You post your car for sale, and within an hour a friendly buyer messages: they are keen, but first, could you run a quick history report from this one particular site and send it over? The link looks official enough. It is not. This is one of the most common car-marketplace scams running right now, a phishing funnel dressed up as a routine vehicle check, and the goal is your credit card number and personal details. The buyer disappears the moment you pay. Here are the 7 signs that a car history report link is a trap, and the one move that shuts it down.
The scam works because the request sounds reasonable. Of course a buyer wants a history report. The trick is who buys it, and where. Learn these signs once and you will spot the funnel before you ever reach for your wallet.
How the scam works
A stranger posing as a buyer, or sometimes a fake seller, steers you to a specific “vehicle history” website and tells you to pay a small fee to pull the report. The site is a phishing page: you enter your card number and details, it charges you, and the scammer harvests everything you typed. Then the buyer ghosts. The Federal Trade Commission has warned about this exact play in its guidance on vehicle history report scams, and the pattern has only spread across Facebook Marketplace and Craigslist since. The signs below are how you tell the funnel from a real request.
1. They insist on one specific site you have never heard of
A genuine buyer will accept your car’s VIN and check it wherever they like. A scammer names one exact website and pushes you to use that one, because it is the site they control. If the name is not Carfax, AutoCheck, or another service you recognize, treat it as suspect. The tell is the insistence: they do not want a report, they want a report from their link. That is not how a real buyer behaves.
2. The link is a lookalike or an odd domain
Look hard at the address before you click. Scam report sites lean on tricks: a misspelled version of a known name, extra hyphens, or an unusual ending. Many of these funnels now redirect to addresses ending in .vin, a newer domain type, or hide behind a shortened link so you cannot see where it leads. If the URL looks even slightly off, or you cannot tell what the real destination is, do not open it. The domain is often the clearest giveaway.
3. It wants your credit card before it shows anything
The funnel’s whole purpose is your card details, so it asks for them early, usually framed as a “small fee” to see the report. Be clear on what is normal: paid services like Carfax do charge, but you go to them, not a link a stranger sent. And free checks, like a recall lookup or a title-history search, never ask for a card at all. A site pushed to you by a buyer that demands your card before it shows a thing is collecting numbers, not selling reports.
4. The buyer is oddly eager and offers full price sight unseen
Watch the buyer who agrees to your price without haggling, has not seen the car in person, and is warm and quick to move, then pivots to “just send me the report from this site first.” The eagerness is bait. A real buyer kicks the tires, asks about service history, and negotiates. Someone who skips all of that but urgently needs you to visit one website is running a script, and the report request is the payload.
5. It rushes you with pressure and fake competition
Urgency is the scammer’s oldest tool. Expect lines like “I have two other people interested, can you send it now,” or a claim that they are about to leave town and need to lock in the sale today. The pressure exists to stop you thinking. A legitimate transaction can wait an hour while you check things out. If a message is engineered to make you act before you reason, slow down on purpose, because that hurry is the point of the whole approach.
6. The site asks for far more than a VIN
A vehicle history lookup needs one thing: the VIN, or sometimes a license plate and state. If the page also wants your full name, home address, phone number, and card, or worse, tries to get you to log in with an email password, it is harvesting an identity, not running a check. The mismatch between what a VIN report needs and what the form demands is a bright line. When a “car report” asks for your personal life, close the tab.
7. They will not just buy the report themselves
Here is the move that ends it: tell the buyer you will happily give them the VIN so they can run any report they want, on any site they choose, and pay for it themselves. A real buyer says fine. A scammer keeps insisting you use their link, invents reasons only you can pull it, or goes quiet. Their entire plan depends on you being the one who enters a card on their page. Hand over the VIN, refuse the link, and the funnel collapses.
This is general safety information, not legal or financial advice. If you have already entered your card or personal details on a suspicious site, contact your bank or card issuer right away to flag the charge and protect the account, and consider reporting it to the FTC. Never enter payment or login details on a site a stranger sent you.
How We Made This List
We built these signs from how the scam plays out for people buying and selling cars online, and from consumer-protection warnings about report-site phishing. We focused on the tells you can check in the moment, before any money moves: who chooses the site, what the link looks like, what the form asks for, and how the other person reacts when you push back. Each sign points to the same safe habit, which is keeping the report in your own hands and off any link a stranger provides.
What To Know
- The scam pushes you to one specific “history report” site to capture your card and personal details, then the buyer vanishes.
- A real buyer accepts your VIN and runs their own report; a scammer insists on their link.
- Free VIN and recall checks never ask for a card, and paid services you go to yourself, not through a sent link.
- Odd domains, extra fields beyond the VIN, and urgency are the clearest red flags.
- Offer the VIN, refuse the link, and report or dispute anything if you already paid.
Frequently Asked Questions
Why would a car buyer ask me to buy a history report?
A real buyer usually runs their own report, so a request that you buy one from a specific site is a warning sign. In the scam, the “buyer” wants you to visit a page they control and enter your card for a small fee, which hands them your payment and card details. If a buyer genuinely wants a report, give them the VIN and let them check it wherever they choose. A serious buyer will do that without pushback.
How do I check a car’s history safely?
Use services you go to directly, not links sent by a stranger. Paid options like Carfax and AutoCheck are the well-known ones, and you reach them by typing their address yourself. For free basics, you can run a recall check and a title-history lookup through official government tools using the VIN. The safe rule is simple: you choose the site and type the address, so no one can steer you onto a lookalike page.
What is the .vin domain and why does it show up in these scams?
The .vin ending is a newer type of web address, and scammers have adopted it because it sounds car-related and lends a fake report site a veneer of legitimacy. Seeing .vin does not by itself prove fraud, but combined with a stranger pushing you to that link and a demand for your card, it is a strong signal to stop. Judge the whole picture: who sent it, what it asks for, and whether you can verify the site independently.
I already entered my card on one of these sites. What should I do?
Act quickly. Contact your bank or card issuer, tell them you entered your details on a fraudulent site, and ask them to watch for or block unauthorized charges, and to reissue the card if needed. Change any password you may have typed, especially if you reuse it elsewhere. You can also report the scam to the FTC. The faster you flag it, the more likely you are to limit any damage.
Does this scam only target sellers?
It hits sellers most often, since a fake buyer asking for a report is the easy setup, but buyers get a version too. A fake listing may tell you to confirm the car through one specific report site before you commit, steering you into the same card-harvesting page. Either way, the defense is the same: never enter payment details on a site someone else pushed you to, and verify any report tool independently.
What To Do Next
Next time a buyer or seller sends a report link, do not click. Offer the VIN, say they are welcome to run any report themselves, and watch how they react. Keep the deal on the marketplace’s own messaging, and if you already paid on a suspicious page, call your bank now. For more on buying and selling safely, browse the autos section, and the technology section has more on spotting online scams.