The FTC Says Scammers Are Cloning Dealership Websites With AI. Your Phone Is Now the Proof You're Real.

A consumer alert that is really about your store

On September 1, 2026, the Federal Trade Commission published a consumer alert with an unglamorous title: "Scammers are spoofing car dealership websites." The mechanics are simple and unsettling. Fraudsters clone a real dealer's website - "often using AI to do so," in the agency's words - copying the logo, the vehicle listings, and the photos "down to the last detail." Some of the fakes include fabricated customer testimonials. They lean on rare muscle cars and hard-to-find classics as bait, describe the buying process in reassuring detail, offer flexible return policies, and then ask for an upfront payment, frequently by wire transfer. The buyer shows up at the real dealership to collect a car nobody there has ever heard of.

The alert is written for shoppers. But read it from the other side of the counter and it is a memo to dealers, because the FTC's advice to consumers is, in effect, a checklist of what a nervous buyer is now going to do before trusting you. Search your name next to the words "scam" and "complaint." Ask to see the car and the store in person. Insist on an independent inspection if they cannot visit. And - implicit in all of it - call the dealership and confirm the deal is real.

That last step is the one this article is about. When the website can be faked in an afternoon, the phone becomes the place a shopper verifies that you exist, that the car exists, and that the price they were quoted came from you. It is a role your phone room did not have to play three years ago, and most stores have not staffed for it.

The myth: Impersonation fraud is a consumer problem. The dealer whose name gets borrowed is a bystander.

The data: Americans reported losing about $3.5 billion to imposter scams in 2025, nearly triple the 2020 figure, and roughly $1 billion of that was to criminals impersonating a business (FTC Consumer Sentinel, June 2026). When the impersonated business is your dealership, the shopper who got burned - and everyone they tell - does not remember the scammer's name. They remember yours.

Why this scam works now, and did not work before

Cloning a dealership website used to require skill and time. A convincing fake needed real design work, scraped inventory that stayed current, and copy that did not read like a phishing email. Generative tools have collapsed all three costs. A site can be duplicated, its listings rewritten, and a page of plausible five-star reviews produced in the time it takes to run a credit application. The FTC's alert names AI explicitly for a reason: the tooling that lets a legitimate store publish faster now lets an impersonator publish just as fast.

This is the same shift showing up elsewhere in auto retail fraud. In July, veteran theft investigator George Ripley told Car Dealership Guy that criminals are using AI to manipulate vehicle information and create synthetic identities, and that strategic cargo theft of vehicles - often through fake transport carriers built on stolen carrier credentials - has grown by roughly 1,400% (Car Dealership Guy, July 2026). Point Predictive estimates the auto-finance industry faced about $10.4 billion in fraud risk in 2025, up 13% from 2024 and 79% from a decade earlier (as reported by CBT News, September 2026). The common thread is not any single scheme. It is that the artifacts a shopper or a lender used to trust on sight - a website, a listing, a pay stub, a carrier number - are all now cheap to fabricate.

Ripley's summary of the situation is the one dealers should keep in mind: "Authentication is the name of the game." He was talking about VINs and transport paperwork. It applies just as squarely to the front door of your business.

The shopper's new verification routine - and where your store fails it

Put yourself in the position the FTC is now describing to the public. You have found a car online at what appears to be a real dealership two states away. The price is good. The site looks right. But you have just read that sites like this get cloned. What do you do?

You call. Not to negotiate - to check. You want a human at a number you found independently to confirm the stock number, the price, and that the person who emailed you actually works there. If the call goes to voicemail, you have learned nothing, and the small voice in your head that says "this might be the fake one" gets louder. If you get a receptionist who cannot see inventory and promises a callback, you have learned almost nothing. If you get someone who pulls up the unit, reads back the price, and tells you the salesperson's name, you have your answer in ninety seconds.

That is the new job of the inbound phone, layered on top of everything it already had to do. And the industry's baseline on the old job is not encouraging. Foureyes' 2026 benchmarks, drawn from more than a billion dealership website sessions, found the average caller waited about 73 seconds on hold before reaching a person, and that 42.7% of qualified sales leads were mishandled in some way (Foureyes, 2026). A shopper who is calling specifically to find out whether you are real does not have 73 seconds of patience. The hold music is, to them, evidence.

Notice what the FTC does not tell shoppers to do: trust the reviews. The alert points out that when scammers impersonate a real store, the reviews a buyer finds will be the real store's glowing ones. Your reputation, in other words, is being used as the scammer's collateral. The only thing the impersonator cannot easily borrow is a live, knowledgeable answer at your published phone number, from a system that can see your actual inventory. That is the asset to protect.

What a phone room built for verification looks like

The store that passes a shopper's authenticity test is not doing anything exotic. It is doing four unglamorous things consistently, at every hour a nervous buyer might call.

It answers, every time. Not most of the time. A verification call that rolls to voicemail at 7:40 p.m. is worse than useless; it confirms the shopper's fear. This is the same after-hours and overflow gap that costs stores appointments in ordinary times - see the real cost of missed calls - but the downside is now sharper, because the caller may conclude not just that you are busy but that you are not there at all.

It can confirm the specifics. "Yes, stock number 4471 is a 2019 Challenger, it is on the lot, and the internet price is what you saw." That sentence requires whoever answers - person or AI - to have live read access to inventory and pricing. A greeting script cannot do it. A message-taking service cannot do it. A connected system can.

It logs the contact and hands off cleanly. The shopper calling to verify is also, very often, a serious buyer. Capturing that call in the CRM with the vehicle of interest, and routing them warmly to the salesperson they were already speaking with, turns a defensive interaction into a sales one. The industry's answered-but-not-booked gap is where this usually breaks down.

