Top News

The anatomy of a scam: How far fraudsters will go to steal your money

 Screengrabs of ad for the Ford Explorer.
Screengrabs of ad for the Ford Explorer. - Postmedia
OTTAWA, Ont. —

Buying a car should be simple.

So should online dating. Or paying an outstanding bill over the internet.

But, like so many things today, simple, mundane tasks have become prime targets for fraud artists around the globe. And Canadians are increasingly falling prey to their schemes.

Gone are the days a Nigerian prince would email you, promising untold riches in exchange for a small payment upfront. Today’s scams are more intimate. Fraudsters craft tailored messages and emails; fake identities; real world addresses for not-so-real companies; websites; phone numbers; a significant corporate presence online; multiple email addresses; and even apparent news coverage from reputable sources.

It’s elaborate. It needs to be.

But just how far are scam artists willing to go to get your cash?

While recently shopping for a car, this reporter stumbled across an advertisement for a 2016 Ford Explorer on The further this reporter engaged with the seller, the more convoluted the con became — and the more it revealed about the new lengths fraudsters are stretching as they try to convince people to part with their money.

The private ad looked simple enough: “my wife wants to sale (sic) her explorer to get a smaller SUV.” The price tag was a reasonable $23,050 and the ad claimed the vehicle had 90,211 kilometres on it.

This reporter emailed back — at first expressing genuine interest — and the seller replied claiming he was in the military stationed at Canadian Forces Base Halifax, but would be shipping out to join “Operation Impact” in the Middle East for a year. As a result, he needed to sell the vehicle. He said his name was Lt.-Col. Daniel Weiss.

Canadian Forces Base Halifax is an actual military outpost. It’s home to the Royal Canadian Navy’s Atlantic Fleet, has been in operation since 1906 and is the country’s largest military base in terms of number of personnel posted.

Operation IMPACT is also a real military operation ongoing in Iraq, Lebanon, Jordan and Syria. News about it was released as recently as April 8, when the Canadian government issued a statement outlining the operation’s involvement in Jordan to help rebuild a border road.

For an average person on the hunt for a used car and a good deal, the ad, so far, might appear legitimate. But the seller’s story wasn’t perfect.

There is no Daniel Weiss registered in Canadian military systems, according to officials with the Canadian Armed Forces. But that doesn’t mean the name is fake. A search for “Daniel Weiss” on Google brings up more than 70 million results. Among those results are several links for U.S. Army veteran Daniel Weiss who served with the 173rd Airborne in Afghanistan in 2005. Weiss was deployed three times, according to a blog post on the U.S. Department of Veterans Affairs website.

Weiss took his own life on March 4, 2012.

 The website of WXX Stormonth Logistics.
The website of WXX Stormonth Logistics.

According to Rachel Jolicoeur, director of fraud prevention and partnerships at payment processing firm Interac, giving the fake seller a high-ranking title in the military is an important part of setting up the fraud.

“Why does it matter that this guy is a person of authority? Well, that’s because a lot of Canadians will trust this individual in the army,” she said.

After realizing how fishy the car ad sounded, this reporter continued to play along, hoping more of the scam’s inner workings would be revealed.

The seller continued his story after another email from our end expressing interest: Seeing as he was deployed and out of the province, he claimed he had secured the help of a private company to assist with the sale of the vehicle.

“I’ve signed a contract with them and they will take care of the sale for me,” he said.

“This includes delivery, insurance, certification, they have all necessary documents in original and the power of attorney to sign the bill of sale. They will also perform a mechanical inspection and send the report to you. When the vehicle is delivered you will have 5 days to test drive and have it inspected by a mechanic. If you find any problems and don’t agree to buy it, they will pick up the vehicle. If you agree to buy it, after the inspection period, the ownership is changed to your name and the payment will be sent to me. You will not have to pay any fees regardless of your decision.”

He did not ask for money. Instead, he asked for a name, mailing address (to determine where the vehicle should be sent) and an email address to forward to the company through which he claimed to be selling the car.

Within hours of providing the info, this reporter received an email from someone named “Keira Watson” who worked in the “Vehicle Inspection Department” at a company called WXX Stormonth Logistics. Watson said the vehicle was accident free, came with complete service records and that there was no “outstanding finance or debt” on the vehicle. She included links to a number of standard quality management certificates she claimed WXX Stormonth has obtained; including Vincotte Certification (ISO 9001), which is a Belgian mechanical safety certification, and Authorized Economic Operator (AEO) Certification, which is typically obtained by companies involved in international trade in North America, among several others.

There was a link to WXX’s website. Another link directed you to customer testimonials and feedback from clients. There was even a Value Added Tax number — in Canada that would be the company’s HST registration number — with a link to the European Union’s webpage offering information on the collection of taxation and customs.

 A fake Canadian Business Journal article.
A fake Canadian Business Journal article.

Finally, the email included an official looking report from an “Andrew Venna” who the company said is one of its licensed mechanics. Venna’s report states things a car buyer wants to hear, including that the transmission “performs without noticeable defects,” the engine, brakes and steering “passed” mechanical inspection and the tires have “27/32” tread depth left, or about 80 per cent life remaining.

