Alleged “auto reports”: This is what lies behind the fraudulent scam in vehicle sales

Selling used vehicles via online platforms such as classifieds and mobile is not for the faint of heart: In addition to late-night messages or calls like “what’s your last price?” There are plenty of crooks who set all sorts of traps for inexperienced people. One of these scams appears again and again under changing names: alleged “motor vehicle reports”. We examined what this is all about.

The process of selling a used car online is usually something like this: The seller takes a few photos, collects the necessary information about the car and posts sales advertisements on platforms such as classifieds online. Interested parties contact us, ask questions, make price offers and ask for a telephone number to make things easier. Giving them out is generally not a good idea, but it often seems to be beneficial for a quick sale.

In one case we have (found on Reddit), the potential buyer asked via WhatsApp in impeccable German for more information about the car and an appointment to view it. After the seller made suggestions for a personal inspection, the alleged interested party changed his mind: he had to drive for a long time and would therefore prefer a complete vehicle report. The seller can download it by entering the license plate number or chassis number on the website “kfzabfrage.de”.

Imaginative vehicle query

So far, so good – but what kind of website is this? When you access “kfzabfrage.de”, the prospective buyer will initially be greeted by a meaningless, modular website, possibly AI-generated. The query is possible using a car license plate or vehicle identification number (VIN), but only the unknown authors know why a cyclist pictogram appears in the corresponding input field next to a truck and car.

After all, over 500,000 users worldwide as well as the well-known brands “Auto Bild” and “TopGear” allegedly trust the vehicle query (which, according to the logo, operates under the brand name “VinCheck”). A sample report can also be accessed: It contains some photos of the car as well as the mileage, performance (telltale: the use of the English abbreviation “hp” for horsepower) and a “stolen vehicle check”. And the layman asks himself: How is a web portal supposed to get all this information? Photos of accident damage do not appear in any public database, nor do position data or speedometer readings.

If you enter a license plate number like “CT-DE 1234” or a randomly rolled but syntactically correct VIN into the input field, the good news lights up: “Success! We have found the vehicle and its previous data.” It is now clear at the latest: It can only be a case of fraud, because the location code “CT” simply does not exist in Germany. Nevertheless, we want to know what the half-ass vehicle database knows about our car.

But she doesn’t want to tell us that without something in return – and of course that consists of providing our credit card details for the €19.99 report. Well, encouraged by the many credit card and Paypal logos, we go to the checkout. There we are greeted by another surprise: Suddenly there is no longer any talk of Paypal payment. Instead, the site operator accepts Google Pay, but we don’t have that “on hand” – so it has to be a credit card payment.

So we quickly generate a one-time credit card from the payment service provider of our choice – and run into the wall. Because “kfzabfrage” rejects it outright. The unknown operators may want to keep the option of (unauthorized) follow-up payments open. Payment works with another virtual credit card from the online bank Revolut. At least almost, because the Revolut app sounds an alarm within seconds.

The bank did not make the payment of €19.99 to a dealer called “Autostoria24” but blocked the card directly. Apparently automatic fraud detection systems have struck at Revolut. We will not disregard such vehement warnings and cancel the purchase. Instead, let’s see what we can find out about the background of the scam.

Who is behind it?

The research starts with the domain and its owners. “kfzabfrage.de” was registered on May 29, 2026, a week before this article was published. According to DENIC owner information, a company called AUTO INFORM on Ballifeary Road in Bamburgh, UK. The picturesque coastal village in north-east England is famous for its medieval castle. Under its Old English name Bebbanburg, it served as a place of longing and origin for the hero Uthred from Bernard Cromwell’s novel series of the same name, and is a popular film set and tourist attraction. But Bamburgh doesn’t have Ballifeary Road; it only exists in Inverness, five hours’ drive away.

When searching for this street, we noticed that there were two different logistics service providers with meaningless names and suspicious websites at the same fictitious address as the vehicle query portal. A lot of business for a village with 400 inhabitants – the suspicion is that the websites were also set up for fraudulent purposes and that the Northumbrian fantasy address is regularly recycled.

The alleged email addresses of the domain owner also lead nowhere: the domain “autexa24.com” exists and is hosted by the US provider Cloudflare, but the website cannot be reached and cannot be found in the Wayback Machine. At least the second email address exists; it belongs to a domain escrow service from the Saarland company Key Systems. And the contact phone number? This is part of a service for free SMS reception and is therefore a disposable number.

Further evidence of the people behind it is sparse: the terms and conditions refer to a British company called “Datachecker Limited”, which, however, was officially liquidated in July 2025. The hosting is provided by GoDaddy in Strasbourg and the domain is registered via Key Systems. The strongest indication could be the dealer ID “autostoria24” when paying by credit card – this name leads to a vehicle parts dealer with a bad reputation who has apparently not been in business since 2025.

Keep your eyes open when selling your vehicle

Investigators repeatedly warn about the scam. The fraudsters not only steal almost 20 euros from their victims, but also their personal data and the VIN or license plate number. They can later use this to lend credibility to further fraud, for example by acting as a seller themselves and telling interested parties the VIN they got hold of as authentication.

A “vehicle report” such as the fraudulent prospective buyer requests from the seller does not exist in this form. If you as a seller are asked about this, you should break off contact immediately – it is a scam. If you have already paid, complain about the payment to your credit card company and have it reversed. Since it cannot be ruled out that the fraudsters will make further debit attempts, keep a close eye on the next credit card statements or even have the card blocked.

The fraudsters change domains every week or month and certainly come out with a variety of design templates. What they all have in common, however, is that they are part of a scam.

(cku)