It never asks for what a scammer would. No legitimate verification call should end with a request for a wire, a gift card, or a deposit by an unusual method. If your own process involves taking payment over the phone, this is a good week to look at how that is disclosed and confirmed, because the FTC has just told millions of shoppers that an upfront payment demand is the tell.

Where AI fits - carefully

It would be a little absurd to write that AI is the whole problem and then propose AI as the whole answer. The honest version is narrower. Generative tools have made impersonation cheap; the same category of tools can make verification cheap too, if they are deployed for that job and constrained to it.

A well-built AI voice agent is a reasonable fit for the verification role for three reasons. It is available at the hours impersonation victims tend to call - evenings and weekends, when the store is dark and the scammer's fake site is still open for business. It can be given live, read-only access to inventory and pricing, so it confirms specifics instead of taking a message. And it can log the interaction and hand off to a named human, which is the step that turns a suspicious caller into an appointment. We have written about the handoff design that makes this work in practice.

Three cautions belong next to that.

First, the agent must be unmistakably yours. Shoppers are being told to distrust anything that feels too smooth; an AI that will not say which dealership it represents, or that dodges a direct question about a stock number, reads as a red flag rather than a reassurance. Disclosure is not just a legal question - several states now require it, as we covered in AI disclosure law and the dealership phone - it is a trust question.

Second, the agent should confirm, not collect. A verification-era phone agent should be able to read back a price and a VIN. It should never be the thing that asks for payment details. If a caller offers them, the right behavior is a warm transfer to a person, on a recorded line, following your existing process.

Third, the phone is only as trustworthy as the number. If a scammer clones your site, they may also publish their own number on it. The defense is to make sure your real number is everywhere a shopper would look independently - the OEM locator, Google Business Profile, the state licensing record - and to ask shoppers, in your own marketing, to call the number they find there. Voice-cloning fraud cuts the other way, too: your customers may soon be as skeptical of calls from you as they are of websites. Consistency of number, name, and process is the only durable answer to both.

A short checklist for this week

• Search yourself the way the FTC told shoppers to. Your dealership name plus "scam," "complaint," and "fake." Set up a standing alert. If a clone exists, you want to find it before a victim does.
• Pull your after-hours answer rate. Not your daytime rate. The verification call that matters most is the one at 8 p.m. on a Saturday, and voicemail is a failing grade.
• Test the verification call yourself. Have someone outside the store call your main line, pick a unit off your website, and try to confirm price and availability. Time it. If it takes longer than two minutes or ends in "someone will call you back," fix the process before you buy anything.
• Give whoever answers - human or AI - read access to inventory. Confirming specifics is the whole point. A greeting is not verification.
• Publish your one real number everywhere, and say so. Add a line to your site and listings: "Confirm any deal by calling the number on our Google Business Profile." It costs nothing and it hands a nervous buyer a reason to trust you.
• Report clones fast. The FTC's ReportFraud.ftc.gov exists for exactly this, and your OEM and hosting provider will want to know. A takedown that happens in days rather than weeks protects the buyers and your name.

The measured takeaway

The FTC's alert is not evidence of an epidemic of cloned dealership sites; the agency did not publish numbers, and this is one scheme among many. What it does mark is a change in how shoppers are being told to behave. The official advice is now: do not trust the site, verify with the store. That advice makes your phone the last line of authentication a buyer has before they wire money to someone using your logo.

Stores that already answer every call, confirm specifics, and hand off cleanly are, without meaning to, well prepared for this. Stores that let calls roll to voicemail after six are not - and the cost of that has just gone up, from a missed appointment to a shopper who decides you might not be real.

If your store's phone is about to double as its proof of identity, it is worth asking whether the system answering it can confirm a real unit, a real price, and a real person at any hour. That is what Carbuki builds for U.S. dealerships - AI voice agents connected to your inventory and CRM that answer every call, verify the specifics, and hand the shopper to a human when it counts. If you want to pressure-test how your store handles the verification call today, we are glad to help.

Sources

• Federal Trade Commission, Consumer Alert, "Scammers are spoofing car dealership websites: What you need to know," September 1, 2026: https://consumer.ftc.gov/consumer-alerts/2026/09/scammers-are-spoofing-car-dealership-websites-what-you-need-know
• Federal Trade Commission, "FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025," June 15, 2026: https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025
• CBT News, "FTC warns car buyers about fake dealership websites and payment scams," September 2, 2026: https://www.cbtnews.com/ftc-warns-buyers-fake-dealership-websites/
• Car Dealership Guy News, "FTC issues alert on scammers spoofing dealers' sites," September 1, 2026: https://news.dealershipguy.com/p/ftc-issues-alert-on-scammers-spoofing-dealers-sites-2026-09-01
• Car Dealership Guy News, "U.S. auto theft declines 23% even as smarter, tech-driven schemes soar" (George Ripley, IAATI; ~1,400% rise in strategic cargo theft of vehicles), July 7, 2026: https://news.dealershipguy.com/p/u-s-auto-theft-declines-23-even-as-smarter-tech-driven-schemes-soar
• CBT News, "Cherokee Mitsubishi pays salespeople to flag suspected fraud" (Point Predictive estimate of $10.4 billion in 2025 auto-finance fraud risk), September 1, 2026: https://www.cbtnews.com/cherokee-mitsubishi-pays-salespeople/
• Foureyes, "2026 Automotive Dealer Benchmarks Report" (73-second average hold time; 42.7% of qualified leads mishandled), 2026: https://www.foureyes.io/blog/2026-automotive-dealer-benchmarks-report