is assembled

The sequence is consistent enough to write down as steps.

1. A buyer contacts you, agrees to the price with little negotiation, and explains why they cannot see the car in person.
2. They propose escrow "for your protection." This is the clever part. You were probably worried about payment, and here is the buyer offering the safe option before you asked.
3. They name the escrow company and send a link. Sometimes the site uses a made-up brand. Sometimes it copies the name and design of a real, licensed company on a slightly different domain.
4. You receive an email that appears to come from the escrow service: funds received, secured, please ship the vehicle and the title within a set window.
5. A transporter arranged by the buyer collects the car. Often the same group runs a car shipping scam alongside the escrow front, so the pickup looks as legitimate as the paperwork.
6. The "release" never happens. The site goes offline, or starts asking you for an "insurance" or "activation" fee before it can pay out.

At no point did money enter an escrow account, because there was no escrow account. Every confirmation you saw was generated by the person who wanted your car.

The FBI's Internet Crime Complaint Center has published warnings about online vehicle sale fraud that leans on fake escrow and fake "buyer protection" programs, including scammers who misuse the names of well-known companies, copy their logos and email formats, and send a fake toll-free number that impersonates the company. Those warnings are written mostly from the buyer's side, but the mechanism is symmetrical. Sellers get the fake funds notice instead of the fake invoice.

Technical tells you can check in ten minutes

None of the checks below is conclusive alone. A well-run fake can pass two or three. Taken together, they shift the probability hard enough to act on.

The padlock row is the one I would underline if I could. People were taught for years that the padlock means "safe." It means the data between you and the server is encrypted. Scammers get free certificates in minutes. A secure connection to a criminal is still a connection to a criminal.

Licensing: the one check the site cannot fake

Every item in the table above is evidence. The license check is closer to proof, because it moves verification to a system the scammer does not control.

Internet escrow companies that serve the public are typically licensed by a state regulator. California's DFPI licenses escrow companies under the state's Escrow Law, and states such as Arizona, Idaho, Nevada, New Mexico, Oregon and Washington have escrow licenses of their own. Rules vary, and some states do not require an escrow license for this kind of business at all; one large internet escrow company's own licensing page lists Hawaii, Indiana, Massachusetts, Tennessee and Wisconsin as states with no license requirement. That is one more reason to stick with a long-established company you can verify, rather than whichever one is newest.

Run the lookup from the regulator's website, which you reach by typing the agency's address or finding it through a government search, never through a link on the escrow site. Match the company name, the license number and, ideally, the web domain on file. If the regulator's record lists a different website or a different phone number from the one you were sent, you have your answer. Then, separately, call the company on the number in the regulator's record and ask whether your transaction exists.

"Every confirmation the scammer sends you is generated by the scammer. So the test is simple: verify through a channel they cannot touch. The regulator's database, a phone number you found yourself, your own login. If the proof came from them, it is not proof."

Emily Chen

A procedure that makes the fake site irrelevant

The detection tests matter less once you adopt a procedure that never lets the buyer choose the channel. Here is the one I would use.

Choose the escrow company yourself, before you list or at least before any buyer suggests one. Pick a long-established, state-licensed company and verify the license as described above. Tell interested buyers up front that if they want escrow, this is the one. A legitimate buyer has no reason to object. A scammer cannot use a service they do not control, so they will argue for theirs, and the argument itself is the signal.

Open the transaction yourself, from the address you typed into your browser. Never log in through a link in an email, even one that looks right. Bookmark the real login page and use only that.

Ship nothing until your own logged-in dashboard shows the buyer's payment as received and secured. Status emails are notifications, not evidence. If the dashboard and the email disagree, the dashboard wins, and you should call the company on the verified number.

Agree in writing on the inspection period and what counts as acceptance, and keep the title until the escrow terms say it goes. Then document the car's condition at pickup with dated photos and video, including the odometer and the VIN plate.

If you have already shipped against a fake notice, report it immediately to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov, file a police report so the car's VIN is flagged as stolen, and alert the state regulator whose licensee was impersonated. Speed improves the odds of recovering the car before it is resold or exported.

Escrow is one payment option among several. For the rest of the closing process, from title signatures to the release of liability, see our selling a classic car guide. The common thread is the same throughout: verify through channels you control, and let nothing move until the verification is done.

Sources and notes

• FBI IC3 public service announcement: Fraudulent online vehicle sales
• Escrow.com: State escrow licenses and states with no license requirement
• New Mexico Financial Institutions Division: Escrow companies
• ICANN Lookup: domain registration data
• FTC consumer alert: Selling stuff online? Here's how to avoid a scam
• FBI Internet Crime Complaint Center: 2024 Internet Crime Report

Note: California's DFPI has posted alerts about fake escrow sites that display a real licensee's license number, including the number held by a well-known internet escrow company. You can search those alerts and verify any escrow license on the DFPI website.