It’s all very intricate and a lot to unpack, especially for someone who doesn’t have their guard up. That’s all part of the scammer’s plan.

“These criminals are relentless. When it doesn’t work, they just shift their methods. They try new tactics and when they find what works, they stick with it,” said Interac’s Jolicoeur. “They constantly evolve. All they need is a handful of people to fall for it in order for it to be worth it.”

On the corporate website for WXX Stormonth Logistics, visitors will find information that claims the firm was established in 1985 to “become a leading competitive global shipping and logistics company.” It’s full of reports about the services it claims to provide and the prices it offers.

A search for the company online finds dozens of links to articles about the business in well-known publications from Canada and the United States. (However, in a slight typing gaffe by the scam’s puppet master, the company is identified as both “WXX” and “WXK” Stormonth Logistics.)

“WXK Stormonth Logistics acquires European transportation and logistics provider,” read one headline on a webpage that looked like it came from The Canadian Business Journal, with an almost identical logo and a similar interface. The article claimed Stormonth had purchased P&O Ferries, a large provider of ferry services to France, Ireland and the United Kingdom.

Another piece claiming to be from Canadian Business Journal stated that “WXK Stormonth Logistics Expands Global Partnership with IKEA.”

A headline from Global News read: “Outlook bright for freight forwarders, says WXX Stormonth Logistics.”

A page that appeared to be from CBS carried the headline: “Despite big customer loss WXK Stormonth Logistics is on growth track.”

Another post claiming to be from Canadian Business magazine (which is unrelated to Canadian Business Journal), said: “For LTL truck pricing WXX Stormonth Logistics turns to AI.”

The headlines seemed to suggest business success for Stormonth Logistics, but digging into their claims turns up a different story entirely.

All of the articles were forged.

“I can confirm that we are not owned by this company,” said Dan Bridgett, a spokesman for P&O Ferries, who declined any further comment.

“Thanks for bringing this to our attention. We can confirm that they are not a supplier of IKEA,” said Stephanie Harnett, a spokeswoman for IKEA.

 A fake Canadian Business article.
A fake Canadian Business article.

The articles were created using the website templates of well-known publications, seemingly with the intention of giving the company more legitimacy online. The articles themselves were hosted on web servers, which appeared to originate in Romania or on anonymous servers protected by privacy company Cloudflare in the United States.

To make them look even more legitimate, the fake news articles all linked back to the real publications’ home pages. If a web surfer found the fake Canadian Business article, then clicked “home,” they would have been taken to Canadian Business’ actual webpage.

“We were unaware of this website before being contacted by the Ottawa Citizen,” said James Cowan, managing editor of Canadian Business. “This site is obviously not affiliated with Canadian Business in any fashion. We’re currently exploring all options to block these individuals from copying our website in the future.”

“We had no knowledge that the (Romanian) website was fraudulently linking back to our website. We have absolutely nothing to do with the content creation of these web pages that have been written and posted on that rogue site,” said Angus Gillespie, editor-in-chief of The Canadian Business Journal. “It appears each of the fraudulent postings involve a company called WXK Stormonth Logistics. The person or persons behind all of this, as of now unidentified, is falsely making it appear as if The Canadian Business Journal is the originator of this content to the public domain, which I repeat – we are not.”

Within hours of this reporter alerting the publications, many of the fake news articles were taken down.

When this reporter returned to the scammer to inquire about the vehicle, another email account jumped into the conversation. Someone claiming to be “Amanda Baurer” responded demanding the purchase price of the vehicle ($23,050) to cover the “vehicle price, the delivery costs and all other expenses.” The money was to be sent by e-transfer or Western Union. After they received the funds, the money would be held in “escrow,” Baurer said. More links are provided explaining the escrow process. A “contract” or “sales agreement” was also provided.

When we responded to Baurer’s email to inquire about seeing the car and making the purchase in person, the email account quickly replied: “Our office is located at 1660 Hollis Street, Halifax. You can visit us from Monday till Friday, 9 am till 6 pm in order to inspect/purchase the vehicle.”

The address provided is a real building. But WXX Stormonth does not have offices there. Even worse, it seems the fake firm has been communicating with other potential victims.

“We do not have a registered tenant in our building by the name of WXX Stormonth Logistics,” said Paul Hiscock the director of property management for Compass Commercial Realty, which manages the Centennial building at 1660 Hollis St. in Halifax. “We have received two other telephone inquiries asking us to confirm about a tenant who was supposed to be occupying space in the Centennial Building and confirmed to these people that they were not tenants in our building.”

This reporter sent another email to the scammer on April 30, with a link to Internet Protocol (IP) address-capturing software that was disguised to look like an e-transfer of funds. IP addresses are like mailing addresses on the internet, and can be used to reveal actual home addresses and online activity. The fraudster clicked the link on May 5, and revealed that their IP address was registered to a residential account in Austin, Texas.

A final email to the scammer asking for comment about their actions was not returned. said it is aware of the issue of fraudsters using its platform to try and pull off scams. The company said it encourages its users to be vigilant when buying and selling a vehicle online.

Due to the sheer volume of our marketplace — with over 400,000 classified listings and thousands being added each week — we understand that fraudsters will attempt to pose as being legitimate,” said Kevin Cheng, director of SEO and content at “This is a serious concern that we do not take lightly. When instances are reported, we work quickly with our moderators to remove the fraudulent vehicle listing from our marketplace. Consumers are encouraged to report fraudulent activities to law enforcement.”

According to Jeff Thomson, a senior intelligence analyst with the RCMP assigned to the Canadian Anti-Fraud Centre — which is jointly operated by the Ontario Provincial Police, the RCMP and the Competition Bureau — there were 466 reported attempts to defraud Canadians with fake car sales ads in 2018. Of those, 168 people fell victim to the scam, reporting losses of nearly $860,000.

“We created a project just so we could capture when people are seeing these fake ads and being sucked down this rabbit hole. It’s been going on for a long time,” he said. “They’ve gotten very good at doing these things. They can make almost any email or website look authentic. You’ve got all these authentic-sounding terms. You’ve got the names and business names that are real, to trick people into believing this is good and it makes sense. The spoof websites are the icing on the cake.”

If recent trends are any indication, things are about to get much worse. The FBI in the U.S. recently released its annual Internet Crime Report for 2018. It found that the number of complaints at its Internet Crime Complaint Center — which captures calls regarding internet-enabled theft, fraud, and exploitation — totalled 351,937 in 2018. Those complainants lost more than $2.7 billion to online criminals last year. The figures are a drastic increase from the 269,422 reports of fraud, totalling $800 million in losses, received by the FBI in 2014.

The FBI used the statistics to urge consumers to be more vigilant than ever when dealing with people online.

“The 2018 report shows how prevalent these crimes are,” said Donna Gregory, chief of the FBI’s complaint centre. “It also shows that the financial toll is substantial and a victim can be anyone who uses a connected device. Awareness is one powerful tool in efforts to combat and prevent these crimes.”

According to Interac, online fraud has become so complex that out of 1,064 Canadians who recently took part in a new study, more than 96 per cent failed to identify online fraud when they were presented with it. Even more troublesome was that many people who took the study believed the best way to deal with the fraudulent activity was to shut down their computer or turn off their internet browser.

“In today’s complex digital landscape, hackers are becoming increasingly sophisticated, which means it’s becoming more difficult to tell real from fake, phishing from friendly,” said Rob Fodor, chief data scientist and vice-president of fraud at Interac in a release.

 One scam involves fraudsters pretending to be from the CRA, and asking victims to transfer them money via Apple iTunes gift cards. - Cheryle Browne/Postmedia
One scam involves fraudsters pretending to be from the CRA, and asking victims to transfer them money via Apple iTunes gift cards. - Cheryle Browne/Postmedia

According to the Canadian Anti-Fraud Centre, cyber fraud is booming business for the bad guys.

Canadians reported a total of $97.7 million stolen as a result of online fraud in 2018. The amount is an increase over the $86.3 million in 2017 and a marked increase from the $83.3 million in 2016.

The methods used to steal money from unsuspecting victims vary. More than 760 Canadians reported $22.5 million stolen in 2018 due to online romance scams alone. The scam involves a fraud artist meeting a typically insecure person online, cultivating a relationship, then asking them for cash.

The move to use online dating to steal money shows exactly how creative criminals are getting, according to Rachel Jolicoeur of Interac.

“We’re finding that it’s increasingly difficult for criminals to steal from Canadians using old methods,” she said. “They constantly evolve. They’re going at it through trickery.

Jolicoeur referenced the “CRA scam” as an example — where a fraudster claims to be a government tax collector from the Canada Revenue Agency in order to extract money from victims in the form of e-transfer or even Apple iTunes gift cards.

“Who would have thought in the past about (scam artists) using the government to try to get money from us?”

Ottawa police are seeing some similar trends. While police haven’t moved to separate online fraud from overall reports of fraud, the police force’s most recent annual Crime Trends Report showed a total of 3,974 cases of fraud reported to police in 2017. That marks a jump of 15.7 per cent from the 3,434 cases reported in 2016. The number of fraud cases reported in 2017 is also a whopping 31 per cent higher than the five-year average.

What makes this all even more alarming is that only about five per cent of all fraud is actually reported to police, according to Thomson with the Canadian Anti-Fraud Centre. Most fraud is either reported to local police departments, who often can’t help when money has been sent to someone online and ended up in another country. Many simply don’t report the fraud due to embarrassment or shame.

“We conservatively estimate that we only capture five per cent of reporting. Fraud is under-reported, often because of stigma/shame, embarrassment, etc. and we do not have the capacity to handle all the calls or validate all the online fraud reports we receive,” said Thomson. “What we capture provides a snapshot of what is occurring in Canada.”

READ MORE: 5 of the most popular scams to watch out for

Copyright Postmedia Network Inc., 2019

Did this story inform or enhance your perspective on this subject?
1 being least likely, and 10 being most likely

Recent Stories